Aliyun Chatbot Manage

Use when managing Alibaba Cloud beebot (Chatbot) via OpenAPI/SDK, including the user asks to configure, query, or troubleshoot Alibaba Cloud chatbot resource...

Security Scan

The skill's described purpose matches its code (managing Alibaba Cloud Chatbot) but there is an incoherence: the registry metadata declares no required credentials while the SKILL.md explicitly instructs use of Alibaba Cloud access keys and a shared credentials file — the mismatch should be resolved before trusting this skill with secrets or running mutating actions.

Purpose & Capability

Name/description and included files align: the skill is for Alibaba Cloud 'Chatbot' management and includes a script to fetch OpenAPI metadata from api.aliyun.com. However, registry metadata lists no required credentials or env vars, while SKILL.md instructs the agent to use ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET and optionally ~/.alibabacloud/credentials for SDK/API calls. The included script itself only fetches public OpenAPI metadata (no credentials used), so the credential expectation appears to come from runtime SDK usage rather than the shipped script.

Instruction Scope

SKILL.md gives focused operational instructions (discover APIs, call SDK/OpenAPI Explorer, verify with describe/list APIs) and specifies output paths. It sensibly asks the agent to confirm region/resource IDs and to ask the user before mutating operations. Minor scope risk: it allows the agent to 'decide the most reasonable region' if ALICLOUD_REGION_ID is unset — this could lead to the agent performing actions without explicit user confirmation unless the agent follows the 'ask the user' guideline.

Install Mechanism

No install spec — instruction-only skill with one small Python script. The script performs HTTPS GETs to api.aliyun.com (an official-looking domain) using urllib.request and writes JSON/markdown under output/. No downloaded executables, no archives, and nothing is written beyond output/ directory by default.

Credentials

Registry metadata claims 'required env vars: none' and 'primary credential: none', but SKILL.md repeatedly prioritizes environment variables ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET and notes ~/.alibabacloud/credentials. That is a direct mismatch: the skill expects cloud credentials for SDK/API calls but does not declare them in its metadata. Requesting API keys for Alibaba Cloud would be proportionate for this purpose — the problem is the metadata omission, which could cause surprise when the skill requests or uses secrets at runtime.

Persistence & Privilege

The skill does not request persistent/always-on privileges (always:false). It doesn't modify other skills or system-wide settings. Output and artifacts are written to a local output/aliyun-chatbot-manage/ directory as documented.

What to consider before installing

This skill appears to do what it says (discover Chatbot OpenAPI metadata and help manage resources), but its metadata omitted the fact that SKILL.md expects Alibaba Cloud credentials. Before installing or running it: (1) confirm whether you'll need to provide ALICLOUD_ACCESS_KEY_ID and ALICLOUD_ACCESS_KEY_SECRET or a credentials file; (2) if you must provide credentials, create and supply least-privilege keys scoped only to Chatbot operations; (3) review and test the non-mutating script (python scripts/list_openapi_meta_apis.py) first — it only fetches public API docs; (4) avoid running any Create/Update/Modify actions until you explicitly approve them and verify the region/resource IDs; and (5) if possible, request the publisher update the skill metadata to declare required env vars so the permission model is clear. If you can't verify those, treat the discrepancy as a red flag and do not grant secrets or run mutating commands.

Category: service

Chatbot (beebot)

Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage resources for beebot.

Workflow

1. Confirm region, resource identifiers, and desired action.
2. Discover API list and required parameters (see references).
3. Call API with SDK or OpenAPI Explorer.
4. Verify results with describe/list APIs.

AccessKey priority (must follow)

1. Environment variables: ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID Region policy: ALICLOUD_REGION_ID is an optional default. If unset, decide the most reasonable region for the task; if unclear, ask the user.
2. Shared config file: ~/.alibabacloud/credentials

API discovery

• Product code: Chatbot
• Default API version: 2022-04-08
• Use OpenAPI metadata endpoints to list APIs and get schemas (see references).

High-frequency operation patterns

1. Inventory/list: prefer List* / Describe* APIs to get current resources.
2. Change/configure: prefer Create* / Update* / Modify* / Set* APIs for mutations.
3. Status/troubleshoot: prefer Get* / Query* / Describe*Status APIs for diagnosis.

Minimal executable quickstart

Use metadata-first discovery before calling business APIs:

python scripts/list_openapi_meta_apis.py

Optional overrides:

python scripts/list_openapi_meta_apis.py --product-code <ProductCode> --version <Version>

The script writes API inventory artifacts under the skill output directory.

Output policy

If you need to save responses or generated artifacts, write them under: output/aliyun-chatbot-manage/

Validation

mkdir -p output/aliyun-chatbot-manage
for f in skills/ai/service/aliyun-chatbot-manage/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-chatbot-manage/validate.txt

Pass criteria: command exits 0 and output/aliyun-chatbot-manage/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/aliyun-chatbot-manage/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Prerequisites

• Configure least-privilege Alibaba Cloud credentials before execution.
• Prefer environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, optional ALICLOUD_REGION_ID.
• If region is unclear, ask the user before running mutating operations.

References

• Sources: references/sources.md