Alibabacloud Aiops Skills

Guide users to manage Alibaba Cloud resources using the Aliyun CLI command-line tool. Covers CLI installation, credential configuration, plugin management, command construction, and error troubleshooting. Use this skill when the user wants to operate Alibaba Cloud services from the terminal — including ECS (云服务器, cloud servers), Function Compute (函数计算, serverless), RDS (云数据库, databases), OSS (对象存储, object storage), SLS (日志服务, log service), VPC (专有网络, networking), ESS (弹性伸缩, auto scaling), and any other Alibaba Cloud product. Also use when the user mentions "aliyun", "阿里云", "阿里云CLI", "命令行", asks about CLI plugin installation, encounters Aliyun CLI errors (InvalidAccessKeyId, SignatureDoesNotMatch, Throttling), or needs help constructing aliyun commands with correct parameter syntax.

Operate Alibaba Cloud CloudMonitor Service (CMS) AgentLoop ContextStore by using aliyun CLI with api version 2024-03-30. Use when users mention CloudMonitor, CMS, AgentLoop, agent loop, context, memory, experience, ContextStore, context store, 上下文库, 记忆库, 经验库, or ask to create/query/update/delete stores, write/search/update/delete context records, manage store API keys, or debug aliyun cms ContextStore commands.

Alibaba Cloud ECS extension installation skill. Supports querying available extension lists, checking if a specific extension is available, and one-click installation of extensions (e.g., OpenClaw, BT Panel, Python environments, etc.). Extensions are officially provided by Alibaba Cloud with verified installation packages and scripts. Triggers: "extension", "install", "BT Panel", "OpenClaw", "Python", "Node.js", "package", "one-click install"

Read-only cost diagnostics and audits for Alibaba Cloud database products (RDS, Redis, MongoDB, PolarDB, DTS, DBS, CDT): explain a high or spiking DB bill with billing-item breakdowns and month-over-month anomaly attribution, and run proactive audits of renewal/expiry risk, idle instances, and optional paid features — never modifying any resource. Triggers: "why is my database bill so high", "DB cost spike", "database cost anomaly", "database bill surged", "unexpected database charges", "unexplained database charge", "don't know what feature is charging me", "RDS bill breakdown", "billing item breakdown", "charged after instance deleted", "released instance still billed", "monthly DB cost trend", "cost increase root cause", "CDT bill", "cost audit", "database cost audit", "idle database instance", "idle instance still charging", "renewal lock", "about to expire", "unexpected auto-renewal charge", "DMS charges", "DAS billing".

Diagnose playback and streaming problems in user-provided media files and URLs (m3u8 / HTTP / RTMP / RTSP / SRT): moov atom position, codec compatibility (H.265/HEVC, AAC-HE, 10-bit), container issues, HLS playlist and TS segment integrity, bitrate/frame-rate anomalies, audio-video sync, and live latency factors such as B-frames and GOP size. Use when the user reports a video that will not play, shows a black or green screen, stutters or buffers, or asks for an HLS playlist, TS segment, or live stream latency check. Read-only. No credentials and no cloud API calls. Triggers: "video file won't play", "video black screen or green screen", "moov atom position issue", "HLS m3u8 playlist check", "HLS segment corrupted", "live stream latency or stutter", "TS segment analysis", "video codec compatibility", "media file format diagnosis", "B-frame or GOP structure analysis".

Create, track, and manage QianWen support tickets from the conversation: submit a new ticket, check ticket status and engineer replies, follow up, close, and rate — so platform issues get resolved without leaving the chat. Triggers: "submit ticket", "create ticket", "list tickets", "view ticket", "reply ticket", "close ticket", "rate ticket", "transfer to human", "work order", "customer service", "human support", "open ticket", "check ticket", "cancel ticket", "evaluate ticket", "ticket list", "support request", "escalate to agent". Do NOT use for general model usage questions, API Key management, or billing inquiries — only when the user explicitly needs ticket operations.

Alibaba Cloud WAF 3.0 read-only diagnostic assistant for interception diagnosis, rule queries, and configuration guidance. Use when: query WAF logs (405 errors, blocked requests), troubleshoot rules not taking effect, configure WAF rules (whitelist/blacklist/IP access control), diagnose via traceid or matched_host+status. Provides TEXT-ONLY console guidance. Uses `aliyun sls get-logs-v2` (SLS plugin required). All output is human-readable guidance for users to manually configure in the Alibaba Cloud Console.

Alibaba Cloud Cloud Firewall ACL rule read-only diagnostic assistant. **Trigger Scenarios**: Diagnose ACL rules not taking effect, troubleshoot Internet/NAT/VPC firewall traffic issues, query traffic logs, check matched rules, get configuration guidance (console manual operation). **Supported firewall types**: Internet Firewall, NAT Boundary Firewall, VPC Boundary Firewall **Keywords**: Cloud Firewall rules not taking effect, Internet Firewall ACL diagnosis, NAT Firewall policy not working, VPC Boundary Firewall rule diagnosis, firewall rule diagnosis ⚠️ **DO NOT use** for WAF issues - use alibabacloud-waf-rule-management skill instead. TEXT-ONLY console guidance. Queries and diagnosis only, no configuration changes.

Manage Alibaba Cloud Firewall (CFW) NAT Firewall (NAT boundary firewall): query firewalls and protection status, enable/disable the protection switch, assess which NAT gateways can be protected and produce a plan, run the creation pre-check, diagnose route-entry inconsistency (route-diff), prepare manual-mode diversion assets, create a firewall (auto or manual vswitch diversion), and change engine strict mode. Deleting/releasing a firewall is NOT supported: protection can be switched off, but the resource must be released by the user in the console. Use when users mention NAT firewall, NAT boundary firewall, NAT gateway protection, protecting private-network outbound traffic, opening/closing the NAT firewall switch, assessing how to enable protection, or diagnosing creation failures from inconsistent custom route entries. 管理阿里云云防火墙（CFW）NAT边界防火墙：查询防火墙与防护状态、开启/关闭防护开关、开墙评估与开墙方案、 创建预检查、路由条目不一致诊断、手动引流准备、创建NAT防火墙、修改引擎模式。不支持删除/释放防火墙， 需用户在控制台自行操作。适用于NAT防火墙、NAT网关防护、私网出方向防护、开关NAT墙、开墙评估等场景。

Alibaba Cloud EBS Disk Monitoring and Metric Analysis Skill. Query and analyze monitoring metrics for single or multiple cloud disks, supporting time-series aggregation and cross-disk analysis. Triggers: "EBS monitoring", "disk metrics", "cloud disk performance", "IOPS analysis", "BPS analysis", "disk monitoring data", "metric aggregation".

阿里云 PDS（智能云盘/网盘）文件操作技能。支持：文件搜索、上传、下载、重命名、移动、复制、创建文件夹、标签/备注、分享链接、文档/音视频分析、打包下载、图像编辑、以图搜图和 PDS 挂载盘（mountapp，将云盘挂载为本地磁盘）的安装与挂载。 当用户要操作其 PDS、网盘、云盘中的文件或空间时（包括仅说明重命名/移动/复制等操作的安全处理方式，不要求真实执行），或要把云盘挂载到本地像本地文件一样访问时，应使用此 skill。即使用户只是简单说"帮我从PDS下载"、"上传到网盘"、"把报告.pdf重命名"、"PDS里有什么文件"、"把文件打包下载"、"分析下这个文档"、"把云盘挂载到本地"、"安装挂载盘"，也应触发。 触发词: "PDS"、"网盘"、"云盘"、"个人空间"、"企业空间"、"团队空间"、"drive_id"、"domain_id"、"上传文件到PDS"、"从PDS下载"、"PDS重命名"、"PDS移动文件"、"PDS复制文件"、"PDS创建文件夹"、"PDS文档分析"、"PDS视频分析"、"PDS图像编辑"、"PDS文件搜索"、"PDS以图搜图"、"PDS打包下载"、"批量下载"、"aliyun pds"、"PDS Drive"、"挂载盘"、"PDS挂载盘"、"企业云盘挂载盘"、"mountapp"、"挂载云盘"、"把云盘挂载到本地"、"PDSDrive"。 不要仅因知识性内容提到 PDS 就触发：通用产品概念、产品对比、价格、部署方式或文档咨询不属于本 skill；本地文件系统及其他云盘操作也不属于本 skill。 Use this skill for operations on the user's PDS files or spaces, and for installing/mounting the PDS mount app (mountapp) to access the cloud drive as a local disk. Do not trigger for generic PDS product concepts, comparisons, pricing, deployment, or documentation questions.

Operate, run O&M for, and manage Alibaba Cloud through local commands, with no MCP configuration needed. CallCLI runs Alibaba Cloud CLI/API commands to create, read, update and delete resources of any product; RunScript runs Python batch scripts; RunIaC runs Terraform orchestration; plus API retrieval and official-document retrieval to follow the best-practice path. Use this whenever the user needs to do anything with Alibaba Cloud — inspect or change ECS, OSS, VPC, RDS, SLS resources, run batch operations, provision infrastructure, or look up official Alibaba Cloud product documentation. Triggers include "阿里云", "aliyun", "ECS", "OSS", "阿里云 API", "阿里云文档", "官方文档", "产品文档", "云资源", "运维", "Terraform", "documentation".

Agent-native CLI for managing ECS instances without public IPs, primarily for single-instance operations. It supports millisecond-level remote command execution, large file transfers up to 1GB, and TCP port forwarding. It offers four authentication modes: AK, RamRoleArn, CredentialsCmd, and CredentialsURI. Use it to run commands, deploy code, view logs, check processes, transfer files, set up port forwarding, or query and filter ECS instance lists.

Perform instance inspection on Alibaba Cloud Cloud-Native API Gateway, AI Gateway, and API Gateway, and query Cloud Monitor metric data. Use when the user needs to view monitoring metrics of gateway instances (such as CPU usage, memory usage, connections, network IO, bandwidth, rate limiting, etc.), obtain metric data for a specific point in time or time range, or evaluate resource utilization. Trigger scenarios include: "check if the Cloud-Native API Gateway has enough resources", "view monitoring data of the AI Gateway instance", "inspect this API Gateway instance", "how is the gateway performing", "check if the gateway has any anomalies", "check gateway health status", etc.

This skill should be used when the user asks to "导入阿里云资源到 Terraform", "terraform import 阿里云", "将现有云资源纳入 Terraform 管理", "阿里云资源迁移 Terraform", "生成 terraform state", "import alicloud resources", "阿里云 IaC 迁移", "阿里云 Terraform 导入", or needs to manage existing Alibaba Cloud resources with Terraform. Guides users step-by-step through environment check, authentication, resource discovery, HCL generation, state import, validation, and dependency graph. Supports both one-time migration and incremental sync.

Diagnose TLS/SSL certificate problems for a user-provided domain - trust chain verification, hostname/SAN matching, expiration check - with automatic DNS resolution and TCP connectivity root-cause analysis when a check fails. Use when the user reports a browser certificate error, HTTPS access fails and needs certificate-layer diagnosis, wants to verify a domain's TLS configuration, or asks for a certificate expiration check. Read-only diagnostics. Only checks domains the user explicitly provides. No write operations, no credentials required. Triggers: "certificate expired", "certificate not trusted", "SSL handshake failed", "hostname mismatch", "certificate check", "TLS certificate diagnosis", "HTTPS certificate error", "certificate validity check", "SAN mismatch", "certificate chain verification".

This skill installs and configures the **Tablestore Mem0** plugin for OpenClaw. Tablestore Mem0 uses Alibaba Cloud Tablestore as the vector store backend for mem0, providing persistent long-term memory for AI agents. Use this skill when the user wants OpenClaw to persist or manage long-term memory using Alibaba Cloud Tablestore as the backend. Triggers: "set up tablestore memory", "install tablestore mem0 plugin", "configure long-term memory with tablestore", "remember this".

Alibaba Cloud Milvus full-stack Skill for two planes: control-plane instance management via aliyun CLI, and data-plane Milvus operations via pymilvus. Use when users want to create, inspect, scale, configure, network-enable, or whitelist Alibaba Cloud Milvus instances; or connect to Milvus and perform collection management, vector insert/search, hybrid search, full-text search, index management, partition/database management, or RBAC with Python.

Alibaba Cloud ICP Filing Success Data Query Skill. Use for querying ICP filing success information including entity, website, app details and risk alerts after successful filing. Triggers: "ICP filing query", "beian query", "filing information", "filing risk", "query filing success", "备案查询", "备案信息", "备案风险".

Alibaba Cloud Live Recording Diagnostic Skill. Use for diagnosing live stream record issues including missing recordings, file generation problems, unexpected recording behavior, and callback issues. Triggers: "live record", "live stream record diagnosis", "record not working", "record file missing", "record callback issue", "录制诊断", "直播录制问题".

OOS template intelligent generation skill. Use when users need to create, write, or generate Alibaba Cloud OOS (Operation Orchestration Service) automation templates. Applicable for: generating OOS templates based on O&M requirements, querying available Actions and OpenAPIs, validating template syntax, iteratively fixing template errors. Triggers: "generate template", "create template", "write a template", "OOS template", "operation orchestration", "automation template", "help me orchestrate"

Read-only diagnostics for Alibaba Cloud CDN refresh and preload issues. Use when a URL/file/directory refresh or preload looks ineffective - refresh failed, preload failed, cache not cleared, or the task failed. Verifies task records and edge cache status, and produces a diagnosis report; never submits refresh/preload jobs. Triggers: "refresh failed", "preload failed", "cache not cleared", "purge not working", "prefetch not cached", "warm up ineffective", "invalidation unsuccessful", "pre-warming failure", "pre-fetching".

Read-only diagnostics for Alibaba Cloud CDN traffic and bandwidth anomalies. Use when CDN traffic or bandwidth suddenly spikes, the CDN bill jumps unexpectedly, traffic theft or hotlink abuse is suspected, or bps/flow/QPS trends need baseline comparison to locate anomalous time windows. Pulls usage data via aliyun CLI to locate anomalous windows, then forensically analyzes CDN offline access logs (four-dimension Top statistics, 13 theft rules, T1~T6 classification) and outputs an analysis report; never stops domains or changes any configuration. Triggers: "traffic spike", "bandwidth anomaly", "traffic theft", "unusual CDN traffic", "hotlink abuse", "CDN bill surge", "traffic suddenly increased", "bandwidth spike analysis".

Diagnose and troubleshoot Alibaba Cloud NAS mount failures. Use when users encounter NAS mount errors on Linux or Windows, including NFS and SMB protocol mount failures, network connectivity issues, permission group misconfigurations, security group port blocks, or specific error codes like "mount.nfs No such device", "access denied by server", Windows system error 53/58/64/67/85/1231/1272/1312/3227320323, and auto-mount failures on boot. Covers both General Purpose NAS and Extreme NAS file systems. Also handles container (K8s/Docker) NAS mount issues, cross-VPC/cross-account mount problems, and ECS cloud assistant batch mount failures.

生成从友商云（AWS、Azure、华为云、腾讯云）迁移到阿里云的迁移方案。当用户提供友商云产品列表时，给出产品映射和详细迁移方案。适用于用户提到"迁云"、"迁移方案"、"云迁移"、"从XX云迁移到阿里云"等场景。

Alibaba Cloud SLS (Simple Log Service) index configuration manager skill. Use this skill to help users inspect, create, update, or delete a Logstore index, generate an index configuration from user-provided structured log samples, and optimize an existing index configuration for given query/SQL workloads, write throughput, and storage cost — all through the aliyun CLI. Triggers: "SLS 索引", "索引配置", "create index", "update index", "delete index", "generate index", "optimize index", "全文索引", "字段索引", "log index config", "aliyun sls index".

End-to-end Alibaba Cloud PAI ResourceGroup (resource pool) lifecycle management via `aliyun paistudio`. Covers list / get / create / update / delete of ResourceGroups (general computing ECS or Lingjun GPU), read-only inspection of MachineGroups, and bind/unbind UserVpc. Use when the user asks to list / get / create / update / delete PAI resource groups, inspect machine groups, bind/unbind UserVpc, or audit resource-group capacity. Trigger phrases: "PAI resource group", "PAI resource pool", "Lingjun resource group", "create PAI resource group", "list PAI resource groups", "PAI machine group", "Lingjun resource group (灵骏资源组)", "PAI resource pool (PAI 资源池)", "PAI 资源组".

Inspect ECS instance health, detect anomalies in memory, disk, CPU, load, and resource leaks, and automatically trigger deep diagnosis when critical memory issues are detected. Suitable for routine inspections, troubleshooting, and risk warning scenarios. Trigger keywords: SysOM, inspection, instance diagnosis, memory_usage_rate, memory usage.

Yunxiao Flow Pipeline Troubleshooting and Solutions. Used to diagnose pipeline execution failures and provide fix recommendations. Trigger scenarios: Pipeline build errors, pipeline run failures, host deployment failures, k8s deployment failures, java build errors, python build errors, node build errors, unit test failures, image build failures, docker deployment failures, pipeline variable substitution errors, pipeline variables replaced with empty values.

Deploy Alibaba Cloud official tech solutions. Trigger when the user mentions an Alibaba Cloud solution, pastes a solution URL (aliyun.com/solution/tech-solution/...), or wants to deploy an official solution template. Covers both Terraform module deployment and CLI step-by-step execution paths.

Perform SysOM deep OS-level diagnosis on Alibaba Cloud ECS instances to identify root causes of performance issues (CPU spikes, memory leaks, IO latency, etc.). Use when users report ECS instance performance problems, need kernel-level troubleshooting, or want to set up continuous automated diagnosis with instance enrollment and DingTalk alert notifications.

Perform batch inspection on Alibaba Cloud MSE Nacos instances, checking configuration count usage, connection count usage, QPS usage, and TPS usage. Supports two modes: inspecting a specified list of instance IDs, or inspecting all Nacos instances in a region by region. Triggers when the user needs to perform health inspection, capacity assessment, or usage check on MSE Registration & Configuration Center instances, or when the user mentions "inspect nacos", "check nacos instance usage", "nacos capacity inspection", "MSE registry inspection", "nacos inspection", "check nacos config count", "nacos connection count over limit", "nacos QPS/TPS usage", "inspect all nacos in a region", "inspect nacos instances in cn-hangzhou", "check nacos usage across all regions"

Batch health inspection for Alibaba Cloud RDS MySQL instances. Supports single, multiple, or all-instance global scan with configurable time window (default 7 days, max 30). Outputs one HTML report per instance plus a summary HTML. Dimensions: instance basics, resource utilization (CPU/memory/disk/IOPS/connections), CloudMonitor alert history, top 20 space-consuming tables (DAS), slow log statistics (DAS), kernel-version / expiration checks. Cluster instances auto-detected; per-node metrics and slow logs. Triggers: RDS inspection, RDS health check, RDS MySQL inspection, Alibaba Cloud RDS inspection, batch/global/multi-instance inspection, slow log analysis, space analysis, RDS 巡检, 阿里云 RDS 巡检, 数据库巡检, 批量巡检, 慢日志分析, 表空间分析.

跨大数据引擎的 SQL 语法转换技能（DML/DDL/存储过程）。覆盖标识符、数据类型、函数、查询语法、分布/分区策略、存储过程/函数、外表等重写场景。目前已实现 Synapse → Hologres，框架为其他引擎对（如 SQL Server → MaxCompute、Hive → Hologres、PostgreSQL → Hologres、Oracle → MaxCompute 等）预留了可扩展位置（TODO）。当用户需要将 SQL/T-SQL/PL-SQL 从一个数仓转换到另一个数仓、跨源迁移查询语句、T-SQL 转 PostgreSQL、数仓 SQL 兼容性改写时使用。不适用于：表结构 DDL 迁移（用 ddl-trans）、ADF 工作流迁移（用 adf2dw）、数据集成作业生成（用 dw-di-generator）。已知局限：不支持递归 CTE、动态 SQL 拼接、SQL Server GEOGRAPHY/GEOMETRY 等空间类型；基于规则匹配，转换结果建议人工审核。

阿里云已签约客户安全产品配置基线体检与整改清单生成。扫描 WAF 3.0 / SAS / CFW / DDoS 四类产品共 60 项配置，按覆盖率/防护强度/响应时效/合规对齐/最佳实践五维度打分（百分制）， 输出 HTML 报告 + Excel 整改清单 + Markdown 摘要三件套。 何时使用：客户问"配置有没有问题/哪些没开/打几分"、CSM 月度巡检/续约前价值证明、 售前做安全基线审计、安全治理项目立项前评估。 不适用：写方案→security-solution-generator；底盘分析→security-customer-analysis； 月度拦截汇报→waf3-monthly-report/sas-security-report；等保→dengbao-calculator。 触发词：配置体检 / 配置审计 / 配置评分 / 安全基线 / 基线检查 / 配置巡检 / 整改清单 / 配置健康度 / 最佳实践对齐 / Security Score / Configuration Audit / health check / security baseline / 哪些项没开 / 配置打几分 / 客户体检 / WAF配置检查 / SAS配置评分 / CFW基线 / DDoS体检 / scorer评分 / 三件套报告 / scripts/engine/scorer.py / report_html.py / report_excel.py / report_markdown.py / health-report.html / remediation.xlsx / exec-summary.md / 配置项打分 / pip install + scorer.py / ImportError + scorer / 安全基线检查 + 依赖。 即使 Prompt 中直接给出 scripts/engine/scorer.py 等脚本路径或提及依赖安装， 仍属本技能调用场景，不可判为独立代码执行或通用 pip 运维任务。

Export and backup Alibaba Cloud WAF protection configurations for WAF 3.0 and WAF 2.0 instances. Supports both China mainland (cn-hangzhou) and international (ap-southeast-1) regions. Output format: Excel workbooks (.xlsx) with each data module as a separate sheet. Triggers: "WAF backup", "WAF config export", "WAF config backup", "protection config backup"

Alibaba Cloud DataHub full-lifecycle resource management skill. Use for creating, querying, updating, and deleting DataHub Projects, Topics, and Subscriptions via Aliyun CLI. Triggers: "datahub", "datahub project", "datahub topic", "datahub subscription", "datahub resource management", "streaming data management".

MaxCompute Quota Management Skill. Use for managing MaxCompute/ODPS quota resources including pay-as-you-go quota creation, query, and listing operations. Triggers: "MaxCompute quota", "ODPS quota", "create quota", "list quotas", "quota management", "CU management".

Quick BI-SmartQ skill with multiple data analysis capabilities: 1. **File Q&A**: Upload Excel/CSV files for intelligent analysis via Quick BI API 2. **Dataset Q&A**: Natural language queries on Quick BI platform datasets, with automatic intelligent table selection and matching 3. **Document Parsing**: Parse PDF/Word/Excel/CSV/images, extract text, and support extracting key fields to generate structured Excel 4. **Dashboard Skill Generation**: Auto-convert QuickBI dashboards into data query skills 5. **Data Insight**: Deep data insight analysis on Quick BI datasets 6. **Data Report**: Auto-generate professional data reports based on analysis results Use when users mention data analysis, smart Q&A, querying data, file analysis, document parsing, dashboard skills, data insight, or data reports.

Use this skill when the user needs help with a Flink Python or PyFlink job, especially on Alibaba Cloud Realtime Compute for Apache Flink (VVR): write, modify, review, or debug PyFlink jobs; explain or select Flink Python APIs; resolve package or file dependencies for PyFlink jobs; or prepare PyFlink job deployment.

Use when user explicitly asks Flink/Ververica/Realtime Compute Console workspace operations: 草稿(draft), SQL校验/执行, 部署(deployment), 作业(job), Session Cluster, namespace, 表(table), 成员(member), 变量(variable), 或 checkpoint timeout 诊断, especially with workspace/deployment/job IDs (w-*, d-*, j-*, sc-*, draft-*). Also use when prompt asks to test/verify Flink Console lifecycle flow, safety guardrails, or parameter validation for these operations. This includes prompts such as create draft, deploy draft, list deployments, start/stop job, create/list session cluster, get tables, list variables. Also use when prompt explicitly asks to run `python scripts/flink_ververica_ops.py` for Flink Console workspace operations. Do not trigger for unrelated "workspace" contexts or generic cloud/platform tasks (ECS, OSS, RDS, Kafka, Spark, Kubernetes, billing, weather). Do not trigger for Flink instance lifecycle operations (create/scale/delete/renew); those belong to alibabacloud-flink-instance-manage.

bash prefix: export LJ_SKILL_DIR="${LJ_SKILL_DIR:-$HOME/.qoder/skills/alibabacloud-lingjun-node-diagnose}" && source "$LJ_SKILL_DIR/lib/lj_init.sh" i18n: detect language each turn (CJK ratio ≥ 0.30 → LJ_LANG=zh, else en); inject LJ_LANG=zh|en prefix before source. Intelligent diagnosis for Alibaba Cloud Lingjun (regular & hyper) compute nodes: submit diagnostic tasks (BasicCheck / NodeHardwareCheck / CheckByAiJobLogs), produce structured diagnostic reports, propose repair plans (reboot / reimage / stop / report-node-status), track fault reports (list-fault-reports / describe-fault-report / stop-node-diagnostic). Read-only: list-clusters / list-cluster-nodes / list-cluster-hyper-nodes / describe-node / describe-hyper-node / list-syslogs / list-diagnostic-results. Triggers: "lingjun diagnose", "灵骏诊断", "灵骏排障", "GPU 故障", "硬件故障", "节点异常", "诊断节点", "重启节点", "重装节点", "灵骏修复", "报障", "终止报障", "syslog", "NodeHardwareCheck", "CheckByAiJobLogs", "BasicCheck", "fault report", "stop fault diagnosis"

阿里云 ECS 跨可用区灾备恢复技能。从现有 ECS 实例创建系统镜像，并在不同可用区部署新实例。 当用户提到以下场景时使用：可用区故障恢复、跨可用区备份、跨可用区实例克隆、ECS 灾备、 用镜像在其他可用区创建实例、"帮我做个镜像然后换个可用区创建实例"等。 也适用于：灾备实例、镜像备份、换个可用区创建实例、可用区容灾、 制作镜像、跨可用区创建、从镜像创建实例。 注意：本技能是"备份"而非"迁移"，不会释放或影响原始实例的资源。

Read-only query and diagnosis of Alibaba Cloud ActionTrail operation audit events: find out who performed which operation, when, from which source IP, and on which resource, across one or many regions, rendered as a 12-column event table or machine-readable JSON. Use when the user asks about the audit log or operation history of an Alibaba Cloud account; wants to know who changed, created, deleted, or operated on a resource; asks when a resource was operated on; needs to trace read/write operation records, console sign-ins, or API calls of a cloud service; or wants to investigate suspicious or failed operations recorded by ActionTrail. Triggers: audit log, operation history, operation records, who changed, who operated, who deleted, when was it operated, action history, read/write operations, ActionTrail, audit event, operation trace.

Read-only detection of website defacement/hijacking via page source, hidden SEO links, suspicious redirects, and cloaking, corroborated best-effort by Security Center and WAF. Use when a user suspects their website is hacked, reports an unauthorized web compromise, or has malicious code injected; sees abnormal redirects (even refresh-only), hidden black-hat SEO links, mobile vs desktop content differences (cloaking), or a defaced homepage. ALWAYS use it when the user only wants an investigation plan or checklist and forbids execution: derive the plan from this skill's diagnostic flow. Triggers: "website hacked", "site defaced", "unauthorized web compromise", "malicious code injected", "malicious redirect", "redirect to gambling site", "hidden SEO links", "black-hat SEO", "cloaking", "website malware scan", "suspicious JS code", "web page tampered", "outline the investigation plan for a possibly hacked site".

ECS Health Inspection - Perform comprehensive health inspection on Alibaba Cloud ECS instances. Checks CPU usage, system load, memory usage, disk IO (BPS and IOPS), network traffic, disk capacity, and GPU metrics (when applicable). Generates a structured HTML inspection report with findings and recommendations. Use when users request ECS health inspection, instance health check, performance inspection, resource usage report, or system health status of an ECS instance.

Alibaba Cloud PolarDB/RDS MySQL historical lock wait root cause analysis skill. Diagnoses and analyzes historical lock wait issues, identifies the complete lock chain and lock holder. Triggers: lock diagnosis, lock wait troubleshooting, deadlock analysis, PolarDB lock issue, RDS lock issue, lock wait timeout, transaction blocking, metadata lock wait, InnoDB lock analysis, database lock troubleshooting, MySQL lock wait, database performance troubleshooting, lock conflict analysis. Use when the user mentions database lock, deadlock, lock wait, transaction blocking, or slow queries related to locks.

Alibaba Cloud scenario-based skill. Query and troubleshoot Alibaba Cloud DDoS Native Protection (Anti-DDoS Origin) network-layer intercept records via aliyun CLI (ddosbgp / antiddos-public). Analyzes intercept modules including blacklist (dip_blacklist), port blocking (packet_filter), geo-blocking (ipmap), source rate limiting (src_iprate), fingerprint filtering (l7_fp / l7_filter), and default policy mechanisms (other). Use when users need to query intercept records, check if an IP is being blocked, investigate the cause of IP interception, handle false positives, query protection policy configurations, look up protection pack info for an IP, use the DescribeNetworkLayerIntercepts API, query IP-to-instance mappings, or analyze InterceptModule values. Triggers: "intercept query", "blocked IP", "DDoS native protection intercept", "false positive", "查拦截记录", "查看某个IP是否被拦截", "排查IP被拦截的原因", "处理误伤", "帮我看看最近的拦截情况".

查询阿里云四款安全产品（云安全中心 / WAF / 云防火墙 / RASP）对指定漏洞的防护覆盖情况，输入 CVE 编号或 AVD 编号即可返回各产品是否已覆盖。当客户或售前 SA 问"我们产品能不能防住 CVE-XXXX？"、"WAF 覆盖这个漏洞了吗？"、"新爆出来的 XX 漏洞有没有覆盖？"、"高危漏洞 YY 我们这边什么情况"时使用本 Skill。基于 avd.aliyun.com 高危漏洞库的离线快照（1697 条记录，覆盖 2002–2026 年），运行时纯本地 grep 查询，不联网、不调用浏览器、不需要任何凭证。也支持批量比对一组 CVE。

Diagnose why a configured Alibaba Cloud WAF 3.0 custom protection rule (custom ACL, CC / rate limiting, scan protection, IP blacklist) is not working: name the first broken link in the chain and hand back the console fix path. Read-only checks of configuration state only; never sends test traffic. Use it when a customer says a rule has no effect at all, a rule matches in the logs but nothing is blocked, an attack that should have been blocked got through, a rule worked yesterday but not today, or a CC or rate-limiting rule does not trigger or bans far too widely. Not for: explaining why one specific request was blocked or looking it up by trace_id, whitelist rule effectiveness itself, live attack sample validation, built-in rule toggles, config export, or reports. Triggers: "规则不生效", "规则配了但不生效", "自定义规则不生效", "预期拦未拦", "该拦的没拦住", "漏拦截", "规则命中但没拦", "规则昨天还好今天失效", "CC不触发", "误封面过大", "规则为什么没生效", "WAF rule not effective", "rule not taking effect", "rule hit but not blocked"

This skill should be used when the user asks about Alibaba Cloud ECS disk snapshots, including creating snapshots, listing snapshots, deleting snapshots, rolling back disks, configuring auto snapshot policies, calculating snapshot costs, managing snapshot lifecycle, or using snapshot consistency groups for crash-consistent backup of an entire instance. Triggers on phrases like "create ECS snapshot", "query snapshot list", "delete snapshot", "rollback disk", "auto snapshot policy", "snapshot cost", "snapshot consistency group", "crash-consistent backup", "consistency backup", or Chinese equivalents "创建快照", "查询快照列表", "删除快照", "回滚云盘", "自动快照策略", "快照费用", "快照一致性组", "一致性备份", "整机备份", "崩溃一致性备份", "整机崩溃一致性备份", and broader ECS disk maintenance intents such as "帮我处理一下 ECS 实例", "给云盘做备份", "ECS 云盘运维".

DataWorks Operations Center assistant for task and workflow operations, alert rule creation and management. Covers troubleshooting, failure recovery, baseline assurance, monitoring and alerting. Supports periodic, manual, and triggered tasks/workflows (excludes real-time/streaming tasks). Uses aliyun CLI to call dataworks-public OpenAPI (2024-05-18). Trigger keywords: query task, task instance, instance log, workflow, workflow instance, alert rule, operations center, task failure, instance status, upstream/downstream dependency, rerun, monitoring alert, custom monitoring, alert rule, task instance, workflow instance, operation log, baseline assurance, failure recovery, DataWorks operations. Do NOT trigger: data source management, compute resources, resource groups, data development, MaxCompute table management, ECS/RDS/OSS operations, workspace member management, data quality, data lineage, data preview.

DataWorks metadata Skill for Alibaba Cloud — browse Data Map metadata and perform non-destructive writes via Aliyun CLI. READ scope: list/get catalogs, databases, tables, columns, partitions; query data lineage (upstream/downstream impact); list/get datasets & versions; list/get metadata collections (Category/Album) and entities inside them; preview dataset version content. WRITE scope (non-destructive only): update table & column business metadata; register lineage relationships; create/update datasets and versions; create/update metadata collections and add entities to them. This Skill exposes NO delete or remove APIs — every `delete-*` and `remove-*` operation is intentionally out of scope. For deletions, use the DataWorks console. Triggers: "dataworks metadata", "data map", "data lineage", "meta collection", "dataset", "catalog", "table info", "column info", "partition", "impact analysis", "register lineage", "create dataset", "update business metadata".

Always use this Skill for any Alibaba Cloud DataWorks semantic analysis job or run request, including read-only and preflight requests that intentionally make no API call, such as checking whether the public DataWorks semantic OpenAPI or dataworks-public plugin commands (for example create-semantic-job) are ready. It also applies when the requested outcome is only a refusal or a user choice with no API call. This includes comparing or disambiguating supplied semantic job candidates, validating or refusing an unsafe, path-traversal, or non-writable semantic result directory before any download, and inspecting artifacts for an exact run. Use it to create, run, stop, monitor, diagnose, or download results for semantic jobs backed by MaxCompute, Hologres, StarRocks, or an already uploaded CSV/XLSX reference. Do not use it for ordinary metadata lookup, lineage analysis, SQL development, workflow scheduling, file upload, published semantic model/version management, or semantic job deletion.

Alibaba Cloud MaxCompute Cost Analysis Skill. Analyze MaxCompute pay-as-you-go costs including billing, storage metrics, and compute metrics. Triggers: "maxcompute cost", "odps cost", "maxcompute billing", "maxcompute费用", "成本分析", "费用分析", "存储用量", "计算用量", "费用突增", "SQL签名", "SQL signature", "重复SQL", "扫描量最大", "daily billing details", "每日账单明细", "按计费项", "billing by fee item".

Troubleshoot an Alibaba Cloud ECS Linux OS. Use when a user needs to diagnose a specified ECS Linux instance, such as instance stuck in Starting, boot stuck, SSH/VNC/Workbench login failure, network issues, disk/FS issues, performance anomalies, suspected mining or hidden processes, crash/hang, clock drift, or configuration not taking effect.

Create an agent platform instance in DMS via Alibaba Cloud OpenAPI. Supports Simple Mode and Advanced Mode. Use this skill when the user wants to provision, deploy, or set up a new Dify instance on Alibaba Cloud DMS.

Build and deploy applications to Alibaba Cloud ECS — Local build + script injection + InstallApplication async deployment. Triggers: build, deploy, CI/CD, compile & package, publish to Alibaba Cloud, diagnose, troubleshoot, root cause, 502, 503, service not started, deployment failed.

Pre-release SQL assessment and optimization for PolarDB MySQL. Combines 28+ static lint rules with Alibaba Cloud DAS dynamic diagnosis. Detects full table scans, missing indexes, dangerous UPDATE/DELETE without WHERE, schema design issues, naming violations, and provides index recommendations with cost estimation. Triggers when users ask to review SQL statements, assess SQL quality, optimize queries before deployment, validate DDL changes, check for SQL injection risks, analyze execution plans, or get DAS-based optimization suggestions for PolarDB MySQL instances.

Manage Cloud Firewall (CFW) Internet Firewall public IP protection switches on Alibaba Cloud. Use this Skill when enabling or disabling firewall protection for public IPs, querying asset protection status, batch protecting ECS/EIP/NAT/SLB resources, toggling all public IPs at once, or configuring auto-protection for new assets. Supports multi-account management via member-uid. 管理阿里云云防火墙（CFW）互联网防火墙的公网IP防护开关。 当用户需要开启云防火墙、管理互联网防火墙开关、查看公网IP是否受保护、 批量开启ECS/EIP/NAT/SLB等资源的防火墙、配置新资产自动防护时使用此Skill。 支持多账号管理（member-uid）。