Alicloud Security Center Sas

Manage Alibaba Cloud Security Center (Sas) via OpenAPI/SDK. Use whenever the user needs Security Center resource operations, configuration updates, status qu...

Security Scan

The skill appears to do what it claims — discover and call Alibaba Cloud Security Center (Sas) OpenAPI metadata and guide SDK usage — with no unexpected network endpoints or installs, though the SKILL.md asks for credentials that the registry metadata does not declare.

Purpose & Capability

Name/description match the included material: SKILL.md and the Python script focus on discovering Sas OpenAPI metadata and guiding SDK/API calls. Minor inconsistency: the registry metadata lists no required environment variables, but the SKILL.md explicitly instructs use of Alibaba Cloud credentials (ALICLOUD_ACCESS_KEY_ID/ALICLOUD_ACCESS_KEY_SECRET and optional ALICLOUD_REGION_ID) and ~/.alibabacloud/credentials — these are reasonable for the stated purpose but should be declared in the manifest.

Instruction Scope

Runtime instructions are scoped to API discovery, calling Alibaba Cloud APIs via SDK/OpenAPI Explorer, and saving artifacts under output/alicloud-security-center-sas/. The README warns to ask before mutating operations and to follow least-privilege credentials. It does not instruct reading unrelated system files or exfiltrating data.

Install Mechanism

No install spec — instruction-only with a small helper script. The included script only performs an HTTPS GET from the official api.aliyun.com metadata endpoints and writes files under the skill output directory; no archives or third-party downloads are performed.

Credentials

The SKILL.md sensibly requests Alibaba Cloud credentials and an optional region; those are proportionate to managing Sas resources. However, the package metadata did not declare any required env vars or a primary credential, which is an inconsistency the user should be aware of before granting credentials.

Persistence & Privilege

The skill is not forced-always, is user-invocable, and does not request elevated platform persistence or modify other skills. It does not enable autonomous permanent presence beyond normal model invocation.

Assessment

This skill appears to be a straightforward helper for Alibaba Cloud Security Center: it fetches API metadata from api.aliyun.com and guides SDK/API calls. Before installing, note that SKILL.md expects you to provide Alibaba Cloud credentials (ALICLOUD_ACCESS_KEY_ID and ALICLOUD_ACCESS_KEY_SECRET or a ~/.alibabacloud/credentials file) even though the registry metadata did not list them. Only provide least-privilege credentials needed for the operations you want, and avoid running mutating actions without confirming region/resource IDs. If you need absolute assurance, ask the maintainer to update the manifest to declare the expected environment variables and to provide a signed source/homepage.

Category: service

Security Center

Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage resources for Security Center.

Workflow

1. Confirm region, resource identifiers, and desired action.
2. Discover API list and required parameters (see references).
3. Call API with SDK or OpenAPI Explorer.
4. Verify results with describe/list APIs.

AccessKey priority (must follow)

1. Environment variables: ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID Region policy: ALICLOUD_REGION_ID is an optional default. If unset, decide the most reasonable region for the task; if unclear, ask the user.
2. Shared config file: ~/.alibabacloud/credentials

API discovery

• Product code: Sas
• Default API version: 2021-01-14
• Use OpenAPI metadata endpoints to list APIs and get schemas (see references).

High-frequency operation patterns

1. Inventory/list: prefer List* / Describe* APIs to get current resources.
2. Change/configure: prefer Create* / Update* / Modify* / Set* APIs for mutations.
3. Status/troubleshoot: prefer Get* / Query* / Describe*Status APIs for diagnosis.

Minimal executable quickstart

Use metadata-first discovery before calling business APIs:

python scripts/list_openapi_meta_apis.py

Optional overrides:

python scripts/list_openapi_meta_apis.py --product-code <ProductCode> --version <Version>

The script writes API inventory artifacts under the skill output directory.

Output policy

If you need to save responses or generated artifacts, write them under: output/alicloud-security-center-sas/

Validation

mkdir -p output/alicloud-security-center-sas
for f in skills/security/host/alicloud-security-center-sas/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/alicloud-security-center-sas/validate.txt

Pass criteria: command exits 0 and output/alicloud-security-center-sas/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/alicloud-security-center-sas/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Prerequisites

• Configure least-privilege Alibaba Cloud credentials before execution.
• Prefer environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, optional ALICLOUD_REGION_ID.
• If region is unclear, ask the user before running mutating operations.

References

• Sources: references/sources.md