Alicloud Platform Docs Api Review

Automatically review latest Alibaba Cloud product docs and OpenAPI docs by product name, then output detailed prioritized improvement suggestions with eviden...

Security Scan

The skill largely does what its description says (fetch and analyze Alibaba Cloud public docs), but its instructions request Alibaba Cloud credentials and mention mutating operations even though the bundled script only performs read-only web requests — this mismatch is unexplained and should be resolved before trusting the skill.

Purpose & Capability

The name/description (review Alibaba Cloud product & API docs) aligns with the bundled Python script, which resolves products via api.aliyun.com and scrapes product/help pages on aliyun.com/help. The script's HTTP requests and parsing are coherent with a docs-reviewer purpose.

Instruction Scope

SKILL.md tells the agent to configure Alibaba Cloud credentials, to include region/resource ids in evidence, and warns about 'mutating operations'. The provided script only performs read-only HTTP fetches of public metadata and docs pages and contains no code that reads credentials or performs mutating cloud operations. The instructions therefore overreach (scope creep): they ask for sensitive context not needed by the actual code.

Install Mechanism

No install spec; this is instruction-plus-script. No external downloads or unusual install actions are present in the bundle. The skill will only write outputs to a local output/ path when run.

Credentials

SKILL.md recommends environment variables ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET and optionally ALICLOUD_REGION_ID, but the skill metadata declares no required env vars and the script contains no references to these variables or to any credentialed API calls. Requesting credentials (even as a prerequisite) is disproportionate to the script's observable behavior and is an unexplained mismatch.

Persistence & Privilege

always is false and the skill does not attempt to modify other skills or system configs. The script writes output only under output/alicloud-platform-docs-api-review/, which matches the SKILL.md output policy.

What to consider before installing

This skill appears to be a genuine docs/audit tool that fetches public Alibaba Cloud metadata and help pages, but the documentation asks for Alibaba Cloud credentials and warns about mutating ops even though the bundled script doesn't use credentials or make mutating API calls. Before installing or running it: 1) Do not provide ALICLOUD access keys to the skill unless the developer can justify them and show where they are used in code. 2) Inspect the full script locally (you already have it) and, if possible, run the provided py_compile/validation in an isolated environment to confirm behavior. 3) If you must run it on a system with network access, verify that network calls go only to expected domains (api.aliyun.com, www.aliyun.com, help.aliyun.com) and that no unexpected endpoints are contacted. 4) Ask the maintainer to either remove the credential recommendation from SKILL.md (if unnecessary) or to declare required env vars in the skill metadata and explain why they are needed. These steps will reduce the risk of accidental credential exposure or unexpected privilege escalation.

Alibaba Cloud Product Docs + API Docs Reviewer

Use this skill when the user gives a product name and asks for an end-to-end documentation/API quality review.

What this skill does

1. Resolve product from latest OpenAPI metadata.
2. Fetch latest API docs for default version.
3. Discover product/help-doc links from official product page.
4. Produce a structured review report with:

• score
• evidence
• prioritized suggestions (P0/P1/P2)

Workflow

Run the bundled script:

python skills/platform/docs/alicloud-platform-docs-api-review/scripts/review_product_docs_and_api.py --product "<product name or product code>"

Example:

python skills/platform/docs/alicloud-platform-docs-api-review/scripts/review_product_docs_and_api.py --product "ECS"

Output policy

All generated artifacts must be written under:

output/alicloud-platform-docs-api-review/

For each run, the script creates:

• review_evidence.json
• review_report.md

Reporting guidance

When answering the user:

1. State resolved product + version first.
2. Summarize the score and the top 3 issues.
3. List P0/P1/P2 recommendations with concrete actions.
4. Provide source links used in the report.

Validation

mkdir -p output/alicloud-platform-docs-api-review
for f in skills/platform/docs/alicloud-platform-docs-api-review/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/alicloud-platform-docs-api-review/validate.txt

Pass criteria: command exits 0 and output/alicloud-platform-docs-api-review/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/alicloud-platform-docs-api-review/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Prerequisites

• Configure least-privilege Alibaba Cloud credentials before execution.
• Prefer environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, optional ALICLOUD_REGION_ID.
• If region is unclear, ask the user before running mutating operations.

References

• Review rubric: references/review-rubric.md