Aliyun Skills

Manage Alibaba Cloud resources using the Aliyun CLI tool. Use this skill whenever the user wants to manage any Alibaba Cloud resource via the aliyun CLI, inc...

Security Scan

The skill's requests and instructions are consistent with its stated purpose (managing Alibaba Cloud via the aliyun CLI); it asks for no unrelated credentials and uses a reasonable install method (Homebrew).

Purpose & Capability

Name/description align with required binaries and instructions: the skill is an instruction-only helper for the Aliyun CLI and references service-specific command patterns and examples. Required binary (aliyun) and the brew install of aliyun-cli are proportional to the stated purpose.

Instruction Scope

SKILL.md instructs the agent to construct and run aliyun commands, perform describe/list calls to discover resource IDs, and only run mutating/destructive commands after explicit confirmation — this is expected. The instructions reference configuration (e.g., ~/.aliyun/config.json and `aliyun configure`) and possible environment variables for STS tokens; they do not instruct the agent to read arbitrary unrelated system files. Note: because the skill performs cloud management actions, it inherently can cause destructive or cost-incurring changes if commands are executed with credentials that permit such actions.

Install Mechanism

Install spec uses Homebrew formula 'aliyun-cli' (creates 'aliyun' binary), which is a standard, low-risk packaging method. The reference docs also show optional manual curl download for Linux from GitHub releases (an expected, traceable source) — nothing appears to pull from unknown/personal servers or use obfuscated installers.

Credentials

The skill declares no required environment variables or primary credential. The reference docs describe normal authentication methods (AccessKey, ECS RAM role, STS tokens) and recommend using least-privilege RAM roles; asking for those credentials when performing actions would be expected and proportional. There are no unrelated credential requests.

Persistence & Privilege

always:false and normal user-invocable/autonomous invocation settings are used. The skill does not request permanent platform presence or modification of other skills. It may read/use the user's existing aliyun CLI configuration when invoked, which is expected for a CLI helper.

Assessment

This skill is an instruction-only helper for the Aliyun CLI and is internally coherent, but be aware of practical risks: 1) It will build and suggest commands that can create, modify, or delete cloud resources — always verify destructive commands before running and confirm costs. 2) The skill does not require credentials itself, but to act it will rely on whatever Alibaba credentials are present on the host (configured via `aliyun configure` or environment variables); prefer least-privilege RAM users/roles rather than root account keys. 3) Installing the CLI via Homebrew is low risk; the README also shows optional curl-based installs from GitHub releases (verify URLs if you follow those instructions). 4) Do not paste long-lived AccessKey/secret pairs into chat; instead configure them securely on the machine or use temporary STS tokens. If you want extra safety, keep the CLI uninstalled or use read-only credentials until you need mutating actions.

Aliyun CLI Skill

This skill teaches you how to use the Aliyun CLI to manage Alibaba Cloud resources. You will construct and explain aliyun commands, interpret their output, and guide users through cloud resource management tasks.

Quick Reference

Resource	Reference File	Common Operations
Setup & Auth	references/setup.md	install, configure, switch profiles
ECS (Elastic Compute Service)	references/ecs.md	list, start/stop/reboot, resize disk, create snapshot
VPC (Virtual Private Cloud)	references/vpc.md	manage VPCs, VSwitches, EIPs, NAT gateways, route tables
OSS (Object Storage Service)	references/oss.md	buckets, upload/download, sync, presigned URLs
RDS (Relational Database Service)	references/rds.md	instances, databases, accounts, backups, IP whitelist
SLB / CLB (Load Balancer)	references/slb.md	create LB, manage listeners, add/remove backend servers
RAM (Resource Access Management)	references/ram.md	users, groups, roles, policies, access keys
DNS (AliDNS)	references/dns.md	list domains, add/update/delete records
ACR (Container Registry)	references/acr.md	instances, namespaces, repositories, image tags, docker login

Read the relevant reference file before responding to a request.

CLI Syntax Pattern

Every aliyun command follows this structure:

aliyun <Product> <Operation> [--Parameter Value ...]

• Product: service name in PascalCase or lowercase (e.g., ecs, oss, vpc, rds, ram)
• Operation: API action name in PascalCase (e.g., DescribeInstances, StartInstance)
• Parameters: prefixed with -- (e.g., --RegionId cn-hangzhou, --InstanceId i-xxxx)

OSS is an exception — it uses a subcommand style like aliyun oss ls, aliyun oss cp.

Always Check These First

Before constructing any command:

1. Region — Most operations require --RegionId. Common regions:

   • cn-hangzhou (Hangzhou), cn-beijing (Beijing), cn-shanghai (Shanghai)
   • cn-shenzhen (Shenzhen), ap-southeast-1 (Singapore), us-west-1 (US West)
   • If the user hasn't specified a region, ask or use aliyun configure get to find the default.

2. Resource IDs — Most mutating operations (start, stop, delete) need a specific resource ID. If the user hasn't provided one, first run a Describe/List command to find it.

3. Pagination — Describe* APIs return paginated results. Default page size is typically 10. Use --PageSize 100 and --PageNumber to retrieve more. Mention this if results seem incomplete.

4. Dry run — Aliyun CLI does not have a universal dry-run flag. For destructive operations, always confirm resource IDs with the user before executing.

Output Formats

The CLI supports multiple output formats via the --output flag:

• Default: JSON (structured, good for parsing)
• --output cols=<col1>,<col2> — tabular output for quick scanning
• --output table — aligned table

For human-readable summaries, use --output cols=InstanceId,InstanceName,Status style where available.

zsh gotcha: If you use rows=Instances.Instance[], the [] will be interpreted as a glob by zsh and cause a "no matches found" error. Quote the argument to avoid this:

aliyun ecs DescribeInstances \
  --output 'cols=InstanceId,InstanceName,Status' 'rows=Instances.Instance[]'

Or simply omit rows= and use the default JSON output when tabular formatting isn't critical.

Common Workflow Pattern

When the user asks to perform an operation on a named resource (e.g., "restart my server called web-prod"):

1. Discover — Run a Describe command to find the resource ID

   aliyun ecs DescribeInstances --RegionId cn-hangzhou
   

2. Confirm — Show the result and confirm the target with the user if there's any ambiguity
3. Act — Run the mutating command with the confirmed resource ID
4. Verify — Optionally run another Describe to confirm the new state

Error Handling

Common errors and what to do:

Error	Cause	Solution
InvalidAccessKeyId	Wrong or expired credentials	Run aliyun configure to reconfigure
Forbidden.RAM	Insufficient RAM permissions	Check RAM policy for required action
IncorrectInstanceStatus	Wrong instance state for operation	Describe instance status first
InvalidRegionId	Unsupported region for this product	Check product availability in that region
Throttling	API rate limit hit	Add a brief delay and retry

If the user has not yet installed or configured the CLI, read references/setup.md and guide them through it before attempting any commands.

Safety Guidelines

• For destructive operations (delete instance, release EIP, drop RDS database), always:
  1. Show the user what will be deleted with a Describe command first
  2. Explicitly ask for confirmation before running the delete command
• For cost-incurring operations (create ECS, purchase bandwidth), mention the cost implications
• Never expose or log AccessKey secrets — remind users to use RAM roles or environment variables instead of hardcoding credentials

Parallelism

When the user needs to operate on multiple resources (e.g., "list all instances in all regions"), you can run several commands and combine the results. For shell loops:

for region in cn-hangzhou cn-beijing cn-shanghai cn-shenzhen ap-southeast-1; do
  echo "=== $region ==="
  aliyun ecs DescribeInstances --RegionId $region
done