alibabacloud-aiops-skills

Use when creating, editing, or reviewing WAF 3.0 custom Lua extension plugins, plugin parameters, or request validation logic.

Export and backup Alibaba Cloud WAF protection configurations for WAF 3.0 and WAF 2.0 instances. Supports both China mainland (cn-hangzhou) and international (ap-southeast-1) regions. Output format: Excel workbooks (.xlsx) with each data module as a separate sheet. Triggers: "WAF backup", "WAF config export", "WAF config backup", "protection config backup"

Use when the user operates Alibaba Cloud Container Service for Kubernetes (ACK). Covers cluster lifecycle (create / modify / delete / upgrade), node pools & nodes (create, modify, delete, repair, fix CVE), addons (install / upgrade / uninstall), KubeConfig & RBAC (issue for RAM user, grant / revoke), security & policy (CVE scan/fix, policy governance, KMS, delete protection), logging / audit / alerting, intelligent O&M (check / inspect / diagnosis / auto-repair), async tasks (track / pause / resume / cancel), templates, autoscaling, tags & quotas. Triggers: create / upgrade / delete ACK cluster, migrate to Pro, scale nodepool, fix node CVE, install / remove addon, get / revoke kubeconfig, grant RBAC, enable audit log, run inspection, diagnose cluster, track task_id, debug cs error, Forbidden.RAM, kubectl cannot connect. Terms: ACK, container service, k8s cluster, nodepool, addon, AutoMode, Terway, Flannel, ForRegion, kubeconfig, RBAC, CVE.

Read-only query and diagnosis of Alibaba Cloud ActionTrail operation audit events: find out who performed which operation, when, from which source IP, and on which resource, across one or many regions, rendered as a 12-column event table or machine-readable JSON. Use when the user asks about the audit log or operation history of an Alibaba Cloud account; wants to know who changed, created, deleted, or operated on a resource; asks when a resource was operated on; needs to trace read/write operation records, console sign-ins, or API calls of a cloud service; or wants to investigate suspicious or failed operations recorded by ActionTrail. Triggers: audit log, operation history, operation records, who changed, who operated, who deleted, when was it operated, action history, read/write operations, ActionTrail, audit event, operation trace.

Perform SysOM performance profiling on ACK cluster Pods to identify root causes of Pod-level performance issues (CPU throttling, OOM, memory distribution, network jitter, IO latency, etc.). Use when users report ACK Pod performance problems or need kernel-level container profiling.

Perform SysOM deep OS-level diagnosis on Alibaba Cloud lingjun node to identify root causes of performance issues (CPU spikes, memory leaks, IO latency, etc.). Use when users report lingjun node performance problems, need kernel-level troubleshooting, or want to configure DingTalk alert notifications for SysOM diagnosis reports.

Perform SysOM deep OS-level diagnosis on Alibaba Cloud ECS instances to identify root causes of performance issues (CPU spikes, memory leaks, IO latency, etc.). Use when users report ECS instance performance problems, need kernel-level troubleshooting, or want to set up continuous automated diagnosis with instance enrollment and DingTalk alert notifications.

Perform SysOM deep diagnosis on Alibaba Cloud PAI products (EAS / DLC) to identify root causes of instance-level issues. Use when users report: - EAS instance anomalies, GPU OOM (out of memory), GPU memory out-of-bounds errors - Slow first-token latency, uneven request scheduling across model service instances - OOM (Out Of Memory), insufficient memory, processes being killed - Abnormally high system load, high IO latency, network jitter, packet loss - Instance crashes, unexpected restarts, kernel oops - DLC training job hangs, communication timeouts, per-step throughput degradation - Any issue related to EAS instance health, DLC job health, or underlying compute resource performance

Enterprise Agent application observability skill. Read-only analysis of user-specified Agent trace (trace_id) Trajectory data, covering 6 business scenarios (task review / failure diagnosis / latency analysis / consumption analysis / multi-Agent collaboration / tool quality) with behavioral insights (decision-cause and behavior-chain perspectives), producing a self-contained HTML observation report. Triggers: "Agent observability", "Agent behavioral insight", "trajectory analysis", "Trajectory", "trace analysis", "LLM Trace", "agent observability", "LLM application observability", "Agent observation report", "LLM latency analysis", "token consumption".

Install Alibaba Cloud Agent Toolkit end-to-end: verify and set up prerequisites (uv, Alibaba Cloud CLI, authentication, CLI plugins, MCP Server Core, bearer token exchange), then install the toolkit via the current client's supported plugin mechanism. Use when: alibabacloud agent toolkit install, environment check, prerequisite check, setup alibabacloud, plugin install, toolkit setup, mcp core setup, aliyun CLI setup.

Execute code in a secure cloud sandbox via AgentBay SDK. Use this skill whenever users request to run, execute, or evaluate code (Python, JavaScript, R, Java), including plotting charts, running scripts, or viewing code output. Covers requests like "run this code", "execute script", "plot with Python", "run data analysis".

Operate Alibaba Cloud CloudMonitor Service (CMS) AgentLoop ContextStore by using aliyun CLI with api version 2024-03-30. Use when users mention CloudMonitor, CMS, AgentLoop, agent loop, context, memory, experience, ContextStore, context store, 上下文库, 记忆库, 经验库, or ask to create/query/update/delete stores, write/search/update/delete context records, manage store API keys, or debug aliyun cms ContextStore commands.

Operate Alibaba Cloud AgentLoop Dataset resources with aliyun CLI and the AgentLoop API version 2026-05-20. Use when requests concern AgentLoop datasets, data rows, Dataset schemas, embedding fields, semantic search, ExecuteQuery, AgentSpace data, 数据集, 数据写入, 数据查询, 语义检索, or ask to create/list/get/update AgentLoop datasets, append structured rows, run read-only SQL or SearchExpr queries, inspect query results, or debug aliyun agentloop Dataset commands.

Orchestrate AgentLoop evaluation workflows through the Aliyun CLI plugin with safe previews, saved evaluator and evaluator-skill management, one-shot sample tests, trace or dataset batch runs, polling, and result inspection. Analyze evaluation quality and low-score cases from SLS. Use for natural-language requests to create or update evaluators or evaluator skills, launch or monitor evaluation tasks, inspect evaluation results, diagnose low scores, troubleshoot evaluation API calls, and simplify AgentLoop evaluation commands.

Connect a cloud or sandbox Agent to Alibaba Cloud Agent Data Gateway (Dgate) through its managed MCP service, or install/reinstall the Dgate CLI and its local Agent Skill/Rule bundle on macOS, Linux, or Windows. Use when the user asks to configure a Region-bound Dgate MCP endpoint and AccessToken, set up Dgate without installing a binary, install the dgate command, refresh the bundled dgate-cli skills, or verify either access path.

Proactively use AgentLoop Recall to retrieve prior Alibaba Cloud AgentLoop experience through the bundled SearchContext CLI whenever the user asks or implies that prior work may help. Trigger for requests to check, search, recall, retrieve, look up, review, consult, reference, or compare prior experience, historical troubleshooting cases, past fixes, comparable incidents, lessons learned, old runbooks, previous remediations, or successful workflows before or during work. Also trigger for Chinese requests such as 先查历史经验、回忆类似案例、召回过往排障记录、看看之前有没有处理过类似问题、 参考以前怎么处理、找找之前的踩坑记录、翻一下历史排障、有没有类似经验、先看看过去的案例.

The skill should be used when the user asks about Alibaba Cloud AgentLoop platform for onboarding applications into observability, high-code instrumentation with loongsuite-genai-utils and OpenTelemetry SDK (高代码埋点、LLM Trace 字段、上下文传递与链路串联), Live-Debug runtime diagnostics, managing Datasets, building pipelines, and evaluating. Live-Debug covers ServiceTask dynamic logging, snapshots, metrics, spans, and JVM inspection.

当用户想体验、探索或获取 GitHub 热门 AI 开源项目的云端一键部署推荐时触发此技能，此技能由2部分组成：1）前端页面通过「AI尝鲜实验室」页面展示AI项目，「AI尝鲜实验室」页面地址：https://www.aliyun.com/daily-act/ecs/ai-innovation-lab；2）后端的一键部署能力由计算巢通过预置部署模版能力来实现，「计算巢 computenest」是阿里云的一个产品。适用场景：用户询问「最近有什么好玩的AI项目」「怎么一键部署GitHub上的AI工具」「有没有适合新手或小白的AI体验平台」「AI尝鲜实验室有哪些项目可以玩」「想在云端零门槛跑AI应用」。触发关键词：AI尝鲜、云端AI体验、AI实验室、一键部署、零代码部署、GitHub热门AI开源。不触发：已部署应用的运维排查（如工具变卡/迁移/费用）、项目数量或分类统计查询、AI框架或技术选型对比咨询（如PyTorch vs TensorFlow/内部项目采购）。用户直接点名"AI尝鲜实验室"、"AI Innovation Lab"、或提到"阿里云 + 一键部署 + AI项目"的组合时，不得再去外部平台搜索别的同名站点，也不得推荐"通义灵码 / DevOpsGPT / MetaGPT / Meeo / Dify / Flowise"等其他工具，应直接按本技能模板输出。

Submit Alibaba Cloud AISC Skill file security scans, poll scan tasks, diagnose API or upload failures, and interpret scan reports for malicious code, prompt injection, hardcoded credentials, sensitive data, risky configuration, and other Skill package security findings. Use when the user asks whether a Skill package or Skill file is safe, wants to scan/check/detect a Skill package, provides one or more Skill download URLs for AISC security detection, asks to run or poll CreateSkillFileCheck/ListSubTasks, asks about check-report.json or rootTaskId status, needs help with permission/parameter/throttling/system scan errors, or needs to choose between multiple candidate Skill files for security scanning. Trigger phrases include AISC scan, Skill security check, Skill file check, Skill 安全检测, Skill 文件安全扫描, 扫描 Skill 包, 检测 Skill 是否安全, and 检查 Skill 文件有没有恶意代码/敏感凭据/prompt 注入.

Investigate an Alibaba Cloud AccessKey (AK) leakage incident and produce a read-only investigation report. Use when the user reports a leaked / exposed / stolen / compromised Alibaba Cloud AccessKey (AK / AK-SK / access key / secret key / RAM credential); receives an AK-leak alert, risk notification, SMS, or email; finds an AK/secret exposed on GitHub, Gitee, a public repo, logs, or config files; needs AK-leak incident response, post-theft investigation, or risk assessment; or wants to trace a leaked AK's malicious operations, attack chain, created sub-users (RAM users), or new AccessKeys.

Diagnose Alibaba Cloud ACK cluster ALB Ingress reconcile errors, Warning events, and configuration issues. Use this Skill when users report: ALB Ingress errors, reconcile failures, AlbConfig sync problems, Ingress not working, ALB configuration not taking effect, actions/conditions annotations not working as expected, certificate not updating, listener errors, or any ALB Ingress related abnormal behavior. Supports matching 61+ known error patterns from the knowledge base.

Inspect ECS instance health, detect anomalies in memory, disk, CPU, load, and resource leaks, and automatically trigger deep diagnosis when critical memory issues are detected. Suitable for routine inspections, troubleshooting, and risk warning scenarios. Trigger keywords: SysOM, inspection, instance diagnosis, memory_usage_rate, memory usage.

Alibaba Cloud AnalyticDB for MySQL Operations & Diagnosis Assistant. Supports cluster info queries, performance monitoring, slow query diagnosis, running SQL analysis, table-level optimization suggestions, etc. Triggers: "ADB MySQL", "AnalyticDB", "cluster list", "slow query", "BadSQL", "data skew", "idle index", "SQL Pattern", "space diagnosis", "table diagnosis", "performance monitoring".

Implement AI Coaching best practices on AnalyticDB for PostgreSQL (ADBPG): Leverage Supabase projects (training data management) + ADBPG instances with vector optimization to build RAG-driven coaching systems that guide users through domain-specific workflows, decision-making, or skill development. Use when: User wants to create Supabase projects (spb-xxx), ADBPG instances (gp-xxx), vector knowledge bases, or RAG-driven coaching systems on ADBPG. Triggers: "Supabase", "ADBPG", "vector database", "knowledge base", "RAG", "AI coaching", "coaching system", "spb-xxx", "gp-xxx"

ADBPG Knowledge Base Management: Create knowledge bases, upload documents, search, Q&A. Triggers: "knowledge base", "document library", "document upload", "knowledge search", "RAG", "Q&A", "embedding", "ADBPG", "AnalyticDB PostgreSQL"

Manage the full lifecycle of ADBPG Supabase projects. Use for listing/querying projects, create, pause/resume, reset password, API Keys, and security IP management. Triggers: "Supabase", "supabase project", "spb-xxx", "ADBPG Supabase"

Analyze and troubleshoot Alibaba Cloud AnalyticDB (ADB) Spark applications—execution monitoring, failure diagnosis, performance anomaly detection, and cross-application comparison. Use this Skill when users need to: 1. Check the execution status of AnalyticsDB Spark applications (running, succeeded, failed, etc.). 2. Analyze root causes of failed AnalyticsDB Spark applications (e.g., OOM, data skew, dependency errors, permission issues). 3. Identify Spark applications with abnormal execution duration by statistical analysis. 4. Compare similar Spark applications to pinpoint performance anomalies or detect SQL execution plan differences. Also applicable for "why did my Spark job fail", "which Spark app is running slow", "compare two Spark runs", etc.

Perform instance inspection on Alibaba Cloud Cloud-Native API Gateway, AI Gateway, and API Gateway, and query Cloud Monitor metric data. Use when the user needs to view monitoring metrics of gateway instances (such as CPU usage, memory usage, connections, network IO, bandwidth, rate limiting, etc.), obtain metric data for a specific point in time or time range, or evaluate resource utilization. Trigger scenarios include: "check if the Cloud-Native API Gateway has enough resources", "view monitoring data of the AI Gateway instance", "inspect this API Gateway instance", "how is the gateway performing", "check if the gateway has any anomalies", "check gateway health status", etc.

Use Alibaba Cloud DashScope API and LingMou to generate AI video and speech. Seven capabilities — (1) LivePortrait talking-head (image + audio → video, two-step), (2) EMO talking-head, (3) AA/AnimateAnyone full-body animation (three-step), (4) T2I text-to-image (Wan 2.x, default wan2.2-t2i-flash), (5) I2V image-to-video (Wan 2.x, default wan2.7-i2v-flash, supports T2I→I2V pipeline), (6) Qwen TTS (auto model/voice by scene, default qwen3-tts-vd-realtime-2026-01-15), (7) LingMou digital-human template video with random template, public-template copy, and script confirmation. Trigger when the user needs talking-head, portrait, full-body animation, text-to-image, text-to-video, or speech synthesis.

AI image creation skill supporting text-to-image, image editing, image understanding, and more. Uses qwen-image-2.0-pro, wan2.7-image, qwen3.5-plus and other models. Use this skill when users need to generate images, edit images, analyze image content, or perform image-related tasks. Note: on first run, it will auto-manage DashScope API Keys (create/recycle) and may auto-install the Alibaba Cloud CLI ModelStudio plugin.

Explain, evaluate, demonstrate, provision, and integrate Alibaba Cloud Bailian Managed Agent (CMA / ManagedAgents). Use for Bailian Managed Agent product selection, sales pitches, customer solutions, hands-on PoCs, scheduled report agents, managed environments, and Python/Java backend integration. Prefer Bailian CLI (bl) for quick trials and resource provisioning; use HTTP API or verified SDKs for customer system integration, and API fallback when CLI capability remains unavailable after an update attempt. Not for generic agent development or unrelated cloud sandboxes.

Manages conversation memories and user profiles in Alibaba Cloud Bailian (Model Studio) Memory Library via DashScope REST APIs. Covers memory extraction from conversations, direct content saving, semantic memory search, memory fragment maintenance, user profile queries and updates, plus memory project and profile schema administration. Use when the user requests memory library ("记忆库") operations such as "add memory", "search memory" or "user profile". Prerequisites: (1) Configure DashScope API Key (2) Activate Bailian Memory Library service. Do NOT use for Bailian RAG knowledge base retrieval or document search.

Alibaba Cloud Bailian Knowledge Base Retrieval Tool. Use HTTPS API to query and retrieve knowledge base content. Use when: User needs to query knowledge base, retrieve document content, or answer questions based on knowledge base. Prerequisites: (1) Configure DashScope API Key (2) Activate Bailian Knowledge Base service.

AI video creation skill supporting text-to-video, image-to-video, reference-to-video, video editing, and video understanding. Uses wan2.6-t2v, wan2.6-i2v, wan2.6-r2v-flash, wanx2.1-vace-plus, qwen3.5-plus and other models. Use this skill when users need to generate videos, edit videos, or analyze video content. Note: on first run, it will auto-manage DashScope API Keys (create/recycle) and may auto-install the Alibaba Cloud CLI ModelStudio plugin.

Alibaba Cloud Bailian Video Analysis Skill. Use for intelligent video comprehension and analysis via the Bailian (QuanMiaoLightApp) API. **Required API Product**: QuanMiaoLightApp (version 2024-08-01) **Required API Actions**: SubmitVideoAnalysisTask, GetVideoAnalysisTask **DO NOT use**: videorecog, Mts, or any other product for video analysis Triggers: "analyze video", "understand video", "analyze the local video /temp/xxx.mp4", "analyze the local video https://xxx.com/temp/xxx.mp4", "what is this video about", "summarize this video", "split video into shots", "video comprehension", "extract video insights", "transcribe video", "extract video captions", "generate video title", "generate video outline", "video mindmap".

AI voice creation skill supporting speech recognition (ASR) and text-to-speech (TTS). Uses qwen3-asr-flash-filetrans, qwen-tts and other models. Use this skill when users need speech-to-text, text-to-speech, or audio processing. Note: on first run, it will auto-manage DashScope API Keys (create/recycle) and may auto-install the Alibaba Cloud CLI ModelStudio plugin.

Diagnose client timeouts or anomalies when accessing Alibaba Cloud Bastion Host — quickly root-cause public network connectivity, Bastion Host configuration, Cloud Firewall blocking, and other causes. Use when users report: connection timeout to Bastion Host, abnormal Bastion Host access, SSH/RDP cannot connect to Bastion Host, Bastion Host web page inaccessible, Bastion Host public network access failure, Bastion Host whitelist issues, Bastion Host blocked by Cloud Firewall, even if the user does not explicitly mention "Bastion Host" or "bastionhost". Applicable to Basic Edition, Enterprise Dual-Engine Edition, and National Cryptography Edition Bastion Host V3.2.

Draw cloud architecture diagrams via CADT AI agent. Submit a product/resource description, the backend creates the architecture and returns a summary. Triggers: "画架构图", "架构绘图", "CADT 绘图", "draw architecture".

Build and deploy applications to Alibaba Cloud ECS — Local build + script injection + InstallApplication async deployment. Triggers: build, deploy, CI/CD, compile & package, publish to Alibaba Cloud, diagnose, troubleshoot, root cause, 502, 503, service not started, deployment failed.

Use CADT probe service to discover cloud resources under an Alibaba Cloud account. Use this skill when users need to: (1) Discover existing cloud resources via CADT probe (2) Inventory existing resource list (3) Export resource list for CADT architecture import (4) Understand resource distribution within an account (5) Query related/associated resources for a specific resource (e.g., find security groups and vswitches linked to an ECS instance) Trigger words: resource probe, CADT probe, probe, resource inventory, list resources, view cloud resources, related resources, associated resources, resource relationships

Deploy SSL certificates to Alibaba Cloud products (CDN/SLB/WAF/ALB/NLB/OSS/ESA, etc.). One-click or batch deployment via CAS DeploymentJob API, with progress tracking, failure diagnosis, rollback, and HTTPS verification. Activate when user says "deploy certificate to CDN", "deploy to SLB", "one-click deploy certificate", "push certificate to cloud", "部署证书到 CDN", "部署到 SLB", "一键部署证书", "证书推送到云产品".

Purchase and apply SSL certificates via Alibaba Cloud CAS (V2.0 unified flow). Supports China site (ProductCode=cas) and International site (ProductCode=cas_intl). Automates instance acquisition via BSS API or reuses existing inactive instances. All certificate types follow: list-instances → update-instance → apply-certificate. OV/EV certificates require additional company info and contact IDs. Activate when user says "apply certificate", "purchase SSL", "buy certificate", "certificate order", "purchase certificate instance", "buy overseas certificate", "申请证书", "购买 SSL", "买证书", "证书下单", "购买证书实例", "买海外证书".

SSL certificate toolkit for Alibaba Cloud CAS. Includes identity configuration, domain verification, certificate download, certificate upload, CSR generation, format conversion, and certificate matching. Activate when user says "verify domain", "download certificate", "upload certificate", "generate CSR", "convert certificate format", "configure identity", "match certificate", "check key cert match", "验证域名", "下载证书", "上传证书", "生成 CSR", "转换证书格式", "配置身份", "检查证书匹配", "是否匹配", "是不是一对".

Read-only diagnostics for Alibaba Cloud CDN refresh and preload issues. Use when a URL/file/directory refresh or preload looks ineffective - refresh failed, preload failed, cache not cleared, or the task failed. Verifies task records and edge cache status, and produces a diagnosis report; never submits refresh/preload jobs. Triggers: "refresh failed", "preload failed", "cache not cleared", "purge not working", "prefetch not cached", "warm up ineffective", "invalidation unsuccessful", "pre-warming failure", "pre-fetching".

Interact with DataWorks Data Agent for conversational data analysis, session lifecycle management, and artifact download. Use this Skill when users want to chat with a Data Agent for data querying, create or resume Agent sessions, list session history, download analysis artifacts, check token usage, or cancel an active session.

Read-only diagnostics for Alibaba Cloud CDN traffic and bandwidth anomalies. Use when CDN traffic or bandwidth suddenly spikes, the CDN bill jumps unexpectedly, traffic theft or hotlink abuse is suspected, or bps/flow/QPS trends need baseline comparison to locate anomalous time windows. Pulls usage data via aliyun CLI to locate anomalous windows, then forensically analyzes CDN offline access logs (four-dimension Top statistics, 13 theft rules, T1~T6 classification) and outputs an analysis report; never stops domains or changes any configuration. Triggers: "traffic spike", "bandwidth anomaly", "traffic theft", "unusual CDN traffic", "hotlink abuse", "CDN bill surge", "traffic suddenly increased", "bandwidth spike analysis".

Alibaba Cloud Cloud Firewall ACL rule read-only diagnostic assistant. **Trigger Scenarios**: Diagnose ACL rules not taking effect, troubleshoot Internet/NAT/VPC firewall traffic issues, query traffic logs, check matched rules, get configuration guidance (console manual operation). **Supported firewall types**: Internet Firewall, NAT Boundary Firewall, VPC Boundary Firewall **Keywords**: Cloud Firewall rules not taking effect, Internet Firewall ACL diagnosis, NAT Firewall policy not working, VPC Boundary Firewall rule diagnosis, firewall rule diagnosis ⚠️ **DO NOT use** for WAF issues - use alibabacloud-waf-rule-management skill instead. TEXT-ONLY console guidance. Queries and diagnosis only, no configuration changes.

Query and analyze Alibaba Cloud public network exposure, identify unnecessary exposed assets and ports, assess exposure risks, and generate remediation recommendations. Triggers when user mentions public network exposure, exposed assets, exposed ports, public IP security, port scan results, attack surface analysis, internet reachability, high-risk port detection. Also triggers when user asks about "which IPs/ports are exposed to the internet", "public asset inventory", "security baseline check", even without explicitly saying "exposure".

Manage Cloud Firewall (CFW) Internet Firewall public IP protection switches on Alibaba Cloud. Use this Skill when enabling or disabling firewall protection for public IPs, querying asset protection status, batch protecting ECS/EIP/NAT/SLB resources, toggling all public IPs at once, or configuring auto-protection for new assets. Supports multi-account management via member-uid. 管理阿里云云防火墙（CFW）互联网防火墙的公网IP防护开关。 当用户需要开启云防火墙、管理互联网防火墙开关、查看公网IP是否受保护、 批量开启ECS/EIP/NAT/SLB等资源的防火墙、配置新资产自动防护时使用此Skill。 支持多账号管理（member-uid）。

Query and analyze security events and alerts detected by Alibaba Cloud Firewall IPS (Intrusion Prevention System), helping quickly locate threats and provide remediation recommendations. Triggers when user mentions IPS alerts, intrusion detection, intrusion prevention, attack events, security alerts, threat detection, attack analysis, IDS/IPS, being attacked, any attacks, security incidents, security warnings, server under attack, machine alarms. Also triggers when user asks about "any recent attacks", "which assets were attacked", "does this IP have attack behavior", "security alerts for a specific server/machine", "which IPs attacked a specific IP", even without explicitly saying "IPS".

Manage Alibaba Cloud Firewall (CFW) NAT Firewall (NAT boundary firewall): query firewalls and protection status, enable/disable the protection switch, assess which NAT gateways can be protected and produce a plan, run the creation pre-check, diagnose route-entry inconsistency (route-diff), prepare manual-mode diversion assets, create a firewall (auto or manual vswitch diversion), and change engine strict mode. Deleting/releasing a firewall is NOT supported: protection can be switched off, but the resource must be released by the user in the console. Use when users mention NAT firewall, NAT boundary firewall, NAT gateway protection, protecting private-network outbound traffic, opening/closing the NAT firewall switch, assessing how to enable protection, or diagnosing creation failures from inconsistent custom route entries. 管理阿里云云防火墙（CFW）NAT边界防火墙：查询防火墙与防护状态、开启/关闭防护开关、开墙评估与开墙方案、 创建预检查、路由条目不一致诊断、手动引流准备、创建NAT防火墙、修改引擎模式。不支持删除/释放防火墙， 需用户在控制台自行操作。适用于NAT防火墙、NAT网关防护、私网出方向防护、开关NAT墙、开墙评估等场景。

Alibaba Cloud Firewall Status Overview Skill. One-click query of overall cloud firewall status including asset management, border firewall switch status, and traffic overview. Triggers: "cloud firewall status", "firewall overview", "firewall status overview", "asset management", "protection coverage", "what is the overall cloud firewall status", "how many assets are not managed", "what is the protection coverage for each boundary", "CFW status", "cloud firewall overview"

Manage Cloud Firewall (CFW) VPC border firewalls on CEN Basic Edition (transit-router-type Basic) on Alibaba Cloud. Use this Skill to inventory the VPC firewall slots and their diversion switch status, onboard or offboard a business VPC, toggle traffic diversion, and troubleshoot stuck firewall states. Only for CEN Basic Edition, not the Enterprise transit router, access-control policies, or manual routing. 管理阿里云云防火墙（CFW）基于云企业网 CEN 基础版的 VPC 边界防火墙； 仅适用于基础版，不涉及企业版转发路由器、访问控制策略与手动路由模式。 Triggers: list VPC firewall slots, check VPC firewall diversion switch status, inspect VPC firewall detail and defended CIDR, run the VPC firewall pre-access check, attach a business VPC to the firewall, open or close traffic diversion, rename a VPC firewall, remove a VPC firewall access configuration, query available firewall zone pairs, diagnose a VPC firewall stuck opening or closing, 查看 CEN 基础版 VPC 墙清单与引流开关状态, 为业务 VPC 接入防火墙, 打开或关闭引流, 给 VPC 防火墙改名, 移除 VPC 接入配置, 排查开墙预检查失败或任务卡住

Send WhatsApp messages via Alibaba Cloud Chat App Message Service (CAMS). Supports both template messages and custom (free-form) messages. Use this skill when the user wants to send WhatsApp messages, broadcast notifications, marketing campaigns, verification codes, reply to customer messages, view available message templates, or query template structure and variables.

ClickHouse cluster migration planner. Use when planning data migration between ClickHouse clusters, including cross-cluster migrations, horizontal scaling, disk downgrade, availability zone changes, or migrating from self-built/non-Alibaba Cloud ClickHouse to Alibaba Cloud ClickHouse (Community or Enterprise Edition). Helps analyze migration conditions, select appropriate migration methods, and generate detailed migration plans.

Guide users to manage Alibaba Cloud resources using the Aliyun CLI command-line tool. Covers CLI installation, credential configuration, plugin management, command construction, and error troubleshooting. Use this skill when the user wants to operate Alibaba Cloud services from the terminal — including ECS (云服务器, cloud servers), Function Compute (函数计算, serverless), RDS (云数据库, databases), OSS (对象存储, object storage), SLS (日志服务, log service), VPC (专有网络, networking), ESS (弹性伸缩, auto scaling), and any other Alibaba Cloud product. Also use when the user mentions "aliyun", "阿里云", "阿里云CLI", "命令行", asks about CLI plugin installation, encounters Aliyun CLI errors (InvalidAccessKeyId, SignatureDoesNotMatch, Throttling), or needs help constructing aliyun commands with correct parameter syntax.

Alicloud CMS Dataset lifecycle management and querying skill. Covers listing, inspecting, creating, updating, deleting datasets and executing dataset queries via the aliyun CLI (CMS API version 2024-03-30). Triggers: "CMS dataset", "数据集", "创建数据集", "查询数据集", "dataset 查询", "ExecuteQuery", "CreateDataset", "GetDataset", "ListDatasets", "UpdateDataset", "DeleteDataset".

Entry skill for the aliyun CLI distribution of CloudMonitor (CMS). Use when the user mentions aliyun cms2, CloudMonitor, CMS commands, or any CMS module operation such as Integration Policy/Center, APM, RUM, Prometheus Service, Recording rule, alert rule, alert template, alert history, event hub, SLS event, PromQL, cloud resource, service observability, monitoring onboarding, metric query, etc.

Alibaba Cloud Cloud Firewall ACL policy management tool centered on backup/restore/management. Backs up and restores ACL policies (Internet boundary, NAT boundary, VPC boundary) together with their supporting configurations (address books - custom IP, cloud asset IP, custom domain, port; sync nodes - ACK cluster, private DNS), with differential restore (only fills items missing online). Also provides ACL policy export and statistical analysis (hit analysis, duplicate rule detection, shadow rule detection, compliance audit) and single-point changes (add policy, enable/disable). 以备份/恢复/管理为核心的阿里云云防火墙ACL策略管理工具。 支持备份和恢复ACL策略（互联网边界、NAT边界、VPC边界）及其配套配置 （地址簿：自定义IP、云资产IP、自定义域名、端口，同步节点：ACK集群、私有DNS）， 支持差异恢复（只补线上缺失项）；还提供ACL策略的导出与统计分析（命中分析、 重复规则检测、影子规则检测、合规巡检）与单点变更（新增策略、启用/禁用）。 当用户提到云防火墙备份、云防火墙恢复、地址簿备份、ACL策略备份、防火墙配置 导出导入、ACL策略导出、策略命中分析、重复/影子策略检测、新增ACL策略、启用 禁用策略时使用此技能。不提供策略删除/清理，需用户在控制台手动操作；不做规则 不生效的故障诊断。

Read-only diagnostics for the public internet egress capability of Alibaba Cloud cloud-native products: cloud-native gateway (MSE), cloud-native API gateway, AI gateway, Serverless App Engine (SAE), and Function Compute (FC). Use when the user asks whether such an instance can access the public internet, reports outbound connectivity failure, or wants to check a fixed public egress IP. Resolves the VPC/vSwitch bound to the instance, then verifies NAT gateway SNAT egress for that vSwitch; produces a diagnosis report. Read-only: never creates, modifies, or deletes any resource. Triggers: "cloud-native gateway public internet", "MSE gateway outbound", "APIG outbound connectivity", "AI gateway public network", "SAE public internet", "SAE outbound connectivity", "FC fixed public IP", "FC function outbound", "cloud-native internet diagnostics", "vSwitch NAT SNAT egress".

Alibaba Cloud ECS File Backup Essential Edition (ECS文件备份基础版). One-click activation, daily automatic backup, 30-day file recovery, 100 GiB free quota. Trigger words: ECS file backup, HBR essential edition, Cloud Backup essential, file deletion recovery, free backup quota, ECS data protection, lightweight backup, affordable ECS backup Redirect words: ECS database backup, ECS full-machine backup, full-machine clone, cross-region backup, cross-account backup, KMS encrypted backup

Diagnose Alibaba Cloud Cloud Firewall VPC firewall provisioning failures, route policy configuration failures, and closure pre-check risks using read-only CloudFirewall, CBN, VPC, STS, and ActionTrail APIs. Use this skill when troubleshooting VPC firewall creation failures, route policy/drainage configuration failures, firewall status stuck in configuring, or assessing route and ACL impact before closing VPC firewall drainage.

Create and query Alibaba Cloud alert rules via CLI. Supports CMS 1.0 cloud resource monitoring (ECS, RDS, SLB, etc.) and CMS 2.0 advanced monitoring (Prometheus, APM, UModel). Intent routing automatically selects the correct workflow based on alert type. Use this skill when users mention: create alert, setup monitoring, configure alarm, ECS/RDS/SLB alert, Prometheus alert, PromQL, K8s monitoring, APM alert, UModel alert, list alerts, query rules, 告警规则, 创建告警, 监控报警, Prometheus告警, 应用监控, 查看告警.

Read-only health and risk monitoring for endpoint devices enrolled in Alibaba Cloud SASE (CSAS). Diagnose a device or scan a fleet for CPU or memory pressure, battery health, disk saturation, and online status. Use when users report a slow, hot, laggy, or draining endpoint, or ask about sustained CPU or memory use, battery health, disk capacity, online status, or devices with recent performance risks. It does not count inventory, assess idle devices, check client versions, or lock, recall, delete, or otherwise modify devices. Triggers: "CSAS device health", "slow endpoint", "CPU or memory pressure", "battery health", "disk saturation", "endpoint online status".

Use this skill when users ask about SASE terminal device management, user account queries, inactive device analysis, or device locking on Alibaba Cloud SASE (product code: csas). Trigger scenarios: "查下哪些设备长期离线", "某部门有多少 终端设备", "锁定闲置设备", "查看用户被授权了哪些应用". Capabilities: flexible device querying with 20+ filters (department, device type, OS, SASE feature status, etc.), user listing, user application authorization queries, inactive device analysis, and locking inactive devices. Deletion or irreversible operations are NOT supported — users are guided to the SASE console. 当用户询问 SASE 终端设备管理、用户账号查询、非活跃设备分析、设备锁定时使用此 Skill。 支持灵活的设备条件组合查询（20+ 筛选项）、用户列表查询、应用授权查询、非活跃设备分析、 锁定非活跃终端。不支持删除等不可逆操作。 注意：当前不支持用户活跃度分析（API 不提供用户最后活跃时间，设备绑定关系会变更）。

Diagnose and manage Alibaba Cloud databases through natural language. Use when users need to troubleshoot database performance issues (high CPU, slow queries, abnormal connections, lock waits), check instance status, analyze disk space, optimize SQL, run health inspections, or detect security baseline violations. Supports RDS (MySQL/PostgreSQL/SQL Server), PolarDB, MongoDB, Redis (Tair), and Lindorm. Trigger this skill even for casual descriptions like "my database is slow", "can't connect to the database", "help me check this SQL", or "database disk is almost full". Also suitable for consulting Alibaba Cloud-specific database features (e.g., PolarDB Serverless, DAS autonomy capabilities) and comparing product differences (RDS vs PolarDB). Do NOT use this skill for general SQL tutorials, non-Alibaba Cloud databases, or local database administration.

Invoke Alibaba Cloud Apsara Data Agent for Analytics via CLI to perform natural language-driven data analysis on enterprise databases. Data Agent for Analytics is an intelligent data analysis agent developed by Alibaba Cloud Database team for enterprise users. It automatically completes requirement analysis, data understanding, analysis insights, and report generation based on natural language descriptions. This tool supports: discovering data resources (instances/databases/tables) managed in DMS, initiating query or deep analysis sessions, real-time progress tracking, and retrieving analysis conclusions and generated reports. Use this Skill when users need to query databases, analyze data trends, generate data reports, ask questions in natural language, or mention "Data Agent", "data analysis", "database query", "SQL analysis", "data insights".

Alibaba Cloud DataHub full-lifecycle resource management skill. Use for creating, querying, updating, and deleting DataHub Projects, Topics, and Subscriptions via Aliyun CLI. Triggers: "datahub", "datahub project", "datahub topic", "datahub subscription", "datahub resource management", "streaming data management".

Dataphin skills 套件入口。通过场景关键词路由到具体子 Skill，覆盖数据规划、数据集成、数据开发、运维监控、数据安全、数据资产、数据服务 API 开发、知识图谱等完整业务流程。 触发场景：数据源（创建数据源 / MaxCompute 数据源 / 数据源连通性校验）、计算源（创建计算源 / 更新计算源 / 计算源连通性）、项目与成员（创建项目 / 项目成员 / 租户成员 / 全局角色）、权限与安全（行级权限 / 列级权限 / 字段权限 / 数据源授权 / 数据分级分类 / 数据脱敏）、数据开发（即席查询 / 执行 SQL / 临时跑代码 / 提交批任务 / 更新批任务 / 按名称查任务 / 业务日期 / 租户根节点）、数据集成（数据同步 / 数据搬运 / 集成管道任务 / 更新管道）、运维监控（任务实例监控 / 查看日志 / 重跑实例 / 暂停实例 / 补数据）、数据服务（创建 API / 发布 API / 应用管理 / API 授权 / 权限绑定 / API 调用 / SDK 调用 / API 监控 / 调用日志 / 运维分析）、数据资产（数据标准 / 质量规则 / 主题域 / 业务实体 / 业务指标 / 查找表 / 标准映射 / 资产属性 / 资产查询）、知识图谱（本体模型 / 实体关系 / Schema / Cypher 图查询 / 邻居遍历 / 语义搜索）、非结构化数据（非结构化工作流 / 数据集 / 表结构）。

DataWorks Operations Center assistant for task and workflow operations, alert rule creation and management. Covers troubleshooting, failure recovery, baseline assurance, monitoring and alerting. Supports periodic, manual, and triggered tasks/workflows (excludes real-time/streaming tasks). Uses aliyun CLI to call dataworks-public OpenAPI (2024-05-18). Trigger keywords: query task, task instance, instance log, workflow, workflow instance, alert rule, operations center, task failure, instance status, upstream/downstream dependency, rerun, monitoring alert, custom monitoring, alert rule, task instance, workflow instance, operation log, baseline assurance, failure recovery, DataWorks operations. Do NOT trigger: data source management, compute resources, resource groups, data development, MaxCompute table management, ECS/RDS/OSS operations, workspace member management, data quality, data lineage, data preview.

DataWorks data development Skill. Create, configure, validate, deploy, update, move, and rename nodes and workflows. Manage components, file resources, and UDF functions. Covers 150+ node types: Shell, SQL, Python, DI, Flink, EMR, etc. Supports scheduled and manual workflow orchestration via aliyun CLI or Python SDK. WARNING: Supports mutating operations (Move, Rename) requiring explicit user confirmation. Delete operations are NOT supported by this skill. Triggers: DataWorks, data development nodes, workflows, FlowSpec, scheduling tasks, data integration, ETL pipelines, .spec.json. Also triggers for Alibaba Cloud data development, scheduling node configuration, FlowSpec format, or DI task orchestration.

DataWorks Infrastructure Management: Create and query operations for Data Sources (50 types), Compute Resources, and Serverless Resource Groups, plus connectivity testing and resource group binding/unbinding. Uses aliyun CLI to call dataworks-public OpenAPI (2024-05-18). Trigger keywords: DataWorks data source, compute resource, resource group, datasource, data source, compute resource, resource group, mysql/hologres/maxcompute data source, holo/mc/flink resource, Serverless resource group, DataWorks infra, create/list datasource, DW environment config, infrastructure initialization, connect database to DataWorks, database connection failure, configure holo/mc resource. Not triggered: data development tasks, scheduling configuration, MaxCompute table management, data integration tasks, ECS/RDS/OSS operations, workspace member management, data quality monitoring, data lineage, data preview.

DataWorks metadata Skill for Alibaba Cloud — browse Data Map metadata and perform non-destructive writes via Aliyun CLI. READ scope: list/get catalogs, databases, tables, columns, partitions; query data lineage (upstream/downstream impact); list/get datasets & versions; list/get metadata collections (Category/Album) and entities inside them; preview dataset version content. WRITE scope (non-destructive only): update table & column business metadata; register lineage relationships; create/update datasets and versions; create/update metadata collections and add entities to them. This Skill exposes NO delete or remove APIs — every `delete-*` and `remove-*` operation is intentionally out of scope. For deletions, use the DataWorks console. Triggers: "dataworks metadata", "data map", "data lineage", "meta collection", "dataset", "catalog", "table info", "column info", "partition", "impact analysis", "register lineage", "create dataset", "update business metadata".

Always use this Skill for any Alibaba Cloud DataWorks semantic analysis job or run request, including read-only and preflight requests that intentionally make no API call, such as checking whether the public DataWorks semantic OpenAPI or dataworks-public plugin commands (for example create-semantic-job) are ready. It also applies when the requested outcome is only a refusal or a user choice with no API call. This includes comparing or disambiguating supplied semantic job candidates, validating or refusing an unsafe, path-traversal, or non-writable semantic result directory before any download, and inspecting artifacts for an exact run. Use it to create, run, stop, monitor, diagnose, or download results for semantic jobs backed by MaxCompute, Hologres, StarRocks, or an already uploaded CSV/XLSX reference. Do not use it for ordinary metadata lookup, lineage analysis, SQL development, workflow scheduling, file upload, published semantic model/version management, or semantic job deletion.

DataWorks Workspace Lifecycle Management Skill. Used for creating workspaces, querying workspace information, and adding workspace members with role authorization. Triggers: "DataWorks", "workspace management", "workspace", "member authorization", "role assignment"

Query Catalog, database, and table metadata resources in Alibaba Cloud Data Lake Formation (DLF). Provides read-only queries via the DLF OpenAPI Python SDK, supporting listing and viewing Catalogs, databases, tables with their detailed information and Schema definitions. Use cases: "list available Catalogs", "list databases", "view table schema", "search tables", "search tables by name", "fuzzy search", "view DLF metadata", "what databases are in the data lake", "what columns does a table have", "find tables whose name contains xxx". This Skill only contains read-only operations — no create, modify, or delete operations.

Read-only cost diagnostics and audits for Alibaba Cloud database products (RDS, Redis, MongoDB, PolarDB, DTS, DBS, CDT): explain a high or spiking DB bill with billing-item breakdowns and month-over-month anomaly attribution, and run proactive audits of renewal/expiry risk, idle instances, and optional paid features — never modifying any resource. Triggers: "why is my database bill so high", "DB cost spike", "database cost anomaly", "database bill surged", "unexpected database charges", "unexplained database charge", "don't know what feature is charging me", "RDS bill breakdown", "billing item breakdown", "charged after instance deleted", "released instance still billed", "monthly DB cost trend", "cost increase root cause", "CDT bill", "cost audit", "database cost audit", "idle database instance", "idle instance still charging", "renewal lock", "about to expire", "unexpected auto-renewal charge", "DMS charges", "DAS billing".

Alibaba Cloud scenario-based skill. Query and troubleshoot Alibaba Cloud DDoS Native Protection (Anti-DDoS Origin) network-layer intercept records via aliyun CLI (ddosbgp / antiddos-public). Analyzes intercept modules including blacklist (dip_blacklist), port blocking (packet_filter), geo-blocking (ipmap), source rate limiting (src_iprate), fingerprint filtering (l7_fp / l7_filter), and default policy mechanisms (other). Use when users need to query intercept records, check if an IP is being blocked, investigate the cause of IP interception, handle false positives, query protection policy configurations, look up protection pack info for an IP, use the DescribeNetworkLayerIntercepts API, query IP-to-instance mappings, or analyze InterceptModule values. Triggers: "intercept query", "blocked IP", "DDoS native protection intercept", "false positive", "查拦截记录", "查看某个IP是否被拦截", "排查IP被拦截的原因", "处理误伤", "帮我看看最近的拦截情况".

Export, import, and restore Alibaba Cloud DDoS Pro manual non-website TCP and UDP port forwarding rules and their portable configuration through Aliyun CLI. Use for non-website port backup, migration, reuse on another instance, or recovery; do not use for website-generated rules, website or infrastructure protection, or runtime traffic and attack data.

Automate Alibaba Cloud Yunxiao DevOps tasks — create and run pipelines, manage code repositories and merge requests, track work items and sprints, create test cases, manage artifacts, and drive application release workflows across 8 Yunxiao products. Triggers: "Yunxiao", "DevOps", "pipeline", "code repository", "merge request", "work item", "sprint", "test case", "application delivery", "artifact repository", "Codeup", "Flow", "Projex", "AppStack", "Packages", "Testhub"

Alibaba Cloud Anti-DDoS Proxy (ddoscoo) origin-server IP exposure risk detector. Detects whether a website protected by Anti-DDoS Proxy still has its origin IP exposed to direct attack, across two scenarios: (S1) a protected domain whose public DNS still resolves to the origin IP, bypassing protection; (S2) the origin IP is directly reachable from the public Internet. Reads protected domains / CNAME / origin IPs via ddoscoo (DescribeWebRules / DescribeNetworkRules). Two probe methods: (1) cloud probe via Cms one-off site monitor (CreateInstantSiteMonitor + DescribeSiteMonitorLog); (2) local dig / curl / nc, used when cloud probe is unavailable. Binary verdict. Triggers: "源站IP暴露", "源站暴露检测", "高防被绕过", "流量绕过高防", "origin IP exposure", "DDoS origin detection", "ddos-origin-exposure", "检测源站", "探测源站", "网络分析与监控探测源站", "Call DescribeWebRules", "DescribeWebRules", "DescribeNetworkRules", "CreateInstantSiteMonitor", "DescribeSiteMonitorLog", "get protected domains", "probe origin server", "site monitor probe origin".

[user] Perform security inspection and monitoring for Alibaba Cloud DDoS security products, covering DDoS Basic Protection, DDoS Native Protection, and DDoS Anti-DDoS Pro/Premium. Supports querying blackhole/scrubbing events, QPS spikes/drops, L4 traffic anomalies, HTTP status code (4xx/5xx) period-over-period surges, origin status code anomalies, and instance asset inventory. Use this Skill when users need security inspection, DDoS protection status checks, attack event queries, traffic anomaly investigation, or to confirm whether DDoS security products are provisioned. Triggers: "DDoS inspection", "security check", "DDoS protection check", "attack event query", "traffic anomaly"

Alibaba Cloud DDoS Pro (ddoscoo) domain-level (Layer 7 website) configuration full export and import. Use for disaster recovery backup, configuration audit, rollback after misconfiguration, or batch import of domain settings. Covers 20 configuration dimensions in YAML v2.0 format. Triggers: DDoS domain config export, domain config import, domain config backup, domain config audit. Does NOT cover Layer 4 port forwarding (TCP/UDP) -- handled by `alibabacloud-ddoscoo-port-config-migration`.

Query Alibaba Cloud DDoS Pro (ddoscoo) block/intercept reasons via SLS full logs and ddoscoo CLI. Analyzes detailed information about intercepted requests including CC protection rules, precise access control rules, region blocking, and IP blacklist policies. Use when users report being blocked by DDoS Pro, encounter block pages, or need to investigate and remediate DDoS protection rules. Trigger words: "DDoS block query", "blocked by DDoS Pro", "DDoS intercept", "ddoscoo intercept query", "CC block", "precise access control block", "高防拦截查询", "request blocked by anti-ddos"

Create an agent platform instance in DMS via Alibaba Cloud OpenAPI. Supports Simple Mode and Advanced Mode. Use this skill when the user wants to provision, deploy, or set up a new Dify instance on Alibaba Cloud DMS.

Alibaba Cloud DMS Database Read/Write Skill. Use this skill to search for target databases in DMS and execute SQL queries and data modifications. Triggers: "DMS query", "database query", "execute SQL", "search database", "DMS SQL", "insert data", "update data".

Alicloud DNS Diagnostic Skill (Read-Only). Diagnostic tool for domain unreachable, DNS resolution failure, DNS record not taking effect, NXDOMAIN, unknownhost, and other DNS-layer issues. Automatically performs WHOIS lookup, recursive tracing, OpenAPI config verification, and nationwide probing via boce to generate diagnostic reports. Covers Alibaba Cloud DNS, GTM, PrivateZone, and third-party DNS. This skill is read-only and will NOT execute any Create, Update, Delete, or other write operations. Triggers: "DNS resolution failed", "domain unreachable", "DNS not working", "NXDOMAIN", "domain ping failed", "DNS diagnose", "quick check", "快速检查", "DNS record check", "记录解析", "DNS resolution status", "解析状态", "check A/CNAME/MX/TXT record"

Alibaba Cloud DocMind intelligent document parsing tool. Supports PDF, Word, PPT, Excel, images and more, outputting structured Markdown/JSON/HTML. Offers two invocation modes — V2 API direct access and Alibaba Cloud POP — with automatic routing based on credential availability. Use when the user needs to parse documents, extract content (text/tables/images), convert documents to Markdown, or mentions "docmind", "document parsing", "parse file", etc.

Query and handle security risk events from Alibaba Cloud Data Security Center. Supports viewing the list of unprocessed risk events and performing manual handling operations on risk events. Trigger words: "Data Security Center", "security risk events", "DSC", "risk handling", "DescribeRiskRules", "PreHandleAuditRisk"

Create, view, and manage Alibaba Cloud DTS data migration/synchronization tasks interactively. Automatically triggered when the user mentions keywords such as "DTS task", "DTS migration", "DTS sync", "data migration task", "data sync task", "create migration", "create DTS", "new DTS", "DTS status", "migration status", "sync status", "stop migration", "suspend DTS", "release DTS".

Query DTS (Data Transmission Service) task status and details across all Alibaba Cloud regions. **v12.1: Enhanced reliability** - Timeout increased to 10s, exponential backoff (0.2s, 0.4s) for better timeout handling. Parallel execution remains **6-8x faster** than v10 (39s → 6s with --workers 16). **API retry logic ensures consistent results (no count variations)**. Supports filtering by instance ID or job name. Automatically polls all 27 regions and 3 job types. Strictly filters for PrePaid/PostPaid tasks and outputs a full Chinese report with Region information. Tasks are grouped by type (Migration/Sync/Subscribe) and sorted by CreateTime within each group. **Use this skill when: checking DTS task status, finding migration/sync tasks, verifying task counts, or filtering tasks by instance ID or job name.**

Alibaba Cloud EBS Disk Risk Events Skill. Query and analyze cloud disk risk events via the DescribeEvents API, supporting filtering by disk, event name, level, status, and time range. Triggers: "EBS events", "disk events", "cloud disk risk events", "DescribeEvents", "EBS disk events", "IOHang event", "NoSnapshot event", "cost optimization event", "query disk events", "filtering disk events".

Alibaba Cloud EBS Disk Monitoring and Metric Analysis Skill. Query and analyze monitoring metrics for single or multiple cloud disks, supporting time-series aggregation and cross-disk analysis. Triggers: "EBS monitoring", "disk metrics", "cloud disk performance", "IOPS analysis", "BPS analysis", "disk monitoring data", "metric aggregation".

This skill should be used when the user asks about Alibaba Cloud ECS disk snapshots, including creating snapshots, listing snapshots, deleting snapshots, rolling back disks, configuring auto snapshot policies, calculating snapshot costs, managing snapshot lifecycle, or using snapshot consistency groups for crash-consistent backup of an entire instance. Triggers on phrases like "create ECS snapshot", "query snapshot list", "delete snapshot", "rollback disk", "auto snapshot policy", "snapshot cost", "snapshot consistency group", "crash-consistent backup", "consistency backup", or Chinese equivalents "创建快照", "查询快照列表", "删除快照", "回滚云盘", "自动快照策略", "快照费用", "快照一致性组", "一致性备份", "整机备份", "崩溃一致性备份", "整机崩溃一致性备份", and broader ECS disk maintenance intents such as "帮我处理一下 ECS 实例", "给云盘做备份", "ECS 云盘运维".

Analyze Alibaba Cloud block storage (EBS) disk performance and fleet composition. Use it to locate performance bottlenecks (saturated IOPS or bandwidth), compare disks, instances, or availability zones to decide where to tune or resize, review disk count and capacity by category / region / billing type to inform capacity and cost decisions, check disk event history, and reach the right console dashboard for deeper drill-down. Triggers: "EBS monitoring", "disk metrics", "cloud disk performance", "IOPS analysis", "BPS analysis", "disk monitoring data", "export disk monitoring data", "export monitoring data", "metric aggregation", "resource overview", "EBS Lens", "CloudLens for EBS", "disk usage report", "capacity distribution", "event overview", "monitoring dashboard", "EBS dashboard", "storage dashboard", "disk monitoring dashboard", "storage health", "block storage insights", "disk observability", "disk inventory summary", "telemetry console", "block storage analytics".

ECS Health Inspection - Perform comprehensive health inspection on Alibaba Cloud ECS instances. Checks CPU usage, system load, memory usage, disk IO (BPS and IOPS), network traffic, disk capacity, and GPU metrics (when applicable). Generates a structured HTML inspection report with findings and recommendations. Use when users request ECS health inspection, instance health check, performance inspection, resource usage report, or system health status of an ECS instance.

Alibaba Cloud ECS extension installation skill. Supports querying available extension lists, checking if a specific extension is available, and one-click installation of extensions (e.g., OpenClaw, BT Panel, Python environments, etc.). Extensions are officially provided by Alibaba Cloud with verified installation packages and scripts. Triggers: "extension", "install", "BT Panel", "OpenClaw", "Python", "Node.js", "package", "one-click install"

基于 aliyun appmanager 一键把项目代码部署到阿里云 ECS 云服务器，覆盖环境预检、询价、部署、日志验证、失败诊断重试全流程。支持 App / AI Agent（LangChain / AutoGen / AgentScope / MCP / FastAPI / Flask / Spring Boot 等），新建或已有 ECS 实例，自动处理分组冲突、zip 解压、余额不足、地域参数透传、重复部署免初始化。触发词：部署到ECS、部署项目到ECS、部署到云服务器、把这个项目部署上去、上线到ECS、把仓库部署到ECS、当前目录部署、阿里云ECS部署、appmanager部署、aliyun appmanager、一键部署App、部署AI Agent、deploy to ECS、code deploy、deploy app、deploy agent、appmanager deploy、ECS code deploy、跑一下这个项目、把代码跑到ECS上、ECS上线。

Comprehensive Alibaba Cloud ECS instance diagnostics skill. Performs systematic troubleshooting including cloud platform status checks and GuestOS internal diagnostics via Cloud Assistant. Use when users report server connectivity issues, SSH timeout, instance lag, website unavailability, disk full, CPU/memory alerts, system event notifications, or abnormal instance status. Triggers: "ECS", "instance", "server", "cannot connect", "SSH", "timeout", "slow", "disk full", "network", "CPU high", "memory high", "status check", "system event", "diagnose", "troubleshoot", "disk performance", "disk IO slow", "IOPS", "IO latency"

阿里云 ECS 跨可用区灾备恢复技能。从现有 ECS 实例创建系统镜像，并在不同可用区部署新实例。 当用户提到以下场景时使用：可用区故障恢复、跨可用区备份、跨可用区实例克隆、ECS 灾备、 用镜像在其他可用区创建实例、"帮我做个镜像然后换个可用区创建实例"等。 也适用于：灾备实例、镜像备份、换个可用区创建实例、可用区容灾、 制作镜像、跨可用区创建、从镜像创建实例。 注意：本技能是"备份"而非"迁移"，不会释放或影响原始实例的资源。

Alibaba Cloud ECS snapshot-based cross-AZ disaster recovery skill. Two scenarios: Scenario A (Full Instance Recovery): Recover ECS instance to a different AZ via snapshots — multi-disk uses snapshot consistency group for crash consistency, creates full custom image (system + data disks), launches new instance in target AZ; single-disk uses individual snapshot. Scenario B (Disk-Level Recovery): Snapshot specific disks from source instance, create new disks from snapshots, and attach them to an existing target instance. Triggers: cross-AZ disaster recovery, cross-zone backup, ECS snapshot recovery, snapshot backup, DR recovery, create instance from snapshot in another AZ, attach disk snapshot to another instance, create instance replica via snapshot. 可用区灾备恢复、跨可用区备份、ECS 快照恢复、快照备份、灾备恢复、 在另一个可用区从快照创建实例、把盘快照挂载到其他实例、用快照在另一个可用区创建实例副本、 恢复这台机器到另一个可用区、跨实例磁盘备份。 Note: This is "backup" not "migration" — the original instance remains untouched.

Diagnose GPU issues on Alibaba Cloud ECS GPU instances: GPU device status, driver issues, and GPU hardware failures. Use when users ask to check the GPU status of their GPU instances, detect whether the GPU device is visible, verify that the GPU driver is installed correctly, or troubleshoot GPU anomalies such as GPU not visible or deep learning task failures. Run Console Diagnosis or Cloud Assistant Diagnosis (RunCommand) to detect GPU hardware failures, perform batch diagnosis of GPU servers, or create scheduled (periodic) diagnosis tasks via CreateCommand and InvokeCommand with Cron. Single-instance diagnosis runs Console Diagnosis and Cloud Assistant Diagnosis in parallel; batch and scheduled diagnosis use Cloud Assistant Diagnosis only. Supports streaming output of diagnostic results.

Troubleshoot an Alibaba Cloud ECS Linux OS. Use when a user needs to diagnose a specified ECS Linux instance, such as instance stuck in Starting, boot stuck, SSH/VNC/Workbench login failure, network issues, disk/FS issues, performance anomalies, suspected mining or hidden processes, crash/hang, clock drift, or configuration not taking effect.

Alibaba Cloud ECS Patch Management Skill. Use for scanning and installing OS patches on ECS instances via OOS (Operation Orchestration Service). Triggers: "patch management", "scan patches", "install patches", "OS update", "security patches", "ACS-ECS-BulkyApplyPatchBaseline", "oos patch", "系统补丁扫描", "系统补丁安装".

Diagnose ECS instance reboot or crash issues. First checks for abnormal maintenance events, then uses Cloud Assistant to check for internal restarts or kernel panics. Use this skill when users report ECS instance unexpected reboot, crash, abnormal shutdown, kernel panic, or OOM. Supports vmcore file analysis, kdump configuration, system log analysis, and Windows crash dump analysis.

Use when an ECS instance cannot reach the internet, its public IP is unreachable, ping to the public network times out, a security group blocks public access, or a VPC cloud service (DataWorks / SAE / ACK) cannot access the public network. Diagnoses Alibaba Cloud ECS public network access and VPC cloud service public egress: ECS public IP reachability and security-group blocking (auto-handling the NAT-gateway egress path for instances without a public IP), plus NAT gateway / SNAT / route / EIP checks for DataWorks, SAE, ACK and others. Triggers: "ECS public network access diagnosis", "ECS public IP reachability", "ECS security group blocking public access", "ECS cannot access the public network", "ECS NAT gateway SNAT egress troubleshooting", "VPC cloud service public network access", "DataWorks cannot access the public network", "SAE public network egress failure", "ACK public network unreachable", "VPC NAT gateway SNAT route EIP check"

Troubleshoot and repair Alibaba Cloud ECS Windows instances from inside the GuestOS or remotely via Cloud Assistant. Use whenever the user reports any Windows symptom or asks for a health check on an ECS Windows instance, even vague ones like "check this machine": boot failures (BSOD, black screen, boot loop, stuck at logo), crashes and hangs, RDP/VNC login failures, network problems (internet access, ping, DNS, DHCP, firewall, SMB), a port unreachable from outside while the service is running (8080, 3389), inbound firewall port blocking, disk and storage, Windows activation, Windows Update, time synchronization, user accounts and permissions, BitLocker, drivers, application crashes, certificates and TLS, scheduled tasks, slow performance, configuration not taking effect, Cloud Assistant and management channel issues. Supports online diagnosis (running system) and offline diagnosis (faulty system disk mounted as a data disk) via a direct in-GuestOS channel or remote aliyun ecs run-command.

阿里云E-HPC Instant计算平台作业管理工具包，支持E-HPC Instant（EHPC Instant/ehpcinstant）作业的创建/提交、查询、获取详情、查询日志、删除等操作。当用户需要创建作业、查询作业列表、获取作业详情、删除作业、查询作业日志时使用。

Alibaba Cloud Elasticsearch instance diagnosis skill. Use for cluster health checks, troubleshooting, and performance analysis on Elasticsearch instances. Triggers (English): Elasticsearch diagnosis, ES instance issues, slow search, write failures, cluster Red/Yellow, unassigned shards, node disconnected, load imbalance, thread pool 429, JVM/OOM/circuit breaker, disk watermark / read-only index, instance activating / change stuck, service avalanche / all shards failed. 触发词（中文）: ES诊断、阿里云ES、Elasticsearch诊断、ES集群/实例故障排查、ES健康检查、集群红灯/变红/黄灯/变黄、集群异常、分片未分配、主分片未分配、节点掉线/离线、负载不均衡、搜索/查询变慢、慢查询、写入失败/变慢/拒绝、线程池打满、HTTP 429、内存过高、OOM、断路器、磁盘满/水位、索引只读、实例激活中/activating、变更卡住/未完成、雪崩、服务不可用、all shards failed。

Deploy HTML pages, static directories, or custom edge functions to Alibaba Cloud ESA edge nodes. Manage Edge KV for distributed key-value storage. Use when deploying web pages, static sites, frontend builds, serverless edge functions, or edge data storage to ESA Functions & Pages.

Use this skill when users want to search, discover, browse, or find Alibaba Cloud (阿里云) agent skills. Triggers include: "find a skill for X", "search alicloud skills", "阿里云有什么 skill","阿里云", "搜索阿里云技能", "有没有管理 ECS/RDS/OSS 的 skill", "阿里云 skills 有哪些类目", "帮我找一个 skill", "browse alicloud skills", "list alicloud skill categories", "is there an alicloud skill that can...", "what alicloud skills are available", "XX Skill 的内容是什么", "我想了解阿里云 XX Skill 具体做什么","帮我安装阿里云 Skill","使用阿里云相关的skill", "阿里云 agent skill 市场", "搜一下阿里云的 skill", "建一个数据分析项目有没有相关 skill".

Alibaba Cloud FinOps Resource Inspection Skill. Performs cost-oriented health inspection across all regions of an Alibaba Cloud account. Scans ECS, RDS, EIP, Cloud Disks, Load Balancers (CLB/ALB/NLB), and NAT Gateways to identify underutilized and idle resources. Triggers: "FinOps巡检", "成本巡检", "资源利用率检查", "idle resource detection", "cost optimization", "finops inspection", "资源浪费检查", "闲置资源检测".

Manage Alibaba Cloud Flink VVP instances and namespaces through create/query operations only. Use when user asks to create or query Flink instances, namespaces, regions, zones, or tags in Chinese or English. Reject Flink SQL/job requests, unrelated cloud services (ECS/Kafka/OSS/DataWorks), and all update/delete operations.

Alibaba Cloud Elasticsearch Instance & Config Management Skill. Use for managing the lifecycle of an Elasticsearch instance (create, query, list, restart, upgrade/downgrade, node info) and for managing instance-side config such as snapshot backup and analyzer dictionaries. Triggers: "elasticsearch", "ES instance", "elasticsearch instance", "create ES", "query ES instance", "restart ES", "ES node", "cluster node", "upgrade ES", "downgrade ES", "scale ES", "resize ES", "ES snapshot", "ES backup", "snapshot setting", "create snapshot", "ES dict", "IK dict", "hot dict", "synonyms dict", "aliws dict", "analyzer dictionary"

Use when the user needs to generate a log collection configuration file (OpenTelemetry Collector or Elastic Beats / Filebeat) that writes logs to Alibaba Cloud Elasticsearch or self-managed Elasticsearch. Covers file logs, log API ingestion (OTLP / HTTP webhook), and Kafka log topics. Also matches natural requests such as: write a filebeat.yml, generate an otelcol config, send logs to ES, collect nginx or Java application logs to Elasticsearch, or sync Kafka logs to ES. Always output one configuration file targeting Elasticsearch; never mix technology stacks or emit non-ES outputs.

Alibaba Cloud Elasticsearch Instance Network Management Skill. Use for managing ES instance network configurations including triggering network, Kibana PVL network, white IP list, HTTPS settings, and Kibana SSO authentication. Triggers: "elasticsearch network", "ES network", "kibana pvl", "white ip", "https", "trigger network", "modify white ips", "kibana sso", "kibana authentication".

Alibaba Cloud EMAS APM (mobile Application Performance Monitoring) issue troubleshooting skill. Covers the 4 read-only OpenAPIs exposed by the `aliyun emas-appmonitor` plugin: `get-issues` / `get-issue` / `get-errors` / `get-error`. Capabilities: Top-N aggregation, sample stack drill-down and dimension breakdowns for 6 issue types (crash / anr / lag / custom / memory_leak / memory_alloc), combined with the user's source code (Java / Kotlin / Objective-C / Swift / ArkTS / Dart / C# / JS) to produce root cause analysis and fix suggestions. Client coverage: native Android / iOS / HarmonyOS, Flutter, Unity (bundled to android / iphoneos / harmony; H5 is out of scope). Triggers: analyze app crash, troubleshoot ANR, APM crash investigation, list top issues, "what is this digestHash", iOS ANR Top 5, Android memory leak analysis, Flutter custom exception stacks, pull lag samples, emas appmonitor usage, sort issues by error rate, map stack to source, appKey problem, EMAS APM issue analysis, analyze APM issues.

EMAS APM Remote Log (TLog) CLI Skill. Use for remote log retrieval, task management, and log query operations via Alibaba Cloud CLI. Triggers: "EMAS APM", "remote log", "tlog", "log retrieval", "log collection", "get-tlog-device-list", "create-tlog-task", "search-tlog", "mobile app log".

Manage the full lifecycle of Alibaba Cloud E-MapReduce (EMR) ECS clusters—creation, scaling, renewal, and status queries. Use this Skill when users want to set up big data clusters, view cluster status, add nodes, release nodes, configure auto-scaling, check cluster and node states, or diagnose creation failures. Also applicable for scenarios like "create a Hadoop cluster", "data lake cluster", "running out of resources", "check my cluster", "renew", etc. NOTE: This Skill does NOT support cluster deletion, release, or termination under any circumstances. Any request to delete or terminate a cluster will be refused and redirected to the EMR console.

Manage the full lifecycle of Alibaba Cloud EMR Serverless Spark workspaces—create workspaces, submit jobs, Kyuubi interactive queries, resource queue scaling, and status queries. Use this Skill when users want to create Spark workspaces, submit Spark jobs, view job status and logs, execute SQL via Kyuubi, scale resource queues, or view workspace status. Also applicable when users say "create a Spark workspace", "submit Spark job", "run PySpark", "execute SQL via Kyuubi", "scale resource queue", "view job logs", etc.

Alibaba Cloud EMR Serverless StarRocks development & operations assistant. Covers five scenarios: cluster connection, schema design, data ingestion, SQL development & tuning, and cluster health diagnostics. Use this Skill when users ask about StarRocks table design, writing SQL, choosing an ingestion method, query execution plans, materialized views, cluster health checks, FE/BE/CN node status, tablet health, or compaction. Typical scenarios: table design, Stream Load / Routine Load / Broker Load selection, SQL optimization, window functions, CTEs, JOIN tuning, materialized view design, cluster health inspection, node-down diagnosis. Not applicable for: StarRocks instance lifecycle management (create / scale / restart / config change / version upgrade — these are control-plane operations, please use the EMR Serverless console or the corresponding OpenAPI), or other Alibaba Cloud products (EMR Cluster, Spark, Milvus, ClickHouse, Doris, RDS, ECS).

Manage the full lifecycle of Alibaba Cloud EMR Serverless StarRocks instances — create, scale, configure, maintain and diagnose. Use this Skill when operations engineers, SREs, or architects need to manage StarRocks instances. Typical scenarios include: "create a StarRocks", "check instance status", "scale up CU", "modify configuration", "restart instance", "diagnose issues", etc. Not applicable for: writing SQL/DDL, data import/export, query tuning, materialized view configuration, or managing non-StarRocks products (EMR clusters, Spark, Milvus, ClickHouse, Doris, RDS, ECS).

Alibaba Cloud OpenAPI troubleshooting skill. Use this skill when the user needs to diagnose API call failures using Request ID, error codes, or error messages — via Aliyun CLI `openapiexplorer` plugin commands. Triggers: "RequestId 排查", "Request ID 诊断", "错误码解决方案", "API 调用失败", "get-request-log", "get-own-request-log", "get-error-code-solutions", "OpenAPI 故障排查", "API troubleshoot", "diagnose OpenAPI", "diagnose OpenAPI error codes", "diagnose OpenAPI error messages", "Diagnose OpenAPI API call failures using Request ID".

阿里云实时计算 Flink 版专家助手。Use when you need expert assistance with Alibaba Cloud Realtime Compute for Flink (阿里云实时计算 Flink 版), including product parameters, engine versions, billing information, general troubleshooting, Flink SQL generation (DDL/pipeline/risk-monitoring scenarios), and explicit file output requests. Covers: parameter/version/billing queries, problem diagnosis, SQL generation, file output.

Use this skill when the user needs help with a Flink Python or PyFlink job, especially on Alibaba Cloud Realtime Compute for Apache Flink (VVR): write, modify, review, or debug PyFlink jobs; explain or select Flink Python APIs; resolve package or file dependencies for PyFlink jobs; or prepare PyFlink job deployment.

Submit and operate PyFlink jobs on Alibaba Cloud Realtime Compute for Apache Flink. Use for storage-routed artifact upload, Python deployment creation or configuration updates, cross-session deployment recovery, state-aware start or stop, and JM/TM logs or metrics. Route deletion-only and SQL requests elsewhere.

Manage the full lifecycle of Alibaba Cloud Realtime Compute for Apache Flink SQL: analyze schemas, author and validate SQL, manage Drafts, Deployments, Jobs, Savepoints, Session Clusters, Catalogs, Connectors, UDFs, variables, and deployment targets, synchronize configuration to Git, and troubleshoot logs, Metrics, Checkpoints, exceptions, plans, and backpressure. Use when the user asks about Alibaba Cloud Flink, VVR, VVP, Flink SQL, its job lifecycle, or troubleshooting. Operate the platform through the Python CLI; historical Metrics use a user-supplied VVP Cookie. Verify scope and authentication before platform operations. High-risk actions usually require confirmation; explicit confirmation for the resolved target in the same request satisfies the gate.

Alibaba Cloud PolarDB/RDS MySQL historical lock wait root cause analysis skill. Diagnoses and analyzes historical lock wait issues, identifies the complete lock chain and lock holder. Triggers: lock diagnosis, lock wait troubleshooting, deadlock analysis, PolarDB lock issue, RDS lock issue, lock wait timeout, transaction blocking, metadata lock wait, InnoDB lock analysis, database lock troubleshooting, MySQL lock wait, database performance troubleshooting, lock conflict analysis. Use when the user mentions database lock, deadlock, lock wait, transaction blocking, or slow queries related to locks.

Alibaba Cloud Hologres Instance Management Skill. Use for listing and querying Hologres instances. Triggers: "hologres", "list instances", "get instance details", "hologres instance", "hologram".

Use the packaged iac-code agent for Alibaba Cloud infrastructure tasks, including designing, provisioning, changing, or deploying resources; generating, reviewing, converting, validating, or troubleshooting ROS and Terraform templates; selecting existing cloud resources; estimating costs; operating ROS stacks; and inspecting or explicitly cleaning downloaded iac-code Skill Runtime caches. Trigger for Alibaba Cloud infrastructure work even when the user does not mention iac-code, ROS, Terraform, or this Skill, and for requests to inspect or clean the iac-code Runtime cache. Do not trigger for general Alibaba Cloud questions or unrelated application code. For matched requests, invoke the packaged bridge before any alternative tool and fail closed on bridge errors. Run through the local authenticated A2A runtime without pip or headless mode.

Use when user explicitly asks Flink/Ververica/Realtime Compute Console workspace operations: 草稿(draft), SQL校验/执行, 部署(deployment), 作业(job), Session Cluster, namespace, 表(table), 成员(member), 变量(variable), 或 checkpoint timeout 诊断, especially with workspace/deployment/job IDs (w-*, d-*, j-*, sc-*, draft-*). Also use when prompt asks to test/verify Flink Console lifecycle flow, safety guardrails, or parameter validation for these operations. This includes prompts such as create draft, deploy draft, list deployments, start/stop job, create/list session cluster, get tables, list variables. Also use when prompt explicitly asks to run `python scripts/flink_ververica_ops.py` for Flink Console workspace operations. Do not trigger for unrelated "workspace" contexts or generic cloud/platform tasks (ECS, OSS, RDS, Kafka, Spark, Kubernetes, billing, weather). Do not trigger for Flink instance lifecycle operations (create/scale/delete/renew); those belong to alibabacloud-flink-instance-manage.

Alibaba Cloud Governance Center evaluation report skill. Use for querying governance maturity check results, generating structured risk reports, and account compliance analysis. Triggers: "云治理", "成熟度检测", "合规检查", "安全风险", "治理检测", "governance evaluation", "maturity check", "compliance report", "risk report", "governance center".

Search Alibaba Cloud help documentation on help.aliyun.com (cn) and www.alibabacloud.com (intl) in zh, en, tc, ja, id, pt-br and experimental fr, with ranked results, and verify OpenAPI contracts (parameters, error codes, RAM permission points) against api.aliyun.com metadata. Use when the user asks how to configure a product, looks up an error code or message, checks quota or limits, asks about billing rules, wants best practices or troubleshooting guides, confirms API parameter semantics, or reads a help document. Triggers: "Alibaba Cloud documentation", "help center", "help.aliyun.com", "product how-to guide", "error code meaning", "what does this error mean", "how to fix this error", "quota and limits", "billing rules", "RAM permission point", "API reference", "troubleshooting guide", "best practice", "read help document", "international site documentation". Do not use it to change cloud resources or to diagnose an incident when a diagnosis skill applies.

Alibaba Cloud ICP Filing Success Data Query Skill. Use for querying ICP filing success information including entity, website, app details and risk alerts after successful filing. Triggers: "ICP filing query", "beian query", "filing information", "filing risk", "query filing success", "备案查询", "备案信息", "备案风险".

Real-time web search and page reading using Aliyun IQS APIs. Use this skill FIRST when the user needs current information, news, facts verification, URL content extraction, or any web-based research. This skill provides structured search results with source links, markdown-formatted content extraction, and supports various search engines including real-time news search and deep research modes.

7-day weather forecast query powered by Alibaba Cloud IQS web search and page reading. Triggers: "weather forecast", "7-day weather", "weekly weather", "weather in [city]", "will it rain", "temperature forecast"

Performs capacity assessment on Alibaba Cloud Kafka instances to determine whether throttling is occurring and recommends instance upgrades when capacity is running high. Triggers when users describe issues such as consumer lag buildup, producer send failures, throughput throttling, or connection anomalies on a Kafka instance. Trigger phrases: "kafka capacity assessment", "kafka throttling", "kafka consumer lag", "kafka performance bottleneck", "kafka throughput insufficient", "kafka connection limit", "kafka disk full", "kafka anomaly". Do NOT use for: Kafka instance creation, Topic/partition management and configuration, message send/receive code debugging, or fault diagnosis unrelated to capacity.

Alibaba Cloud KMS Secret Management Skill. Used for managing secrets in KMS, supporting create, delete, update, query operations, version management, and rotation policy configuration. Trigger words: "KMS secret", "secret management", "create secret", "delete secret", "secret rotation", "get secret value"

Health inspection for Alibaba Cloud Redis (ApsaraDB for Redis / Tair) instances. Generates HTML reports across 7 dimensions: instance basic info, current sessions, resource usage trends (CPU/memory/connection/bandwidth, last 7 days), big key / hot key analysis, slow log statistics, alert history, and risk-prioritized recommendations. Supports standard / cluster / SplitRW architectures, Tair PENA (persistent memory) and Tair ESSD (disk) types. Single-instance, multi-instance and full-account batch modes are supported. Trigger keywords: Redis inspection, Redis health check, KVStore inspection, Tair inspection, CPU usage, memory usage, connection usage, bandwidth usage, proxy usage, persistent memory, disk usage, slow log, big key, hot key, alert history, instance health report.

Unified dispatch entry point for the LHM (Lakehouse Migration Center) skill, coordinating the three core capabilities of SQL conversion, data validation, and big-data workflow migration. Use when the user raises a lakehouse migration requirement, such as SQL dialect conversion (e.g., "presto to spark", "hive to maxcompute", "转换 SQL", "SQL 转换", "方言转换"), pre/post-migration data validation / data consistency comparison ("数据校验", "数据比对", "一致性检查", "跑校验", "数据量校验", "指标校验"), migration of scheduled workflows such as DataWorks/DolphinScheduler/Airflow ("工作流迁移", "调度任务迁移", "建数据源", "创建数据源", "把 X 迁移到 Y"), or when the user is unsure which sub-skill to use or needs cross-skill collaboration.

Read-only health-check diagnostics for Alibaba Cloud load balancers (CLB/ALB/NLB). Collects listener health-check configuration, forwarding rules, server groups and backend server probe status, and produces a structured diagnosis report; never changes any configuration. Use when health checks fail, backend servers are marked unhealthy, or the customer asks about load balancer health-check configuration. Triggers: "health check failed", "unhealthy backend server", "backend probe abnormal", "backend server unhealthy", "SLB health check diagnosis", "CLB health check diagnosis", "ALB health check diagnosis", "NLB health check diagnosis", "listener health check configuration query", "server group probe status".

Use this Skill for Alibaba Cloud Lindorm work: instance lifecycle and configuration, networking and access control, monitoring, performance, storage, connection diagnosis, backup, migration, permissions (including Lindorm SQL user management with `CREATE USER` and `GRANT`), slow queries, SQL development, and Search, vector, graph, AI, multimodal, or knowledge-base workflows. Trigger on Lindorm product or CLI terms such as LindormTable, LindormTSDB, LindormSearch, Lindorm AI, HBase/AliHBase, lindormcli, Lindorm CLI, `aliyun lindorm`, or Chinese requests mentioning 宽表引擎、时序引擎、搜索引擎、向量检索、图引擎、白名单、实例创建/扩缩容/释放. Use this Skill's references or official Alibaba Cloud documentation; do not invent Lindorm-specific facts from general training knowledge.

bash prefix: export LJ_SKILL_DIR="${LJ_SKILL_DIR:-$HOME/.qoder/skills/alibabacloud-lingjun-node-diagnose}" && source "$LJ_SKILL_DIR/lib/lj_init.sh" i18n: detect language each turn (CJK ratio ≥ 0.30 → LJ_LANG=zh, else en); inject LJ_LANG=zh|en prefix before source. Intelligent diagnosis for Alibaba Cloud Lingjun (regular & hyper) compute nodes: submit diagnostic tasks (BasicCheck / NodeHardwareCheck / CheckByAiJobLogs), produce structured diagnostic reports, propose repair plans (reboot / reimage / stop / report-node-status), track fault reports (list-fault-reports / describe-fault-report / stop-node-diagnostic). Read-only: list-clusters / list-cluster-nodes / list-cluster-hyper-nodes / describe-node / describe-hyper-node / list-syslogs / list-diagnostic-results. Triggers: "lingjun diagnose", "灵骏诊断", "灵骏排障", "GPU 故障", "硬件故障", "节点异常", "诊断节点", "重启节点", "重装节点", "灵骏修复", "报障", "终止报障", "syslog", "NodeHardwareCheck", "CheckByAiJobLogs", "BasicCheck", "fault report", "stop fault diagnosis"

Manage Alibaba Cloud Lingjun (hyper-)node full-lifecycle ops: stop/reboot/reimage, subscription renewal (bssopenapi renew-instance), spec change (change-node-types), repair (report-node-status/approve-operation), run-command, node-group default update, tag/untag, change-resource-group, plus read-only inventory prerequisite (list-cluster-nodes/describe-node/list-cluster-hyper-nodes). change-node-group & send-file out of scope (see alibabacloud-lingjun-cluster-scaling). Triggers: "lingjun node ops", "灵骏节点运维", "节点停机", "stop nodes", "节点重启", "reboot nodes", "节点重装", "reimage nodes", "节点续费", "renew lingjun node", "节点规格修改", "change node types", "节点维修", "report node status", "节点执行命令", "run command", "节点分组更新", "update node group", "节点打标", "tag node", "节点资源转组", "change node resource group".

Use this Skill for operational MaxCompute or ODPS data-plane work and concrete static diagnosis. MUST invoke it even without a CLI mention, with an exact command plan, or when diagnosis or clarification forbids execution. Also use for any `aliyun maxc` command or a concrete MaxCompute/`aliyun maxc` JSON envelope supplied for diagnosis. Covers SQL/query/cost/explain, metadata/partitions, sample/profile/transfer, jobs, authentication/permissions/sessions, namespaces, quotas, connectivity, and errors. Exclude CLI/SDK/PyODPS development, pricing/docs-only, DataWorks scheduling, product/tool/architecture comparison or selection, requests confined to other SQL engines, and adjacent cloud resources. Triggers: "operate or diagnose a concrete MaxCompute or aliyun maxc data-plane task"

MMS skill for MaxCompute data migration operations. Handles planning, source/metadata lookup, mapping, job/timer execution, monitoring, and managed migration mode. Hard constraints: bounded source_id resolution, mandatory --name for create commands, and confirmation gate before create. Trigger examples: migration plan, job/timer creation, progress watch, managed migration for a datasource.

Read-only diagnostics for Alibaba Cloud Live: stream quality checks (codecs, bitrate, GOP, B-frames, A/V sync), CDN edge-node probing, local recording/snapshot, traffic-theft analysis on abused live domains, and signed push/pull test URL generation; never changes any configuration. Use when the user reports live stream stuttering, pixelation or latency, push/pull stream failures, audio-video out of sync, wants to probe live CDN nodes or record a stream, suspects live traffic theft or anomalous billing, needs a URL authentication check, or asks for push/pull test URLs. Triggers: "live stream stuttering", "live stream pixelation", "live stream latency", "push stream failed", "pull stream failed", "audio video out of sync", "live CDN node check", "live traffic theft", "anomalous live billing", "live URL authentication check", "live stream recording", "generate push stream URL", "generate pull stream URL".

Live-Debug runtime diagnostics: dynamic logging, method snapshots, dynamic metrics, dynamic spans, and JVM inspection. Use for live-debug ServiceTask on Alibaba Cloud CMS (aliyun cms2 apm service-task): dynamic log/snapshot/metric/span probes, Java JVM commands (OGNL evaluate, decompile, thread info, memory info, inspect object, search type/method, runtime info), disable/clear probes, and query capture results via SLS. Java supports commands + LOG/SNAPSHOT probes; Python supports LOG/SNAPSHOT/METRIC/SPAN/SPAN_TAG probes only. Synonyms: live debug, service task, probe, dynamic logging, method snapshot, take a snapshot, inspect running JVM, runtime diagnostics. Do NOT use for APM/agent onboarding, CMS alerts, RUM, Prometheus rules, or billing.

Alibaba Cloud Live Recording Diagnostic Skill. Use for diagnosing live stream record issues including missing recordings, file generation problems, unexpected recording behavior, and callback issues. Triggers: "live record", "live stream record diagnosis", "record not working", "record file missing", "record callback issue", "录制诊断", "直播录制问题".

Alibaba Cloud LoongCollector / SLS installation, collection onboarding, Pipeline config management and validation, machine groups, permission troubleshooting, and Lens queries. HARD RULE: for matching requests, the first tool MUST load this skill before any SSH probe, directory setup, checklist/file write, or cloud read. Triggers: "安装 LoongCollector", "ECS 安装采集器", "自建 Linux 主机安装 LoongCollector", "ACK 安装 loongcollector", "自建 K8s 部署采集", "从安装到能查到日志", "SLS 日志采集接入", "SLS 日志采集接入相关的事", "修改采集配置", "改采集配置", "采集配置校验", "validate_pipeline.py", "SLS 机器组", "新建 Logtail Pipeline 采集配置", "Logtail Pipeline", "ClusterAliyunPipelineConfig", "SLS Lens 查询", "无数据排查", "心跳异常", "SLS 采集权限排查", "SLS 权限排查", "阿里云 CLI 凭证没有 SLS 操作权限", "Logtail", "iLogtail", "AgentSight", "Agentloop", "input_agentsight", "eBPF Runtime", "ebpf-event".

This skill should be used when the user asks to "build a frame extraction job" / "视频抽帧 / 抽关键帧", "label driving images with a VLM" / "图像打标 / image labeling with Qwen-VL", "compute image embeddings" / "图像向量化 / multi-modal embedding", "build a video_table / image_table / clip_dir_table for AI FUNC", "扫 OSS 建 video meta 表", or mentions driving-scene / ADAS / 智驾 / 智能驾驶 / 自动驾驶 / 路测 / 行车记录仪 / 座舱 video or image pipelines on MaxFrame + OSS + ODPS. Not for audio (use driving-audio-maxframe-job).

Operate, run O&M for, and manage Alibaba Cloud through local commands, with no MCP configuration needed. CallCLI runs Alibaba Cloud CLI/API commands to create, read, update and delete resources of any product; RunScript runs Python batch scripts; RunIaC runs Terraform orchestration; plus API retrieval and official-document retrieval to follow the best-practice path. Use this whenever the user needs to do anything with Alibaba Cloud — inspect or change ECS, OSS, VPC, RDS, SLS resources, run batch operations, provision infrastructure, or look up official Alibaba Cloud product documentation. Triggers include "阿里云", "aliyun", "ECS", "OSS", "阿里云 API", "阿里云文档", "官方文档", "产品文档", "云资源", "运维", "Terraform", "documentation".

Generate Alibaba Cloud MCP Core RunScript-compatible Python scripts from natural-language cloud operation requests. Use when the user explicitly asks for RunScript scripts, MCP Core scripts, or sandbox-compatible cloud automation code. For standard SDK Python code with imports and credentials, use `alibabacloud-sdk-usage` instead.

Diagnose playback and streaming problems in user-provided media files and URLs (m3u8 / HTTP / RTMP / RTSP / SRT): moov atom position, codec compatibility (H.265/HEVC, AAC-HE, 10-bit), container issues, HLS playlist and TS segment integrity, bitrate/frame-rate anomalies, audio-video sync, and live latency factors such as B-frames and GOP size. Use when the user reports a video that will not play, shows a black or green screen, stutters or buffers, or asks for an HLS playlist, TS segment, or live stream latency check. Read-only. No credentials and no cloud API calls. Triggers: "video file won't play", "video black screen or green screen", "moov atom position issue", "HLS m3u8 playlist check", "HLS segment corrupted", "live stream latency or stutter", "TS segment analysis", "video codec compatibility", "media file format diagnosis", "B-frame or GOP structure analysis".

自动审查应用迁云、大数据搬栈等场景的割接手册（.xlsx）， 围绕 5 大核心维度 Review：停机公告、切流方式（阻流层）、 源端数据库只读与会话管理、阿里云应用重启策略、回滚决策条件。 默认仅审查「割接执行步骤」与「回滚步骤」两个 Sheet （CheckList / 域名清单 / 数据迁移需 --sheets 打开）， 输出「重点确认项 + 需关注项」两段式 Markdown / JSON 报告（含评分与风险等级）。 当用户给出割接手册 / 割接方案 / 割接计划 / cutover plan 的 xlsx， 或说"审查割接手册"、"review 割接方案"、"评估割接风险"、"检查回滚方案"、 "割接 checklist 评审"、"看看这个割接方案有什么问题"时触发。 以下情形同样由本 skill 处理，禁止自行写脚本解析 Excel： 要列出 / 查看手册里有哪些 Sheet、工作表、页签名称用 --list-sheets； 分批割接（含用户显式指定过程 Sheet / 回滚 Sheet 名称）用 --scenario batch 配合 --process-sheet / --rollback-sheet；全量割接 / 一次性切流用 --scenario full； 场景不确定或属纯 DNS 切换 / 域名切换 / 配置变更等其他类型用 --scenario other； 未给路径时先用 find / ls 定位文件再审查。 不适用于：MongoDB / MySQL / Redis 等数据迁移任务配置、 非结构化文档（Word / PDF）、英文关键词主导的手册、业务语义级深度评审。 纯 DNS 方案审查深度有限（仅通告、回滚决策等基本维度）。 本 skill 仅做结构匹配与关键词检测，不理解业务语义，评分仅供参考。 适用于任意支持本地 shell 执行的 Agent 平台（Qoder / Claude Code 等）。

Standardized Skill based on Alibaba Cloud CMH (Rainmeter) database evaluation tool. Full coverage: download collector, create collection account and grant privileges, run collection, export data package, upload for evaluation, source DB profiling, target DB selection recommendation, target DB compatibility assessment, generate evaluation reports. Triggers: database evaluation, database collection, CMH, Rainmeter, APDS, Cloud Migration Hub, source DB profiling, compatibility assessment, target DB selection, migration evaluation, Oracle DB evaluation, full migration assessment, PolarDB-O, PolarDB, ADB, migrate Oracle to Alibaba Cloud, collector account, collection account, common user, C## user, CDB, PDB, multitenant, data.zip, 11 reports, evaluation report, MySQL collection, PostgreSQL collection, SQL Server collection, 数据库评估, 数据库采集, 迁移评估, 采集账号, 采集器, 源库画像, 目标库选型, 兼容评估, 兼容性分析, 评估报告.

Oracle traffic-capture guidance Skill. Guides the customer to run Workload Capture (DBMS_WORKLOAD_CAPTURE.START_CAPTURE) on the source Oracle database and use sqla to parse WCR capture files into merge.json for CMH traffic replay. Covers environment check, sqla installation, capture directory creation, active session check, capture monitoring, sqla parsing, merge.json validation, and deep quality check/repair. Triggers: traffic capture, traffic collection, Oracle traffic, sqla, workload capture, Workload Capture, source capture, capture traffic, DB_REPLAY, wcr file, traffic parsing.

Alibaba Cloud Milvus full-stack Skill for two planes: control-plane instance management via aliyun CLI, and data-plane Milvus operations via pymilvus. Use when users want to create, inspect, scale, configure, network-enable, or whitelist Alibaba Cloud Milvus instances; or connect to Milvus and perform collection management, vector insert/search, hybrid search, full-text search, index management, partition/database management, or RBAC with Python.

端到端管理 RedisShake 数据迁移任务：从用户提供的 Excel 表格、文本描述或逐项问答中提取迁移信息，生成 shake.toml 配置文件，并在本地或通过 SSH 远程部署、启动、停止、监控迁移任务。当用户需要配置 Redis 迁移/同步、提供了含 Redis 地址密码等信息的文本/表格、需要启动或管理 RedisShake 任务、或通过 SSH 远程操作服务器时触发。本 skill 不适用于：MongoDB/MySQL/ES 等非 Redis 数据迁移、Redis 内存 dump 备份、集群拓扑改造、未提供 SSH 凭证的远程操作；本 skill 不验证迁移后的数据一致性（推荐使用redis-full-check进行校验），仅在已部署 redis-shake 二进制的 Linux 服务器上运行。

执行 Hive 数据表探查任务，支持全量探查和增量探查，提供两种连接方式：DB 直连（通过 Metastore MySQL/PostgreSQL 数据库）和 Thrift 直连（通过 HMS Thrift API 端口 9083）。全量探查导出所有表的元数据、存储大小和 DDL；增量探查识别指定时间节点之后的表创建、结构变更、数据变更和分区变更。使用场景：用户提到"Hive 探查"、"全量探查"、"增量探查"、"Hive 元数据"、"hive_dive"、"metastore 变更"、"Thrift 探查"、"migration-lhm-inspect-hive-metastore"时调用此 skill。不适用于数据迁移执行、DDL 转换、数据写入等场景，这些功能由 migration-lhm-migrate-hive-to-paimon 等下游 skill 承担。

Hive 到阿里云 DLF Paimon 数据迁移工具，覆盖存量迁移与增量迁移全流程。存量迁移：Hive DDL 自动转换为 Paimon DDL 与 format-table 外表、rclone 同步 HDFS 到 OSS、Spark Thrift Server 执行 INSERT OVERWRITE，支持 orc/parquet/csv/json/text；提供 --auto-create-db、--force、--max-parallel 并行、--verify 行数校验、--direct-read 直读模式（OSS-HDFS/DLS 场景跳过 rclone）、迁移报告自动生成。增量迁移：三阶段流水线（DDL → rclone → INSERT）执行 hive-exploration 增量探查结果。内置独立 ddl_converter 支持 Hive DDL 快速转换为 DLF Paimon/FORMAT 外表 DDL。使用场景：用户提到"存量迁移"、"增量迁移"、"增量同步"、"Hive Paimon 迁移"、"Paimon 建表"、"Hive 数据湖迁移"、"format-table"、"direct-read"、"hive-to-paimon"、"migration-lhm-migrate-hive-to-paimon"、"转换 Hive DDL"、"建 DLF 表"、"生成 Paimon/外表 DDL"、"表记录数统计SQL"时调用此 skill。

当用户提供迁云调研材料（Excel/Word/文本/CSV文件）并要求生成结构化调研报告时，自动分析汇总并输出 .docx 文档。涵盖客户画像、架构现状、云产品映射、版本兼容性风险、迁移风险、待确认事项。支持 AWS/Azure/GCP/华为云/腾讯云/百度云/IDC 到阿里云的迁移评估。适用于阿里云迁云项目售前或交付调研阶段。本 skill 仅做信息梳理和报告生成，不执行实际迁移操作，不生成报价方案。

多厂商云产品映射 Skill，支持 AWS、腾讯云、华为云、Azure 到阿里云的全量映射，涵盖产品名称映射、实例规格映射、用量换算和阿里云实时询价。当用户需要将其他云资源迁移到阿里云、需要规格对照表、需要估算阿里云成本、或执行产品询价时使用。

生成从友商云（AWS、Azure、华为云、腾讯云）迁移到阿里云的迁移方案。当用户提供友商云产品列表时，给出产品映射和详细迁移方案。适用于用户提到"迁云"、"迁移方案"、"云迁移"、"从XX云迁移到阿里云"等场景。

跨大数据引擎的 SQL 语法转换技能（DML/DDL/存储过程）。覆盖标识符、数据类型、函数、查询语法、分布/分区策略、存储过程/函数、外表等重写场景。目前已实现 Synapse → Hologres，框架为其他引擎对（如 SQL Server → MaxCompute、Hive → Hologres、PostgreSQL → Hologres、Oracle → MaxCompute 等）预留了可扩展位置（TODO）。当用户需要将 SQL/T-SQL/PL-SQL 从一个数仓转换到另一个数仓、跨源迁移查询语句、T-SQL 转 PostgreSQL、数仓 SQL 兼容性改写时使用。不适用于：表结构 DDL 迁移（用 ddl-trans）、ADF 工作流迁移（用 adf2dw）、数据集成作业生成（用 dw-di-generator）。已知局限：不支持递归 CTE、动态 SQL 拼接、SQL Server GEOGRAPHY/GEOMETRY 等空间类型；基于规则匹配，转换结果建议人工审核。

Alibaba Cloud Security Center cryptomining (cryptojacking) diagnosis skill. Use when the user reports or suspects a mining infection, receives a mining alert, or asks for mining alert detection, IOC extraction (pool IPs, malicious domains, sample hashes, malicious processes), affected-asset scoping, attack-surface analysis, entry-vector analysis, risk assessment, prioritized remediation reporting, cryptomining incident response, or mining risk detection. Triggers: "mining", "cryptomining", "cryptojacking", "coin mining", "coin-mining", "miner", "mining alert", "mining alerts", "mining pool", "pool IPs", "malicious domains", "sample hashes", "malicious processes", "mining IOC", "IOC extraction", "mining alert detection", "affected-asset scoping", "attack-surface analysis", "entry-vector analysis", "risk assessment", "prioritized remediation reporting", "cryptomining incident response", "mining risk detection", "xmrig", "kdevtmpfsi", "kinsing", "sysrv", "minerd", "Security Center", "ECS high CPU mining"

Alibaba Cloud MongoDB full lifecycle management: create/query/scale/delete standalone, replica set, sharded cluster instances. Covers node management, security (whitelist/security group), public & SRV address, password reset, renewal, billing conversion, cloud disk reconfiguration, maintenance window, backup, version upgrade, HA switchover, account & tag management. Triggers: "MongoDB", "create MongoDB", "dds instance", "list instances", "MongoDB scaling", "add Mongos/Shard node", "MongoDB whitelist", "reset password", "allocate public address", "SRV address", "MongoDB renewal", "billing type conversion", "cloud disk reconfiguration", "delete MongoDB instance", "maintenance window", "restart MongoDB", "MongoDB backup", "upgrade MongoDB version", "HA switchover", "MongoDB tags", "MongoDB account"

Perform batch inspection on Alibaba Cloud MSE Nacos instances, checking configuration count usage, connection count usage, QPS usage, and TPS usage. Supports two modes: inspecting a specified list of instance IDs, or inspecting all Nacos instances in a region by region. Triggers when the user needs to perform health inspection, capacity assessment, or usage check on MSE Registration & Configuration Center instances, or when the user mentions "inspect nacos", "check nacos instance usage", "nacos capacity inspection", "MSE registry inspection", "nacos inspection", "check nacos config count", "nacos connection count over limit", "nacos QPS/TPS usage", "inspect all nacos in a region", "inspect nacos instances in cn-hangzhou", "check nacos usage across all regions"

Public network MTR diagnosis tool. Supports both manual guidance and Cloud Assistant automation modes. Manual mode guides users to run MTR tools locally (macOS/Linux/Android/Windows) and analyze result screenshots. Automated mode remotely executes mtr/ping/curl diagnostics on ECS instances via Alibaba Cloud Cloud Assistant. Applicable to public network access failures, high latency, packet loss, SLB health check failures, NAT outbound packet loss, etc. Use this skill when users encounter network connectivity issues, need to troubleshoot public network link quality, or analyze MTR screenshots.

Diagnose and troubleshoot Alibaba Cloud NAS mount failures. Use when users encounter NAS mount errors on Linux or Windows, including NFS and SMB protocol mount failures, network connectivity issues, permission group misconfigurations, security group port blocks, or specific error codes like "mount.nfs No such device", "access denied by server", Windows system error 53/58/64/67/85/1231/1272/1312/3227320323, and auto-mount failures on boot. Covers both General Purpose NAS and Extreme NAS file systems. Also handles container (K8s/Docker) NAS mount issues, cross-VPC/cross-account mount problems, and ECS cloud assistant batch mount failures.

[project] [user] Alibaba Cloud private network connectivity diagnosis tool. Use when ECS ping/telnet fails, same-VPC access fails, cross-VPC access fails, VPN or Express Connect is unreachable, NAT Gateway DNAT/SNAT behaves asymmetrically, or the user suspects security group, network ACL, route table, CEN/TR, VPC Peering, VPN Gateway, VBR, or NAT Gateway blocking. Not for classic network, public internet access, DNS resolution, CDN, SLB, or WAF issues.

Query MaxCompute (ODPS) Information Schema metadata views. Tenant-level (SYSTEM_CATALOG.INFORMATION_SCHEMA.*, recommended) or project-level (Information_Schema.*, deprecated). NL→SQL for IS views: tables, columns, partitions, tasks_history, tunnels_history, table_privileges, users, user_roles, quota_usage, etc. NOT for: DDL/DML, listing tables via MCP, running ad-hoc SQL, general MaxCompute questions.

Use this skill for MaxFrame SDK development and documentation navigation on Alibaba Cloud MaxCompute (ODPS). Helps answer MaxFrame API, concept, official example, and supported pandas API questions; create data processing programs; read/write MaxCompute tables; debug jobs (remote or local); and build custom DPE runtime images. Trigger when users mention MaxFrame, MaxCompute with MaxFrame, ODPS table processing, DPE runtime, MaxFrame docs/examples, DataFrame/Tensor operations, or GPU runtime setup. Works for both English and Chinese queries about Alibaba Cloud data processing with MaxFrame.

Alibaba Cloud MaxCompute Project Management Skill. Use for creating, querying, and listing MaxCompute projects. Triggers: "maxcompute project", "odps project", "create maxcompute project", "manage maxcompute project", "list maxcompute project".

MaxCompute Quota Management Skill. Use for managing MaxCompute/ODPS quota resources including pay-as-you-go quota creation, query, and listing operations. Triggers: "MaxCompute quota", "ODPS quota", "create quota", "list quotas", "quota management", "CU management".

Comprehensive health inspection tool for Alibaba Cloud network products (EIP, CBWP, NAT Gateway, CEN, Transit Router, Physical Connection, VBR, Global Accelerator, CLB, ALB, NLB). Analyzes bandwidth utilization, connection count, QPS, and packet loss using Cloud Monitor data; generates a Markdown inspection report with monitoring charts, risk assessment, and scaling recommendations. All API calls are read-only. Use when users want to inspect network product usage, check bandwidth headroom, assess capacity before a business launch, or identify over-limit risk. Triggered by: inspect network products, network health check, bandwidth inspection, EIP/NAT/CLB/ALB/NLB/CEN/VBR/GA inspection, network utilization analysis, pre-launch network inspection, capacity assessment, bandwidth over-limit risk.

Perform Alibaba Cloud NIS (Network Intelligence Service) network path reachability analysis with forward/reverse path diagnosis, topology visualization, and resource monitoring. Use when analyzing network connectivity, diagnosing unreachable paths, checking security groups or route tables, or visualizing network topology between cloud resources. Triggers: "reachability analysis", "network path analysis", "NIS analysis", "connectivity diagnosis", "path reachable", "network troubleshooting", "可达性分析", "网络路径分析", "NIS分析", "连通性诊断", "路径可达", "网络排障".

Alibaba Cloud ALB Ingress Migration Skill. Migrate Kubernetes nginx Ingress resources to Alibaba Cloud Application Load Balancer (ALB Ingress, requires AlbConfig + IngressClass + Ingress). Users provide Ingress YAML (paste, file, or directory) — no cluster access required. Covers annotation compatibility classification, ALB-native annotation mapping, instance/listener-side configuration, path and order semantics, AlbConfig + IngressClass + Ingress generation, and a migration report with DNS weighted cutover. Triggers: "nginx ingress migration", "ALB compatibility", "ALB support check", "ingress-nginx to ALB", "switch to Application Load Balancer", "AlbConfig generation", "nginx迁移ALB", "nginx 迁移 ALB", "ALB Ingress迁移", "ALB Ingress 迁移", "切换到 ALB", "替换为 ALB", "AlbConfig生成", "AlbConfig 生成", "ALB 配置清单", "Ingress兼容性分析", "Ingress 兼容性分析", "入口规则适配", "注解适配审查", "annotation兼容性", "annotation 兼容性", "迁移评估", "切换可行性", "Nginx Ingress 迁移", "迁移到 alb ingress", "转成 alb ingress", "转成 ALB Ingress", "迁移到 ALB", "ingress 迁移".

Alibaba Cloud APIG Migration Skill. Migrate Kubernetes nginx Ingress resources to Alibaba Cloud API Gateway (APIG, ingressClass: apig). Users provide Ingress YAML (paste, file, or directory) — no cluster access required for analysis. Covers annotation compatibility classification, Higress native mapping, built-in plugin selection, custom WasmPlugin development, migrated Ingress YAML generation, and migration report with deployment guide. Triggers: "nginx ingress migration", "APIG compatibility", "gateway migration", "ingress-nginx to APIG", "nginx迁移", "网关迁移", "Ingress兼容性分析", "APIG迁移", "迁移评估", "annotation兼容性", "WasmPlugin开发".

Alibaba Cloud MaxCompute Cost Analysis Skill. Analyze MaxCompute pay-as-you-go costs including billing, storage metrics, and compute metrics. Triggers: "maxcompute cost", "odps cost", "maxcompute billing", "maxcompute费用", "成本分析", "费用分析", "存储用量", "计算用量", "费用突增", "SQL签名", "SQL signature", "重复SQL", "扫描量最大", "daily billing details", "每日账单明细", "按计费项", "billing by fee item".

Provides MaxCompute SQL intelligent generation capabilities for AI agents, covering text2sql conversion principles, dialect syntax differences (DQL/DDL/DML), common query pattern templates (Top N, PIVOT, window functions, etc.), and ODPS error code diagnostics. Use when generating, debugging, or migrating MaxCompute / ODPS SQL.

Alibaba Cloud OOS ChatOps Agent for natural-language cloud resource management and O&M operations. Supports querying ECS/RDS/VPC/SLB resources, executing operations (start/stop/restart), viewing monitoring and billing data, and batch O&M via OOS. Use when users ask about Alibaba Cloud resources, instance management, cloud operations, or O&M automation. Triggers: "查看实例", "ECS", "RDS", "管理资源", "运维", "OOS", "ChatOps", "阿里云资源", "实例列表", "帮我操作", "重启", "停止实例", "resource management", "cloud operations", "list instances", "batch ops".

OOS template intelligent generation skill. Use when users need to create, write, or generate Alibaba Cloud OOS (Operation Orchestration Service) automation templates. Applicable for: generating OOS templates based on O&M requirements, querying available Actions and OpenAPIs, validating template syntax, iteratively fixing template errors. Triggers: "generate template", "create template", "write a template", "OOS template", "operation orchestration", "automation template", "help me orchestrate"

Scan installed skills for security risks and audit platform configuration. When to use: user requests security scan, security analysis, skill audit, OpenClaw health check, config audit, security baseline check, pre-install, safety check, supply chain security check, or asks "is this skill safe". Trigger phrases: "security scan", "安全扫描", "安全分析", "风险评估", "安全体检", "skill audit", "配置审计", "安全基线", "skill安全扫描", "检查skill风险", "这个skill安全吗", "安装前检查", "能不能装这个skill".

Alibaba Cloud OpenSearch instance management skill. Create and query OpenSearch instances. Note: OpenSearch instance and OpenSearch app group are synonymous terms. Triggers: "opensearch", "search instance", "create search instance", "app group", "instance management", "create instance", "query instance", "list instances"

Read-only diagnosis of OSS request failures and access-log tracing from the customer's own log and configuration. Use when a request returns 403 AccessDenied, 404 NoSuchKey, SignatureDoesNotMatch or an unexplained EC error code, when a bucket policy seems to deny a request that should be allowed, when anonymous access is rejected, when the customer asks who accessed or deleted an object, or when log enablement must be checked. Shows which policy statement matched, degrades to console statements when logs cannot be read, and states which causes need a ticket. Never changes configuration. Do NOT use for billing, traffic abuse, endpoint or transfer-acceleration errors. Triggers: "OSS 403 error diagnosis", "bucket policy denied my request", "SignatureDoesNotMatch", "presigned upload fails", "OSS EC error code lookup", "NoSuchKey diagnosis", "who accessed my files", "who deleted my object", "access log not enabled", "which IP accessed my bucket".

Solution skill for using WAF to protect web applications on ECS. Used for quickly deploying network environments including VPC, security groups, and ECS instances, and integrating WAF for web application protection. Trigger words: "WAF protection", "ECS web protection", "Web Application Firewall", "website security"

Alibaba Cloud OPC (one-person-company) cloud resource SELECTION advisor — recommends one of 7 standard SKU packages with exact monthly price, purchase URL, and plain-language launch/migration path for non-technical solo founders. Read-only selection; does NOT deploy (that is the companion `alibabacloud-opc-deploy` skill). WHEN TO USE: user wants to deploy/publish/launch a website or app online, make a project accessible to others, choose a cloud server/package for a one-person business, migrate from Vercel/Netlify/AWS/another platform to Alibaba Cloud (esp. 'slow in China'), or built something with an AI tool (QoderWork/WorkBuddy/Cursor/Codex/Bolt) and wants it online. ALSO trigger for potentially out-of-scope requests (company team / large traffic / PV over 1M) so this skill can explicitly judge and decline. 触发词（中文）：用 QoderWork/WorkBuddy/Cursor/Bolt 等做了网站/小程序想上线或让别人访问；从 Vercel/AWS 等迁到阿里云、国内访问慢；选阿里云套餐/服务器/配置（个人/独立开发者）；AI 小程序（植物识别/AI 记账）想上线；公司/大流量需求（触发后由本 skill 判定是否超范围并拒绝）。输出用中文。

Own every OPC (one-person company) Alibaba Cloud package request end to end — BOTH picking the package and provisioning it. WHEN TO USE (any one is enough): the user asks to provision / deploy / create their cloud resources; names a package directly; continues right after the advisor's recommendation; **OR asks which OPC package suits them / asks you to pick one for them / describes what they want to build and asks whether an OPC package can do it — i.e. the SKU is NOT yet settled**. 'No package chosen yet' is NOT a reason to skip: the no-SKU path is this skill's job. A general assistant must NEVER answer such a question itself, compare tiers, or recommend a SKU — a critical violation. Creating cloud resources costs money — never charge without explicit user confirmation. 触发词（中文）：帮我开通 / 帮我部署 / 帮我创建资源 / 开始部署；直接报 SKU 名（如"帮我开一个 lite_seed"）；advisor 推荐完接下来怎么办；**帮我选个套餐 / 哪个套餐合适 / 具体是哪个套餐 / 我想做 X，用 OPC 套餐能实现吗（此时尚无 SKU，同样必须触发本 skill）**。输出用中文。

Deploy OpenClaw AI agent platform on Alibaba Cloud ECS and integrate with DingTalk bot. OpenClaw (formerly Clawdbot/Moltbot, 中文名"龙虾") is an open-source AI assistant and automation platform supporting natural language-driven task automation with multi-channel chat integration. This Skill covers the full workflow from ECS instance creation, public network configuration, base environment setup, one-click OpenClaw deployment to DingTalk bot verification. End users can chat with the AI assistant by @mentioning the bot in a DingTalk group. Triggers: "OpenClaw", "龙虾", "Clawdbot", "Moltbot", "DingTalk bot", "DingTalk AI", "deploy OpenClaw on ECS", "AI agent platform", "DingTalk integration", "openclaw dingtalk", "openclaw deploy", "DingTalk AI employee", "Alibaba Cloud OpenClaw", "Bailian + DingTalk", "DingTalk group AI", "DingTalk smart assistant", "部署龙虾", "龙虾机器人", "龙虾钉钉"

Zero-cloud-API diagnosis of Alibaba Cloud OSS integration problems for third-party backup software (Veeam, Synology NAS, Rclone, generic S3 clients): S3 compatible interface checks (endpoint form, path-style), V1-signature-forbidden routing to V4, retrieval-fee attribution for IA/Archive backup buckets, whitelist (jia-bai) request guidance. Configuration advice only; never executes changes. Do NOT use for: upload/download error codes (use alibabacloud-oss-transfer-error-code-diagnosis), billing line-items (use alibabacloud-oss-billing-diagnosis), lifecycle rules (use alibabacloud-oss-lifecycle-runtime-diagnosis), presigned URLs (use alibabacloud-oss-presigned-url-v4-diagnosis). Triggers: "Veeam backup to OSS", "Synology backup OSS", "rclone sync OSS", "S3 compatible interface", "high retrieval fee from backup", "V1 signature forbidden on backup tool". Invoke immediately on any trigger; the entry script collects missing inputs via its "Inputs still missing" report instead of interviewing the user first.

Read-only diagnosis of browser/mini-program direct-upload failures and OSS CORS: preflight OPTIONS rejected, CORS rule missing/not effective, no Access-Control-Allow-Origin, expose-headers gaps (ETag / x-oss-request-id), PostObject policy issues. Templates only; never writes. Triggers: "upload reports CORS error", "CORS config not working", "browser direct upload 403", "mini program upload failed", "Please set the etag of expose-headers", "preflight OPTIONS failed", "No 'Access-Control-Allow-Origin'". Do NOT use for transfer error codes (alibabacloud-oss-transfer-error-code-diagnosis), multipart (alibabacloud-oss-multipart-upload-diagnosis), endpoints (alibabacloud-oss-endpoint-internal-diagnosis), signed URLs (alibabacloud-oss-presigned-url-v4-diagnosis), billing (alibabacloud-oss-billing-diagnosis), direct-access links (alibabacloud-oss-direct-access-link-diagnosis), static hosting (alibabacloud-oss-static-website-diagnosis).

Alibaba Cloud Resource Center - Global Resource Inventory, Search & Statistics Skill. Provides cross-region, cross-product, and cross-account resource inventory, search, and statistical analysis capabilities. Also supports enabling and disabling Resource Center service. Triggers: "resource center", "resource search", "resource inventory", "resource statistics", "cross-account resource", "global resource", "resource count".

Use Alibaba Cloud ROS Agent to plan, review, validate, and iteratively refine Alibaba Cloud infrastructure, and to guide users through solution choices or approved deployments. Trigger when the user explicitly asks to use ROS Agent or wants a remote ROS-assisted infrastructure workflow. Do not trigger for ordinary local iac-code work or unrelated ROS API operations.

Alibaba Cloud content moderation and AI guardrails automated testing. Tests sample content against moderation APIs, compares multiple services, tracks requestId/traceId, supports manual annotation, deep false-negative analysis, cross-batch comparison, AI guardrails testing (prompt injection, sensitive data, jailbreak), and generates alignment reports. Use when user asks about content safety, moderation testing, moderation strategy, label configuration, content review, batch safety checks, miss analysis, AI guardrails, prompt injection detection, or safety guardrails testing.

Alibaba Cloud Security Center (SAS) CWPP host security alert handling skill. Used for querying, analyzing, and handling security alerts from Cloud Security Center. Triggers: "security alert", "alert handling", "CWPP alert", "Cloud Security Center alert", "SAS alert", "Aegis alert", "view alerts", "handle alerts"

Alibaba Cloud Security Center incident management skill. Query security incidents, threat trends, and incident details. Triggers: "云安全中心", "安全事件", "事件查询", "安全态势", "威胁事件", "cloud-siem", "Agentic-soc".

Read-only diagnostics for CDN back-to-origin to OSS. Use when CDN fetching from an OSS origin fails or looks wrong: back-to-origin 403 on a private bucket, traffic bypassing the CDN straight to OSS, wrong origin host or port, or a CDN domain that is offline or never configured. Checks configuration and attributes the cause; never changes any CDN or OSS setting. Triggers: "CDN back-to-origin 403", "private bucket CDN origin", "traffic bypasses CDN", "origin host misconfigured", "CDN domain offline", "origin port check", "OSS origin authorization". Do NOT use for refresh/preload tasks (use alibabacloud-cdn-refresh-preload), CDN traffic anomaly analysis (use alibabacloud-cdn-traffic-anomaly), OSS endpoint selection or internal-endpoint errors (use alibabacloud-oss-endpoint-internal-diagnosis), or OSS billing (use alibabacloud-oss-billing-diagnosis).

Read-only diagnosis of OSS client tool failures. Use when the customer reports an ossbrowser login failure or 403, an ossutil error such as InvalidAccessKeyId, AccessDenied, a missing or expired STS token, a connect timeout while uploading files, or a RequestTimeTooSkewed clock skew, when a client cannot connect to OSS, or when the customer asks which ossbrowser or ossutil version to standardize on. Also use for a troubleshooting plan or information checklist. Triggers: "ossbrowser login failed", "ossbrowser 403", "ossutil AccessDenied", "ossutil InvalidAccessKeyId", "client cannot connect to OSS", "RequestTimeTooSkewed", "SecurityTokenExpired", "SigningContext.Credentials", "region must be set in sign version 4", "The Security Token may be lost". Answers only; runs no client commands, calls no cloud API. Do NOT use for SDK/API errors not naming ossbrowser or ossutil, endpoint selection, presigned URL, billing, or throttling (503/SlowDown).

Read-only OSS cross-account auth diagnosis: attributes NoPermission/AccessDenied to trust-policy gaps, RAM-policy scope, Bucket-Policy+RAM dual-grant, AssumeRole failures; emits templates only. Triggers: "cross-account access failed", "trust policy error", "cross-account replication permission error", "AssumeRole failed on OSS", "cross-account migration authorization", "peer account cannot read my bucket", company/partner account, account transfer, EncodedDiagnosticMessage decode. Do NOT use: transfer/timeout (use alibabacloud-oss-transfer-error-code-diagnosis); endpoint (use alibabacloud-oss-endpoint-internal-diagnosis); CRR health (use alibabacloud-oss-crr-config-check); ossfs (use alibabacloud-oss-ossfs-mount-diagnosis); direct-link 403 (use alibabacloud-oss-direct-access-link-diagnosis); signed-URL (use alibabacloud-oss-presigned-url-v4-diagnosis); same-account RAM (use alibabacloud-oss-security-incident-forensics).

Alicloud OSS AI Content Awareness Skill. Use for enabling and querying OSS semantic search with AI-powered content understanding. Triggers: "OSS AI Content Awareness", "OSS semantic search", "OSS vector search", "search by text", "text-to-image search", "text-to-video search", "OSS MetaQuery", "OSS data index", "OSS AI内容感知", "OSS语义检索", "OSS向量检索", "以文搜图", "以文搜视频", "OSS数据索引"

Alicloud Service Scenario-Based Skill. Use for diagnosing local-to-OSS network state, upload/download bandwidth, download time, and local symlink issues with `aliyun ossutil probe`. Triggers: "aliyun ossutil probe", "OSS 网络探测", "OSS 带宽探测", "OSS 下载时间探测", "OSS 软链接探测".

Generate or review Alibaba Cloud WAF 3.0 security operations reports, customer assessments, rule-tuning reports, and focused false-positive or false-negative investigations using WAF OpenAPI, SLS traffic logs, authorized read-only verification, or user-supplied offline WAF samples and exports. Use for WAF monthly reports, security patrols, API Security reviews, BOT analysis, and OWASP API Security Top 10 coverage. Do not use for unauthorized testing or direct production rule changes.

Read-only OSS cross-region replication (CRR) configuration checks. Verify a replication rule and explain why replication is not starting; never creates or modifies a rule. Covers whether a bucket has any replication rule configured before it is relied on for DR, the authorization role, prefix scope, delete-marker and historical-data sync switches, and cold archive or cross-border transfer-acceleration mis-configurations. Also use for a replication investigation plan before execution. Triggers: "cross-region replication not starting", "replication rule config error", "AliyunOSSRole authorization", "replication delete marker sync", "verify whether a bucket has cross-region replication configured", "rely on replication for DR", "replication investigation plan", "replication check", "cold archive replication", "transfer acceleration not enabled for cross-region replication", "replication slow", "replication capacity".

Read-only OSS diagnosis of accidental-deletion recovery and deletion residue: uses versioning to decide if a deleted object is recoverable, explains delete markers, leftover fragments, and why capacity/cost does not drop. States honestly when data is unrecoverable by official policy (versioning never enabled, lifecycle noncurrent version expiration, overdue-payment release). Triggers: "accidentally deleted how to recover", "delete marker", "BucketNotEmpty", "failed to delete bucket", "capacity not reduced after deletion", "file/object suddenly disappeared or returns 404, can it be recovered", "restore the deleted object to its previous version". Not for bill line-items (alibabacloud-oss-billing-diagnosis), the fragment cleanup procedure (alibabacloud-oss-multipart-upload-diagnosis), transfer or endpoint/region issues, lifecycle rule design, or restore/delete writes. Invoke immediately; missing bucket/region/object details are handled internally, never ask for supplements before invoking.

Perform security operations on OpenClaw environments by calling Alibaba Cloud Security Center (SAS) and ECS APIs via the aliyun CLI. Supports asset queries, vulnerability detection, baseline checks, alert analysis, daily security report generation, and Cloud Assistant command execution. Use this skill when users need to query OpenClaw security status, handle security alerts, check vulnerability risks, execute emergency commands, or generate security reports.

Alibaba Cloud Security Center (SAS) Overview Data Query Skill. Retrieves security score, asset status, risk governance, asset risk trends, and billing info. Supports flexible scope: query a single data item, a specific module, or the full overview based on user intent. 阿里云云安全中心（SAS）总览数据查询技能。 可获取安全评分、资产状态、风险治理、资产风险趋势及账单信息。 支持灵活查询范围：根据用户意图查询单个数据项、特定模块或完整总览。 Triggers: "SAS overview", "security center overview", "SAS 总览", "云安全中心总览", "security score", "安全评分", "安全分", "vulnerability fix", "baseline risk", "handled alerts", "host assets", "uninstalled clients", "risk governance", "WAF blocks", "asset risk trend", "SAS billing", "订阅状态", "账单" Out of scope: This Skill only covers SAS overview data queries. It does not perform remediation, modify configurations, or manage non-SAS services.

Read-only OSS direct-access link diagnosis: attributes preview-turns-download (0048 default-domain forced download incl. images on post-2019-09 buckets, attachment disposition, wrong Content-Type, private-bucket 403), EC 0003-00000005 bisection (object private ACL / Block Public Access / AK-signature) for 403 on non-private buckets, domain binding failures (cname, ICP, CNAME), and referer whitelist/blacklist false positives. Templates only, never writes. Triggers: "open turns into download", "file cannot preview", "image downloads instead of previewing", "image downloads instead of showing it", "0003-00000005", "custom domain binding failed", "domain requires ICP filing", "referer whitelist blocks legitimate requests". Do NOT use for hotlinking forensics, static website hosting, endpoints, image styles, browser CORS, signed URLs, CDN origin-pull, cross-account authorization, or transfer acceleration - route to the matching alibabacloud-oss-* sibling skill.

Read-only OSS endpoint and internal-network diagnostics for wrong endpoint/region choice: which endpoint to use, ECS and OSS in different regions, internal network access failing, same-region internal traffic fee, custom domain not opening. Triggers: "no such host", "must use specified endpoint", "internal endpoint", "public network traffic cost", "wrong region endpoint", "endpoint region mismatch", "does not belong to you". Do NOT use for billing (alibabacloud-oss-billing-diagnosis), errors (alibabacloud-oss-transfer-error-code-diagnosis), multipart (alibabacloud-oss-multipart-upload-diagnosis), images (alibabacloud-oss-image-processing-diagnosis), emergencies (alibabacloud-oss-security-incident-forensics), signed URL (alibabacloud-oss-presigned-url-v4-diagnosis), ossfs (alibabacloud-oss-ossfs-mount-diagnosis), client tools (alibabacloud-oss-client-tools-diagnosis), static hosting (alibabacloud-oss-static-website-diagnosis), direct-access links (alibabacloud-oss-direct-access-link-diagnosis).

Read-only OSS event notification and upload callback diagnostics. Use when event notifications do not trigger (rule configuration check, dependent service activation, event type matching) or upload callbacks fail (CallbackFailed, callback 502, 5-second response limit, certificate and network issues), plus configuration-correctness advice. Triggers: "event notification not triggering", "upload callback failed", "CallbackFailed error", "callback 502", "callback timeout 5 seconds", "OSS event to MNS", "x-oss-event-status". Only checks and advises; never creates or modifies notification rules. Do NOT use for access-log tracing (use alibabacloud-oss-access-log-trace-diagnosis), error codes (use alibabacloud-oss-transfer-error-code-diagnosis), endpoint issues (use alibabacloud-oss-endpoint-internal-diagnosis), or billing (use alibabacloud-oss-billing-diagnosis).

Query and analyze real data through SLS Context Models to answer business questions. Use when the user asks business data questions using an SLS Context Model. Not for inspecting or managing the models themselves.

Alibaba Cloud SLS (Simple Log Service) index configuration manager skill. Use this skill to help users inspect, create, update, or delete a Logstore index, generate an index configuration from user-provided structured log samples, and optimize an existing index configuration for given query/SQL workloads, write throughput, and storage cost — all through the aliyun CLI. Triggers: "SLS 索引", "索引配置", "create index", "update index", "delete index", "generate index", "optimize index", "全文索引", "字段索引", "log index config", "aliyun sls index".

Read-only diagnostics for OSS image processing. Use when an x-oss-process error occurs, an image style or watermark is not applied, image preview fails or the default domain forces download, original image protection 403, unsupported-format BadRequest, WebP conversion errors, HEIC thumbnail 400 errors, image-processing action order differences, or dynamic WebP processing failures. Triggers: "x-oss-process error", "image style not working", "original image protection 403", "watermark not applied", "image preview fails", "image forced download", "WebP conversion error", "HEIC thumbnail 400", "image-processing action order", "dynamic WebP processing". Not for transfer error codes, endpoints, billing, presigned URL/V4, direct-access links, or static hosting (use the matching OSS diagnosis skill); video / blind-watermark / document-preview (IMM) is out of scope.

Read-only OSS diagnosis for lifecycle runtime and archive restore. Use when a lifecycle rule does not take effect (loading window, prefix/tag matching, one-way transition, versioning), when an archive / cold archive / deep cold archive object cannot be read (restore tiers, archive direct read), or for storage tiering advice and restore/retrieval fee composition. Triggers: "lifecycle rule not working", "archive file cannot download", "InvalidObjectState", "RestoreAlreadyInProgress", "Overlap for same action type", "The operation is not valid for the object's state", "restore fee", "storage class transition", "cold archive restore duration", "storage tiering". Do NOT use for bill line-items (alibabacloud-oss-billing-diagnosis), data recovery (alibabacloud-oss-deletion-recovery-diagnosis), transfer error codes (alibabacloud-oss-transfer-error-code-diagnosis), backup-tool retrieval fees (alibabacloud-oss-backup-integration-diagnosis), or write operations.

Alibaba Cloud OSS scheduled local-folder sync skill using aliyun CLI, including integrated ossutil commands for incremental upload. Use when the user wants to schedule recurring local-to-OSS uploads, validate OSS backup prerequisites, set up cron or Task Scheduler for OSS sync, or clearly separate what stays on aliyun CLI from what remains OS-local or manual. Conditional write operations: creates the target bucket (PutBucket) only when the user confirms the bucket does not exist yet; optionally deletes test objects (DeleteObject) only when the user explicitly requests cleanup after verification. Triggers: "OSS scheduled sync", "定时同步到OSS", "aliyun ossutil cp --max-age", "aliyun ossutil cp -u", "cron upload to OSS", "Task Scheduler OSS upload", "aliyun CLI OSS sync", "本地目录增量上传 OSS".

Process images, audio, and video files stored in Alibaba Cloud OSS. Supports 14+ image operations (resize, crop, rotate, watermark, blur, format conversion, etc.), image-intelligent features via IMM (blind watermark, face/body/car detection, QR recognition, labeling, scoring), and audio/video processing (transcoding, screenshot, animation, sprite sheet, concatenation, metadata extraction, HLS streaming). Results can be returned as signed URL, downloaded locally, or saved as new OSS object. Also supports plain file upload/download. Use when the user needs to process or transform media files in OSS, such as generating thumbnails, transcoding video, extracting audio, adding watermarks, detecting faces, compressing images, or converting formats. Triggers on media processing requests in English or Chinese (resize, crop, thumbnail, transcode, video convert, audio convert, watermark, face detection, 缩略图, 裁剪, 压缩, 转码, 视频转换, 音频处理, 水印, 盲水印, 人脸检测, 截帧, 拼接).

Read-only diagnostics for OSS multipart upload. Use when a multipart upload is stuck or interrupted, a large file upload fails, or multipart fragments occupy storage. Finds fragments via read-only ListMultipartUploads, checks part size/concurrency limits, attributes server/client/network causes; cleanup guidance is manual-only. Triggers: "multipart upload stuck", "upload stuck at 0%", "resume interrupted upload", "multipart fragments occupy storage", "large file upload fails", "fragment cleanup", "resumable upload", "breakpoint resume". Do NOT use for single-request upload errors (use alibabacloud-oss-transfer-error-code-diagnosis), billing (use alibabacloud-oss-billing-diagnosis), endpoints (use alibabacloud-oss-endpoint-internal-diagnosis), signed URL V4 (use alibabacloud-oss-presigned-url-v4-diagnosis), browser/mini-program direct upload with CORS (use alibabacloud-oss-browser-upload-cors-diagnosis).

End-to-end Alibaba Cloud PAI Quota lifecycle management via `aliyun paistudio` (Quota CRUD, scale, workload inspection) and `aliyun aiworkspace` (binding Quotas to Workspaces). Covers root and child quota creation, absolute scaling, metadata update, deletion, listing quota workloads / active user usages, plus attaching and detaching quotas to PAI workspaces. Use when the user asks to list / get / create / update / scale / delete PAI quotas, inspect quota workloads or active users, or attach / detach quotas to a workspace. Trigger phrases: "PAI quota", "create PAI quota", "scale PAI quota", "child quota", "quota tree", "bind quota to workspace", "list PAI quotas", "Lingjun quota", "PAI 资源配额", "Quota 扩缩容".

Alibaba Cloud PAI-Rec Engine Diagnostic and Configuration Validation Skill. Use for diagnosing PAI-Rec engine interface issues and validating engine configurations. Triggers: "PAI-Rec", "engine diagnosis", "engine config validation", "pairec", "recommendation engine".

End-to-end Alibaba Cloud PAI ResourceGroup (resource pool) lifecycle management via `aliyun paistudio`. Covers list / get / create / update / delete of ResourceGroups (general computing ECS or Lingjun GPU), read-only inspection of MachineGroups, and bind/unbind UserVpc. Use when the user asks to list / get / create / update / delete PAI resource groups, inspect machine groups, bind/unbind UserVpc, or audit resource-group capacity. Trigger phrases: "PAI resource group", "PAI resource pool", "Lingjun resource group", "create PAI resource group", "list PAI resource groups", "PAI machine group", "Lingjun resource group (灵骏资源组)", "PAI resource pool (PAI 资源池)", "PAI 资源组".

Alibaba Cloud PAI Workspace Management Skill. Create, query, and list workspaces on the Platform for AI (PAI). Triggers: "create PAI workspace", "query PAI workspace", "list workspaces", "PAI workspace", "create workspace", "get workspace", "list workspaces", "AIWorkSpace CreateWorkspace", "AIWorkSpace GetWorkspace", "AIWorkSpace ListWorkspaces"

Alibaba Cloud SLS (Simple Log Service) log query & analysis skill. Use this skill to help users write, explain, optimize, execute, or troubleshoot SLS index search, SQL analytics, and SPL scan/pipeline statements through the aliyun CLI. Triggers: "SLS 查询", "SLS 分析", "日志查询", "日志分析", "log query", "analyze sls logs", "aliyun log query".

Read-only diagnostics for ossfs and container OSS mounts. Use when an ossfs mount fails, a mounted directory disappears, an ACK/ACS storage volume mount returns 403, or reading archive objects through a mount returns 403. Attributes causes (credential file, endpoint region, RAM permission, FUSE dependency) and checks bucket region/storage class read-only for the archive direct-read judgment; never executes mounts, never changes anything. Triggers: "ossfs mount failed", "mount directory disappeared", "mount OSS in container", "storage volume mount 403", "ossfs archive read 403". Do NOT use for endpoint selection (use alibabacloud-oss-endpoint-internal-diagnosis), authorization config (use alibabacloud-oss-cross-account-auth-diagnosis), archive restore or lifecycle (use alibabacloud-oss-lifecycle-runtime-diagnosis), or transfer acceleration error codes (use alibabacloud-oss-transfer-error-code-diagnosis).

Zero-cloud-API diagnosis of OSS presigned (share) URL failures and V1-to-V4 migration: parses a pasted URL, routes to causes (expired, clock skew, V1 signature forbidden, credential rotation, method mismatch, malformed x-oss-credential, SDK config misuse, proxy header tampering). Triggers: "share link expired", "SignatureDoesNotMatch on presigned URL", "V1 signature is forbidden", "x-oss-credential error", "signed URL stops working"; Chinese ticket wording routes via the embedded catalog keyword layer. Do NOT use for transfer error codes, billing, endpoints, traffic abuse / AK-leak, CDN back-to-origin or Referer hotlink configuration requests, or other OSS domains (backup / image processing / direct-access links / static hosting) — route to the matching alibabacloud-oss-* skill. A presigned-URL signature failure stays here even when a CDN or a proxy sits in front of the bucket.

Read-only OSS QPS/bandwidth quota and throttling diagnostics. Use when requests persistently hit 503/SlowDown or clients time out with no server errors. Covers watermark guidance, a throttling attribution decision tree, optimization (concurrency, prefix hashing, backoff), quota-increase guidance, ActiveRequestLimitExceeded concurrency throttling, and resource pool QoS / dedicated bandwidth consultation. Triggers: "QPS limit exceeded", "bandwidth saturated", "timeout without server errors", "persistent SlowDown 503", "quota increase request", "TotalQpsLimitExceeded", "x-oss-qos-delay-time", "ActiveRequestLimitExceeded", "resource pool QoS", "dedicated bandwidth". Not for one-off SlowDown / single-request error codes, client-tool connection timeouts, transfer acceleration selection, endpoint errors, or billing (use the matching OSS diagnosis skill); never applies changes.

Read-only forensics for OSS traffic abuse and security incidents (overnight traffic spikes, suspected AK leak, hotlinking). Audits exposure (ACL, policy, public-access block, Referer), runs the 6-step SLS log query sequence, routes root causes, outputs containment checklists. Triggers: "OSS traffic spike overnight", "traffic abuse", "strange files in my bucket", "suspected AK leak on OSS", "hotlinking abuse", "unexpected outbound traffic", "unauthorized downloads from my bucket". Do NOT use: for transfer error codes use alibabacloud-oss-transfer-error-code-diagnosis; for billing use alibabacloud-oss-billing-diagnosis; for endpoint choice use alibabacloud-oss-endpoint-internal-diagnosis; for signed-URL use alibabacloud-oss-presigned-url-v4-diagnosis; for access-log tracing use alibabacloud-oss-access-log-trace-diagnosis; for direct-link issues use alibabacloud-oss-direct-access-link-diagnosis.

PAI-EAS service diagnosis and troubleshooting. Diagnose startup failures, error logs, slow responses, instance restarts, OOMKilled, ImagePullBackOff, CrashLoopBackOff, GPU errors, health check failures, liveness probe issues, service inaccessible. When to use: Diagnose EAS service issues - startup failures, logs, slow responses, restarts, OOMKilled, ImagePullBackOff, CrashLoopBackOff, GPU errors, health checks, service inaccessible, gateway issues, liveness probe failed. Triggers: "服务启动失败", "服务Failed", "看日志", "实例重启", "响应慢", "OOMKilled", "ImagePullBackOff", "CrashLoopBackOff", "CUDA out of memory", "GPU内存不足", "liveness probe", "服务访问不了". Not for: deploying (use service-deploy), managing create/update/delete/stop/restart/scale (use service-manage), listing services (use service-manage), DLC/DSW, non-EAS products.

Read-only diagnosis of OSS static website hosting: hosting config checks (homepage / 404 rules, IndexDocument / ErrorDocument), "website opens as a download" attribution, and domain filing (ICP) guidance. Triggers: "static website shows download", "index.html not rendered", "website hosting config", "404 page rule", "static site domain filing", "ICP filing for OSS domain", "static site opens as download", "custom domain filing". Do NOT use for hotlink protection, domain binding procedures or generic default-domain direct access links (use alibabacloud-oss-direct-access-link-diagnosis), endpoint selection (use alibabacloud-oss-endpoint-internal-diagnosis), image processing (use alibabacloud-oss-image-processing-diagnosis), browser upload CORS (use alibabacloud-oss-browser-upload-cors-diagnosis), signed URL / V4 (use alibabacloud-oss-presigned-url-v4-diagnosis).

Read-only OSS transfer acceleration diagnosis: detects acceleration not taking effect (client still on the plain endpoint), separates OSS Data Accelerator (same-region hot data) from Transfer Acceleration (cross-region links), attributes slow cross-border access and fees; never changes anything. Triggers: "transfer acceleration not working", "oss-accelerate endpoint", "cross-border access slow", "overseas upload slow", "transfer acceleration fee", "accelerator vs transfer acceleration". Do NOT use for bill line-item attribution (defer alibabacloud-oss-billing-diagnosis), endpoint choice (alibabacloud-oss-endpoint-internal-diagnosis), multipart fragments (alibabacloud-oss-multipart-upload-diagnosis), presigned URL errors (alibabacloud-oss-presigned-url-v4-diagnosis), QPS/bandwidth throttling (alibabacloud-oss-quota-throttling-diagnosis), GA/ESA/CDN back-to-origin, or executing enablement (write, out of scope).

Query FeatureDB read/write usage data from PAI-FeatureStore. Use for analyzing consumption, usage trends, and cost estimation by official pricing. Supports date range queries with breakdowns. Triggers: "FeatureDB read/write volume", "PAI-FeatureStore usage", "FeatureDB usage", "FeatureDB statistics", "Feature View usage", "PAI-FeatureStore billing"

Manage Alibaba Cloud PAI compute Nodes — list nodes within a ResourceGroup or Quota, inspect a node's status, hardware spec (GPU / CPU / memory) and resource usage, and perform safety-gated maintenance operations (cordon, uncordon, drain) with explicit two-step confirmation. Use when the user asks to list / get / inspect PAI nodes, check node status, find a node's MachineGroup or ResourceGroup, or cordon / uncordon / drain a node. Out of scope: node power changes (start / stop / reboot), node replacement / migration, per-node GPU metrics, and per-node pod listing — these are platform-managed and require escalation to the platform Ops team / Lingjun ops ticket / account manager. Trigger phrases: "PAI node", "list nodes", "node status", "GPU node", "Lingjun node", "cordon node", "uncordon node", "drain node", "isolate node for maintenance", "PAI 节点", "查看节点", "隔离节点", "恢复节点".

Manage Alibaba Cloud PolarDB-X instance lifecycle and routine operations via the Aliyun CLI. Use when the user asks to create, delete, restart, scale, modify, monitor, or inspect PolarDB-X instances. Triggers: "polardb-x", "polardbx", "create polardb-x", "delete polardb-x", "restart polardb-x", "scale polardb-x", "upgrade polardb-x", "describe polardb-x", "polardb-x instance", "polardb-x parameters", "polardb-x slow log", "polardb-x performance", "polardb-x binlog"

Provide Alibaba Cloud SLS / Aliyun Log SDK installation, quickstart, usage guidance, and SDK selection advice across languages. Use when users ask how to install or use SLS SDKs, choose an SDK for a scenario, write logs, consume logs, query logs, or integrate application logs with Producer, Consumer, or logging framework Appender libraries.

Zero-cloud-API routing of OSS upload/download error codes to root causes. Do NOT use for: endpoint (alibabacloud-oss-endpoint-internal-diagnosis), billing (alibabacloud-oss-billing-diagnosis), multipart (alibabacloud-oss-multipart-upload-diagnosis), presigned URL (alibabacloud-oss-presigned-url-v4-diagnosis), image processing (alibabacloud-oss-image-processing-diagnosis), deletion/residue (alibabacloud-oss-deletion-recovery-diagnosis), forensics (alibabacloud-oss-security-incident-forensics), client tools (alibabacloud-oss-client-tools-diagnosis), throttling (alibabacloud-oss-quota-throttling-diagnosis). Triggers: "403 AccessDenied during OSS upload", "SignatureDoesNotMatch", "OSS RequestTimeout", "OSS upload timeout", "EntityTooLarge", "SlowDown", "InvalidAccessKeyId", "SecurityTokenExpired", "OSS download fails with 403", "OSS upload failed", "409 BucketAlreadyExists". Skip non-OSS errors (SSH/MySQL/CDN).

Alibaba Cloud PAI-DLC (Deep Learning Containers) job management skill. Covers: distributed training job CRUD, monitoring (logs and events), and GPU sanity check. Triggers: "DLC", "PAI-DLC", "create-job", "list-jobs", "get-job", "stop-job", "update-job", "get-pod-logs", "get-job-events", "get-pod-events", "list-job-sanity-check-results".

PAI-DLC job diagnostics and health inspection. Queuing-stuck root cause analysis, failed-job localization, cluster health checks. Companion to the `alibabacloud-pai-dlc-job` skill (read-only — no writes). Triggers: "diagnose", "diagnose job", "job stuck", "why queuing", "queue stuck", "stuck in queue", "job failed", "failure reason", "healthcheck", "health check", "inspect job", "inspection".

Manage the full lifecycle of Alibaba Cloud PAI DSW (Data Science Workshop) instances — create, update, query, list, start, stop, and look up ECS specs. Triggers: PAI DSW, DSW instance, create instance, start instance, stop instance, update instance, query instance, instance list, ECS spec, CreateInstance, UpdateInstance, GetInstance, ListInstances, StartInstance, StopInstance, ListEcsSpecs

Deploy AI models as PAI-EAS inference services. Supports LLMs (Qwen, Llama), image gen (SD, SDXL), speech synthesis, and more. When to use: deploy models, create inference services, EAS deployment, model serving, deploy vLLM/SGLang/ComfyUI.

Query SAG (Smart Access Gateway / 智能接入网关) configurations and perform status inspections via Alibaba Cloud OpenAPI. Generates inspection report files. Use when the user mentions SAG, smart access gateway, 智能接入网关, or asks to check SAG instance status, query SAG configs, inspect SAG health, troubleshoot SAG connectivity, perform SAG device inspections, 网关巡检, 查询SAG配置, SAG状态巡检, or SAG健康检查.

Alibaba Cloud Parse-X intelligent document parsing and extraction tool. Supports two capabilities: (1) Parse — convert documents, images, and audio/video to structured Markdown/JSON/HTML with layout, table, and synopsis support; (2) Extract — schema-driven information extraction with citations from parsed or new documents. Uses Parse-X HTTP (Spectrum gateway, Bearer token via DASHSCOPE_API_KEY). **When to use this skill** — the user asks to: - Parse / convert / analyze any document, image, spreadsheet, or media file (PDF, Word, PPT, Excel, Markdown, HTML, images, audio, video) - Extract structured fields or entities from a document - Convert files to Markdown or JSON format - Process files with mentions of: 解析, 文档解析, 文件解析, 表格, Excel, xlsx, xls, PDF, Word, PPT, 合同, 发票, 报告, 图片, 本地文件, 上传, markdown, JSON, 提取, 抽取, 字段, parse, extract, document parsing, parse file, 解析文档, 解析文件, 文件转换, 图片解析, 表格提取

Analyze local pcap/pcapng captures to diagnose network transfer problems. Use when given a pcap file to explain slow network transfer, connection issues, abrupt TCP session termination, security association setup error, private network tunnel establishment problem, DNS, TLS or encrypted session establishment error, MTU or oversized packet drop, or receiver buffer exhaustion. Read-only; no credentials required. Triggers: "pcap analysis", "packet capture analysis", "analyze pcap file", "slow network transfer", "TCP retransmission", "connection reset", "IPsec/IKE negotiation failed", "VPN negotiation failure", "TLS handshake failed", "DNS resolution failure", "MTU issue", "zero window", "abrupt TCP session termination", "domain name lookup error", "encrypted session establishment error", "oversized packet drop".

Alibaba Cloud PTS task CRUD worker skill — executes concrete PTS scenario operations (create / query / start / stop / report / delete) for both PTS native HTTP/HTTPS and JMeter-based stress testing. This is a WORKER skill, typically delegated from the `alibabacloud-pts-pilot` router. Do NOT use this skill for tuning advice or general PTS Q&A. Triggers: "创建压测场景", "启动压测", "停止压测", "查看压测报告", "删除压测场景", "上传JMeter脚本", "执行JMeter压测", "list PTS scenes", "start PTS scene",

阿里云 PDS（智能云盘/网盘）文件操作技能。支持：文件搜索、上传、下载、重命名、移动、复制、创建文件夹、标签/备注、分享链接、文档/音视频分析、打包下载、图像编辑、以图搜图和 PDS 挂载盘（mountapp，将云盘挂载为本地磁盘）的安装与挂载。 当用户要操作其 PDS、网盘、云盘中的文件或空间时（包括仅说明重命名/移动/复制等操作的安全处理方式，不要求真实执行），或要把云盘挂载到本地像本地文件一样访问时，应使用此 skill。即使用户只是简单说"帮我从PDS下载"、"上传到网盘"、"把报告.pdf重命名"、"PDS里有什么文件"、"把文件打包下载"、"分析下这个文档"、"把云盘挂载到本地"、"安装挂载盘"，也应触发。 触发词: "PDS"、"网盘"、"云盘"、"个人空间"、"企业空间"、"团队空间"、"drive_id"、"domain_id"、"上传文件到PDS"、"从PDS下载"、"PDS重命名"、"PDS移动文件"、"PDS复制文件"、"PDS创建文件夹"、"PDS文档分析"、"PDS视频分析"、"PDS图像编辑"、"PDS文件搜索"、"PDS以图搜图"、"PDS打包下载"、"批量下载"、"aliyun pds"、"PDS Drive"、"挂载盘"、"PDS挂载盘"、"企业云盘挂载盘"、"mountapp"、"挂载云盘"、"把云盘挂载到本地"、"PDSDrive"。 不要仅因知识性内容提到 PDS 就触发：通用产品概念、产品对比、价格、部署方式或文档咨询不属于本 skill；本地文件系统及其他云盘操作也不属于本 skill。 Use this skill for operations on the user's PDS files or spaces, and for installing/mounting the PDS mount app (mountapp) to access the cloud drive as a local disk. Do not trigger for generic PDS product concepts, comparisons, pricing, deployment, or documentation questions.

Implements exact filename search, fuzzy filename search, semantic file search, and image-based image search Triggers: "PDS drive file search", "PDS image search by image"

Alibaba Cloud PolarDB Database AI Assistant. For PolarDB MySQL/PostgreSQL cluster management, instance inspection, performance diagnostics, parameter explanation and change assessment, SQL/log analysis, backup, security audit, HA/DR, event analysis, and other PolarDB O&M operations. Use when user questions involve PolarDB, cluster IDs starting with pc-, PolarDB kernel/proxy versions, parameters, primary-standby switchover, IMCI columnar storage, or PolarDB console operations. This Skill is PolarDB-only.

Health inspection for Alibaba Cloud PolarDB MySQL instances, generating visual HTML reports. Supports single-instance, multi-instance, and full-account inspection modes. Trigger keywords:PolarDB inspection, instance health check, database inspection report, CPU/memory/IOPS usage, disk space analysis, table space usage, largest tables, top table space, slow query statistics, slow SQL analysis, alert records, alert history, connection monitoring, active sessions, database performance check.

Pre-release SQL assessment and optimization for PolarDB MySQL. Combines 28+ static lint rules with Alibaba Cloud DAS dynamic diagnosis. Detects full table scans, missing indexes, dangerous UPDATE/DELETE without WHERE, schema design issues, naming violations, and provides index recommendations with cost estimation. Triggers when users ask to review SQL statements, assess SQL quality, optimize queries before deployment, validate DDL changes, check for SQL injection risks, analyze execution plans, or get DAS-based optimization suggestions for PolarDB MySQL instances.

Alibaba Cloud PolarDB-X Distributed Database AI Assistant. Use for PolarDB-X cluster management, topology inspection, performance diagnostics, SQL optimization, data distribution analysis, elastic scaling diagnostics, connection/session analysis, security audit, backup/restore, parameter tuning, and other O&M operations. Triggers: "PolarDB-X", "distributed database", "pxc-", "DN/CN nodes", "data sharding", "PolarDB-X diagnostics", "PolarDB-X performance", "PolarDB-X slow SQL", "YaoChi Agent", "PolarDB-X topology", "PolarDB-X backup", "PolarDB-X security audit", "PolarDB-X scaling"

Design partition schemes, select partition keys, create GSI, and write SQL for PolarDB-X 2.0 Enterprise Edition AUTO mode databases, handling PolarDB-X vs MySQL differences (partitioned tables, GSI, CCI, Sequence, table groups, TTL, pagination, etc.). Use when designing partition schemes, selecting partition keys, converting single tables to partitioned tables, creating GSI/CCI indexes, writing or migrating SQL for PolarDB-X, or diagnosing slow queries on PolarDB-X. Triggers: "PolarDB-X SQL", "PolarDB-X create table", "partitioned table", "partition design", "partition scheme", "partition key", "GSI", "CCI", "Sequence", "MySQL migrate to PolarDB-X", "PolarDB-X compatibility", "single table to partitioned table", "convert to partitioned table", "large table", "table sharding", "distributed table", "AUTO mode", "pagination query", "Keyset pagination", "Range partition", "auto add partition", "PolarDB-X slow query", "full-shard scan"

Alibaba Cloud PTS (Performance Testing Service) scenario-based skill for creating and managing stress testing scenarios. Supports both PTS native HTTP/HTTPS stress testing and JMeter-based stress testing. Triggers: "PTS", "压测", "性能测试", "stress testing", "performance testing", "JMeter", "load testing", "创建压测场景"

Router skill for Alibaba Cloud PTS (Performance Testing Service) operations. Resolves the user's PTS intent and delegates execution to the appropriate sub-skill. Itself does NOT execute any CLI / API / business logic. Triggers "PTS", "压测", "性能测试", "stress testing", "performance testing", "JMeter", "load testing", "压测调优".

Alibaba Cloud PTS report analyzer worker skill — analyzes past PTS stress-testing reports (HistoryReportId), identifies report-observable performance issues (PTS client config, application-layer errors, throughput/latency patterns), and produces ranked, evidence-grounded analysis. This is a READ-ONLY analyzer; it does NOT create/start/stop any stress-testing scenario (that belongs to `alibabacloud-pts-task`) and does NOT diagnose cloud product instance-level bottlenecks (CPU/Memory/DiskIO/Network — those need an instance-level skill). Typically delegated from the `alibabacloud-pts-pilot` router. Triggers: "压测报告分析", "压测报告解读", "压测结果分析", "PTS report analysis", "压测瓶颈分析", "压测指标解读"

Use when troubleshooting Linux server performance or stability issues — CPU saturation, high load, scheduling delay, memory pressure, OOM events, high RSS, page cache / shared memory growth, memory cgroup residue, Java heap issues, disk IO saturation or latency, packet loss, network jitter, or a server that is slow, stuck, or unstable. Performs diagnosis and surfaces recommendations; does not apply fixes automatically.

Alibaba Cloud Tablestore Agent Storage Skill. Use for building and managing Tablestore-based knowledge bases with the `tablestore-agent-storage` Python SDK. Triggers: "知识库", "tablestore", "ots", "表格存储", "agent storage", "knowledge base", "向量检索", "文档上传", "文档导入", "知识库同步", "tablestore-agent-storage", "AgentStorageClient"

This skill installs and configures the **Tablestore Mem0** plugin for OpenClaw. Tablestore Mem0 uses Alibaba Cloud Tablestore as the vector store backend for mem0, providing persistent long-term memory for AI agents. Use this skill when the user wants OpenClaw to persist or manage long-term memory using Alibaba Cloud Tablestore as the backend. Triggers: "set up tablestore memory", "install tablestore mem0 plugin", "configure long-term memory with tablestore", "remember this".

Alibaba Cloud Tablestore (OTS) Read-Only Operations Skill. Use for querying Tablestore instances and data tables via Aliyun CLI. Triggers: "tablestore", "ots", "表格存储", "list instance", "describe instance", "list table", "describe table", "aliyun otsutil"

Create, track, and manage QianWen support tickets from the conversation: submit a new ticket, check ticket status and engineer replies, follow up, close, and rate — so platform issues get resolved without leaving the chat. Triggers: "submit ticket", "create ticket", "list tickets", "view ticket", "reply ticket", "close ticket", "rate ticket", "transfer to human", "work order", "customer service", "human support", "open ticket", "check ticket", "cancel ticket", "evaluate ticket", "ticket list", "support request", "escalate to agent". Do NOT use for general model usage questions, API Key management, or billing inquiries — only when the user explicitly needs ticket operations.

Quick BI-SmartQ skill with multiple data analysis capabilities: 1. **File Q&A**: Upload Excel/CSV files for intelligent analysis via Quick BI API 2. **Dataset Q&A**: Natural language queries on Quick BI platform datasets, with automatic intelligent table selection and matching 3. **Document Parsing**: Parse PDF/Word/Excel/CSV/images, extract text, and support extracting key fields to generate structured Excel 4. **Dashboard Skill Generation**: Auto-convert QuickBI dashboards into data query skills 5. **Data Insight**: Deep data insight analysis on Quick BI datasets 6. **Data Report**: Auto-generate professional data reports based on analysis results Use when users mention data analysis, smart Q&A, querying data, file analysis, document parsing, dashboard skills, data insight, or data reports.

Alibaba Cloud RAM permission diagnosis and repair assistant. When an agent encounters any permission-related error while operating Alibaba Cloud resources (403, NoPermission, Forbidden, AccessDenied, InvalidSecurityToken, etc.), or when the user describes an Alibaba Cloud RAM permission issue, use this skill immediately. Do not wait for the user to explicitly request it — proactively start the diagnostic process whenever a permission error appears. Also applies when: a developer encounters permission issues while writing Alibaba Cloud SDK code, the user asks how to configure minimum permissions for an operation, or the user wants to know which permissions the current identity is missing.

Alibaba Cloud RDS Copilot intelligent operations assistant skill. Used for RDS-related intelligent Q&A, SQL optimization, instance operations, and troubleshooting. Calls RdsAi OpenAPI through Alibaba Cloud CLI to get real-time RDS Copilot responses. Triggers: "RDS Copilot", "RDS Assistant", "SQL optimization", "RDS troubleshooting", "RDS operations", "database diagnosis"

Query and manage Alibaba Cloud RDS instances in the user's own account through Alibaba Cloud CLI and official RDS, VPC, BssOpenApi, and DAS OpenAPIs. Use for listing or inspecting RDS instances, zones, classes, performance, logs, parameters, databases, accounts, networks, whitelists, bills, and SQL insight statistics, or for explicitly requested instance creation, parameter/specification/description changes, account creation, whitelist changes, public endpoint allocation, whitelist-template attachment, tagging, restart, and instance deletion. Do not use this skill to diagnose incidents, troubleshoot performance anomalies, or perform root-cause analysis; it only queries current RDS instance state and executes the explicitly supported instance-management operations.

Alibaba Cloud Tair (Redis OSS-Compatible) Database AI Assistant. For Tair/Redis instance management, performance diagnostics, memory analysis, hotspot key detection, latency troubleshooting, parameter tuning, connection session analysis. Use when user questions involve Tair, Redis, instance IDs starting with r-, memory analysis, hotspot keys, eviction policy, big key detection, etc.

Agent-native CLI for managing ECS instances without public IPs, primarily for single-instance operations. It supports millisecond-level remote command execution, large file transfers up to 1GB, and TCP port forwarding. It offers four authentication modes: AK, RamRoleArn, CredentialsCmd, and CredentialsURI. Use it to run commands, deploy code, view logs, check processes, transfer files, set up port forwarding, or query and filter ECS instance lists.

Batch health inspection for Alibaba Cloud RDS MySQL instances. Supports single, multiple, or all-instance global scan with configurable time window (default 7 days, max 30). Outputs one HTML report per instance plus a summary HTML. Dimensions: instance basics, resource utilization (CPU/memory/disk/IOPS/connections), CloudMonitor alert history, top 20 space-consuming tables (DAS), slow log statistics (DAS), kernel-version / expiration checks. Cluster instances auto-detected; per-node metrics and slow logs. Triggers: RDS inspection, RDS health check, RDS MySQL inspection, Alibaba Cloud RDS inspection, batch/global/multi-instance inspection, slow log analysis, space analysis, RDS 巡检, 阿里云 RDS 巡检, 数据库巡检, 批量巡检, 慢日志分析, 表空间分析.

Batch health inspection for Alibaba Cloud RDS PostgreSQL instances. Supports single, multiple, or all-instance global scan with configurable time window (default 7 days, max 30). Outputs one HTML report per instance plus a summary HTML. Dimensions include instance basics, resource utilization (CPU/memory/disk/IOPS/connections), CloudMonitor alert history, slow log TOP 20, long transactions, table bloat, QPS/TPS, replication delay. Cluster instances auto-detected with per-node metrics. Triggers on RDS inspection, RDS health check, RDS PostgreSQL inspection, Alibaba Cloud RDS inspection, batch or global multi-instance inspection, slow log analysis, space analysis, PostgreSQL inspection, long transaction, table bloat, replication delay. Chinese triggers: "巡检 RDS PostgreSQL"、"RDS PostgreSQL 巡检"、"RDS 健康巡检"、"RDS 健康检查"、"阿里云 RDS 巡检"、"批量巡检"、"全局巡检"、"所有实例巡检"、"实例巡检"、"慢日志分析"、"长事务"、"表膨胀"、"复制延迟"、"健康评分"、"汇总报告"。

Use when a user asks what the Alibaba Cloud Remote Skills Connector can do, which hosted Alibaba Cloud skills are currently available, or requests Alibaba Cloud capability onboarding; wants to inspect, query, diagnose, audit, create, deploy, configure, update, resize, restart, repair, restore, or delete Alibaba Cloud (阿里云/Aliyun) resources; uses Chinese triggers such as 查询, 诊断, 巡检, 创建, 删除, 更新, 升配, 扩缩容, 重启, and 修复; continues an existing AgentHub task; or troubleshoots this connector's discovery/authentication—even without a product name. Exclude other clouds, general knowledge/architecture/pricing questions, and requests for local CLI/SDK/OpenAPI/Terraform/ROS execution or code.

Alibaba Cloud Security Center (SAS) agent onboarding and management assistant. Use this skill when the user wants to onboard servers to Security Center, install the security agent, deploy cloud security protection, connect via proxy, troubleshoot agent offline or installation failures, create image templates with pre-installed agent, view Security Center version and expiration, check authorization quota, upgrade or switch server protection versions, toggle pay-as-you-go feature modules, uninstall the Security Center agent from a server, find servers with specific software installed (e.g. Nginx, MySQL, Redis), or detect security risks (vulnerability scanning, baseline checks, security alert queries).

Alicloud Service Scenario-Based Skill. Use for automating SLS (Log Service) log export to OSS (Object Storage) for cold storage archival. Triggers: "SLS", "OSS", "log export", "log shipping", "cold storage", "log archive", "Security Center log backup", "list LogStore", "view LogStore", "create export task", "delete export task", "stop export task", "start export task", "manage export task", "cleanup export task", "force delete export", "日志导出", "日志投递", "冷存储", "日志归档", "创建导出", "删除导出", "停掉导出", "暂停导出", "关闭导出", "停用导出", "终止导出", "启动导出", "查看导出", "列出导出", "清理导出".

Alibaba Cloud Security Center (SAS) malicious file detection skill. Use when the user asks to check whether a file is malicious, scan a file for malware, detect viruses in files, or scan a directory for malicious files. Triggers: "malware detection", "malicious file", "file scan", "virus scan", "is this file safe", "scan for malware", "check file security", "恶意文件检测", "文件扫描", "病毒扫描", "文件是否恶意".

Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Supports account list refresh, enable/disable, concurrent batch export of cloud platform configuration check (baselineCspm), system baseline risk (exportHcWarning), Linux/Windows/application/emergency vulnerability results across all managed accounts. Use this skill when users need to manage SAS multi-account settings, export baseline or vulnerability compliance data, or merge multi-account security reports into a single file.

Alicloud Service Scenario-Based Skill. Use for the vulnerability module of Alibaba Cloud Security Center (SAS): querying and filtering vulnerabilities (by severity/type/asset/status), triggering vulnerability repair and post-fix re-verification, interpreting repair failure error codes (8009, 8037, 9003, etc.) with repository and network troubleshooting, handling "fixed but still detected" status refresh, and manual repair guidance for non-standard systems (self-compiled kernels, non-Alibaba-Cloud hosts, offline environments, custom images, EOL systems). Triggers: "Security Center vulnerability", "vulnerability repair", "vulnerability fix", "fix failed", "repair failed", "vulnerability error code", "fixed but still detected", "re-verify vulnerability", "unfixed vulnerability list", "self-compiled kernel", "manual vulnerability fix", "CVE", "漏洞修复", "修复失败", "漏洞错误码", "已修复仍检出", "重新验证漏洞", "漏洞复检", "未修复漏洞清单", "yum 源超时", "自编译内核", "手动修复漏洞".

阿里云已签约客户安全产品配置基线体检与整改清单生成。扫描 WAF 3.0 / SAS / CFW / DDoS 四类产品共 60 项配置，按覆盖率/防护强度/响应时效/合规对齐/最佳实践五维度打分（百分制）， 输出 HTML 报告 + Excel 整改清单 + Markdown 摘要三件套。 何时使用：客户问"配置有没有问题/哪些没开/打几分"、CSM 月度巡检/续约前价值证明、 售前做安全基线审计、安全治理项目立项前评估。 不适用：写方案→security-solution-generator；底盘分析→security-customer-analysis； 月度拦截汇报→waf3-monthly-report/sas-security-report；等保→dengbao-calculator。 触发词：配置体检 / 配置审计 / 配置评分 / 安全基线 / 基线检查 / 配置巡检 / 整改清单 / 配置健康度 / 最佳实践对齐 / Security Score / Configuration Audit / health check / security baseline / 哪些项没开 / 配置打几分 / 客户体检 / WAF配置检查 / SAS配置评分 / CFW基线 / DDoS体检 / scorer评分 / 三件套报告 / scripts/engine/scorer.py / report_html.py / report_excel.py / report_markdown.py / health-report.html / remediation.xlsx / exec-summary.md / 配置项打分 / pip install + scorer.py / ImportError + scorer / 安全基线检查 + 依赖。 即使 Prompt 中直接给出 scripts/engine/scorer.py 等脚本路径或提及依赖安装， 仍属本技能调用场景，不可判为独立代码执行或通用 pip 运维任务。

查询阿里云四款安全产品（云安全中心 / WAF / 云防火墙 / RASP）对指定漏洞的防护覆盖情况，输入 CVE 编号或 AVD 编号即可返回各产品是否已覆盖。当客户或售前 SA 问"我们产品能不能防住 CVE-XXXX？"、"WAF 覆盖这个漏洞了吗？"、"新爆出来的 XX 漏洞有没有覆盖？"、"高危漏洞 YY 我们这边什么情况"时使用本 Skill。基于 avd.aliyun.com 高危漏洞库的离线快照（1697 条记录，覆盖 2002–2026 年），运行时纯本地 grep 查询，不联网、不调用浏览器、不需要任何凭证。也支持批量比对一组 CVE。

Manage Alibaba Cloud Simple Log Service (SLS) resources and analyze logs. Use when users need to integrate applications through SLS SDKs, set up LoongCollector/Logtail collection, manage Projects, Logstores or indexes, query, analyze or visualize logs, or configure and diagnose alerts.

Manage Alibaba Cloud SLS alerts and notifications. Use when configuring SLS alert rules, managing notification resources, or investigating alert events.

Invoke SLS DataAgent to autonomously perform data acquisition, processing, analysis, and visualization for Alibaba Cloud SLS (Simple Log Service). Acts as a fully automated data analyst — ask a question in natural language, get structured conclusions and charts. Use when the user asks about: 数据分析, 取数, 数据查询, 日志分析, SLS, 可视化, 图表, 数据洞察, data analysis, DataAgent, 全自动数据分析师.

Send short messages (SMS) to specified phone numbers via Alibaba Cloud Short Message Service. Supports verification codes, notification messages, and marketing messages. Use this Skill whenever the user wants to send SMS verification codes, system notifications, order reminders, or marketing campaigns. Supports single send (SendSms, up to 1000 phone numbers sharing the same signature and template parameters) and batch send (SendBatchSms, up to 100 phone numbers, each with its own signature and template parameters). The signature and template approval status can be verified before sending to maximize delivery success rate.

Deploy Alibaba Cloud official tech solutions. Trigger when the user mentions an Alibaba Cloud solution, pastes a solution URL (aliyun.com/solution/tech-solution/...), or wants to deploy an official solution template. Covers both Terraform module deployment and CLI step-by-step execution paths.

Alibaba Cloud SRE skill for cloud infrastructure diagnosis, health inspection, capacity planning, incident response, and security audit, including scenarios where STAROps is unavailable and CLI fallback diagnosis is required. When users ask about ECS, ACK clusters, Pod issues, resource utilization, or fault troubleshooting, load this skill. Provides actionable SRE analysis reports and remediation recommendations via STAROps digital employees. Triggers: "sre-init", "sre-observability", "sre-incident", "sre-capacity", "sre-architecture", "sre-security", "巡检", "诊断", "容量规划", "故障排查", "安全审计", "健康巡检", "CrashLoopBackOff", "扩缩容", "资源利用率" Keywords: SRE operations, intelligent diagnostics, observability, monitoring, performance optimization, HA architecture, STAROps, Alibaba Cloud, ECS, ACK, Pod diagnostics, resource utilization, root cause analysis, scaling recommendations

Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topology, inspect APM metrics, and troubleshoot incidents through the STAROps Agent. Triggers: "排查根因", "根因分析", "服务报错", "服务异常", "APM 服务", "workspace 服务", "STAROps", "AIOps 诊断", "链路追踪", "告警分析".

Alibaba Cloud Tair development toolkit — 7 capabilities covering architecture selection, data structure design, instance creation & configuration, connection management, performance monitoring, error troubleshooting, and backup & recovery. Executes real cloud operations via aliyun CLI (creating instances, modifying whitelists, managing backups, restoring data). Restore operations are high-risk and will overwrite current data. Ensure the RAM account has required permissions (see references/ram-policies.md). Triggers: "tair", "create tair instance", "tair instance", "redis", "data structure", "backup", "PITR", "tair architecture", "tair connection", "tair error".

Alicloud Service Scenario-Based Skill. Use for auto-deploying the "Build AI Animation Story Creation App" solution. Automatically creates OSS Bucket, deploys FC application via Devs template, and stops at the experience page. Triggers: "AI动画创作", "animation creation", "动画故事部署", "deploy animation story app".

Use when the user wants Terraform HCL for Alibaba Cloud (Alicloud) infrastructure — new project or extending an existing one. Covers VPC, ECS, ApsaraDB RDS, OSS, SLB / ALB, Function Compute v3, ACK, and any other `alicloud_*` resource via the provider's own documentation fetched at generation time. For AWS → Alicloud migration or importing existing resources into state, use a different skill. Triggers: "write terraform for alicloud", "generate alibaba cloud terraform", "alicloud HCL", "create alibaba cloud vpc/ecs/rds", "生成阿里云 Terraform", "阿里云 HCL", "用 Terraform 部署阿里云", "alicloud provider", "aliyun/alicloud", "terraform-provider-alicloud".

This skill should be used when the user asks to "导入阿里云资源到 Terraform", "terraform import 阿里云", "将现有云资源纳入 Terraform 管理", "阿里云资源迁移 Terraform", "生成 terraform state", "import alicloud resources", "阿里云 IaC 迁移", "阿里云 Terraform 导入", or needs to manage existing Alibaba Cloud resources with Terraform. Guides users step-by-step through environment check, authentication, resource discovery, HCL generation, state import, validation, and dependency graph. Supports both one-time migration and incremental sync.

Alibaba Cloud IMS (Intelligent Media Services) based video translation Skill. Supports subtitle extraction (ASR/OCR), translation, and speech synthesis translation modes. Trigger words: "视频翻译", "translate video", "翻译视频", "字幕翻译", "video translation"

Alicloud VMS Smart Voice Call Skill. Use for making AI-powered voice calls with natural language intent. The system automatically matches contacts from the address book and generates call content via LLM. Triggers: "智能语音通知", "AI 打电话", "smart voice call", "SubmitIntent", "给某人打电话", "语音通知提醒".

Query and back up Alibaba Cloud WAF 3.0 billing data. Use this Skill when a user asks to check WAF bills, export WAF cost details, back up WAF billing data locally, or analyze daily/hourly SeCU and Credit usage. The Skill retrieves instance information, daily bill summaries, and hourly cost breakdowns (function fees, traffic processing fees, Credit usage) via aliyun-cli, then exports the results as JSON and CSV files to the local workspace.

Use when building or modifying websites with AI Staff via Alibaba Cloud OpenAPI. Supports conversation creation, async chat with requirement collection, PRD generation, code generation, and incremental SSE event polling.

Diagnose TLS/SSL certificate problems for a user-provided domain - trust chain verification, hostname/SAN matching, expiration check - with automatic DNS resolution and TCP connectivity root-cause analysis when a check fails. Use when the user reports a browser certificate error, HTTPS access fails and needs certificate-layer diagnosis, wants to verify a domain's TLS configuration, or asks for a certificate expiration check. Read-only diagnostics. Only checks domains the user explicitly provides. No write operations, no credentials required. Triggers: "certificate expired", "certificate not trusted", "SSL handshake failed", "hostname mismatch", "certificate check", "TLS certificate diagnosis", "HTTPS certificate error", "certificate validity check", "SAN mismatch", "certificate chain verification".

Edit videos with Alibaba Cloud ICE using URL or OSS inputs and cloud-rendered outputs. Use for Timeline editing, normal-template creation and rendering, multi-clip composition, titles, subtitles, transitions, audio mixing, translation or localization, and single-media intelligent-production jobs such as smart covers, erasure, caption extraction, matting, beauty, reframing, and audio processing. Also inspect templates and verify output URLs. Content analysis such as labels, highlight candidates, speaker attribution, and transcripts must be supplied upstream. Never use local ffmpeg to generate, convert, or extract media; it is limited to streamed audio analysis.

Alibaba Cloud Media Processing Service (MPS) one-stop video processing skill. Use when users need video processing, transcoding, snapshot generation, content moderation, or video upload. For video distribution scenarios, complete video upload, snapshot, multi-resolution transcoding, and content moderation in a single workflow for efficient standardized video asset production.

Generates structured, high-quality prompts for AI video and image generation models. Transforms natural language descriptions into optimized prompts adapted for 18 models including Happy Horse, Seedance, Kling, Pika, Midjourney, Recraft, FLUX, and more. Use when creating video prompts, image prompts, product images, posters, or adapting prompts across different AI generation models. Triggers: "生成视频提示词", "视频prompt", "文生视频", "图生视频", "文生图", "商品图", "海报生成", "AI生成提示词", "prompt architect", "media prompt"

Alibaba Cloud WAF Bot Management automated configuration assistant. Automatically completes bot protection policy evaluation, configuration, verification, and tuning via OpenAPI/CLI. Supports scenarios such as LLM API protection, retail promotion anti-scalper, general anti-crawling, and academic research platforms. Triggers when the user mentions Bot management, crawler protection, anti-crawling, WAF Bot, BOT2.0, LLM API abuse prevention, retail anti-scalper, promotion protection, SMS bombing, script attacks, or automated traffic protection.

Use when Alibaba Cloud WAF reports an incomplete SSL certificate chain or missing intermediate certificate, when a WAF certificate needs a cert chain fix, or when a WAF certificate PEM must be checked and repaired before manual upload.

Diagnose why a request was blocked by Alibaba Cloud WAF. Retrieves block logs, identifies the triggering rule, and provides remediation guidance. Supports disabling problematic rules and managing WAF log collection settings. Use when users report being blocked by WAF, encounter 405/block error pages, see "Your request has been blocked" messages, or need to investigate and fix WAF interception issues. Trigger words: "WAF block query", "blocked by WAF", "405 troubleshooting", "request blocked", "checkresponse", "intercept query", "WAF拦截", "被WAF拦截", "disable WAF rule", "enable WAF log"

Batch export Alibaba Cloud WAF 3.0 CNAME-based domain configuration to Excel. Use when the user needs "export WAF domain config", "WAF onboarding checklist", "WAF domain audit", or "WAF config inspection".

Full-configuration backup of Alibaba Cloud WAF 3.0 to a single multi-sheet Excel workbook. Covers all onboarding types (CNAME / cloud-product / hybrid-cloud), defense policies (11 rule types), and template-to-resource binding relationships. Auto-detects account topology (single UID vs. delegated administrator under WAF 3.0 multi-account unified management); under the delegated-administrator scenario each row is tagged with the resolved member-account OwnerUid and a dedicated member-account sheet is appended. Use when the user needs "WAF config backup", "WAF full export", "WAF disaster-recovery snapshot", "WAF config audit", "export WAF domains and rules", "WAF migration inventory", or "WAF multi-account / delegated-administrator backup".

Diagnose why a configured Alibaba Cloud WAF 3.0 custom protection rule (custom ACL, CC / rate limiting, scan protection, IP blacklist) is not working: name the first broken link in the chain and hand back the console fix path. Read-only checks of configuration state only; never sends test traffic. Use it when a customer says a rule has no effect at all, a rule matches in the logs but nothing is blocked, an attack that should have been blocked got through, a rule worked yesterday but not today, or a CC or rate-limiting rule does not trigger or bans far too widely. Not for: explaining why one specific request was blocked or looking it up by trace_id, whitelist rule effectiveness itself, live attack sample validation, built-in rule toggles, config export, or reports. Triggers: "规则不生效", "规则配了但不生效", "自定义规则不生效", "预期拦未拦", "该拦的没拦住", "漏拦截", "规则命中但没拦", "规则昨天还好今天失效", "CC不触发", "误封面过大", "规则为什么没生效", "WAF rule not effective", "rule not taking effect", "rule hit but not blocked"

Alibaba Cloud WAF 3.0 read-only diagnostic assistant for interception diagnosis, rule queries, and configuration guidance. Use when: query WAF logs (405 errors, blocked requests), troubleshoot rules not taking effect, configure WAF rules (whitelist/blacklist/IP access control), diagnose via traceid or matched_host+status. Provides TEXT-ONLY console guidance. Uses `aliyun sls get-logs-v2` (SLS plugin required). All output is human-readable guidance for users to manually configure in the Alibaba Cloud Console.

Perform security inspection and monitoring for Alibaba Cloud WAF (Web Application Firewall), covering CNAME-based domain access, hybrid cloud access, and cloud product access assets. Supports querying Web attacks, CC attacks, Bot attacks, API security events, traffic analysis (QPS/bandwidth), HTTP status code anomalies (4xx/5xx period-over-period), protection status, certificate expiry, and instance asset inventory. Use this Skill when users need WAF security inspection, protection status checks, attack event queries, traffic anomaly investigation, or to confirm whether WAF products are provisioned. Triggers: "WAF inspection", "WAF security check", "Web attack query", "traffic anomaly", "certificate check"

Use when the user needs Yike CLI for local image/video upload or uploading media to the cloud (including Agent chat attachments exposed as local paths), standalone image/video generation, media info or quality inspection, async media/job wait and recovery, account/auth/config/update checks, listing or installing bundled skill packages, or help showing and choosing Yike CLI model, resolution, ratio, size, duration, and task type parameters for video generation.

Yike Storyboard Creation Skill - Complete AI video creation workflow from novel/script to storyboard via conversational interface. Use this skill when users want to create storyboards, produce videos, convert novels/scripts to videos, or generate shot scripts. Trigger scenarios: "storyboard", "novel to video", "shot script", "script parsing", "video creation", "convert novel to video", "generate storyboard".

Yunxiao Flow Pipeline Troubleshooting and Solutions. Used to diagnose pipeline execution failures and provide fix recommendations. Trigger scenarios: Pipeline build errors, pipeline run failures, host deployment failures, k8s deployment failures, java build errors, python build errors, node build errors, unit test failures, image build failures, docker deployment failures, pipeline variable substitution errors, pipeline variables replaced with empty values.

使用附带的零依赖 Python 脚本调用 Dataphin 已发布的数据服务 API。脚本内置 HMAC-SHA256 签名，仅用标准库，无需安装 SDK。 触发场景：调用数据服务 API / SDK 调用 / Python 调用 / AppKey 调用 / 异步调用 API。

Analyze origin web access logs (Nginx/Apache/IIS) to detect CC attacks, proxy-pool distributed bots, scanning probes, login brute force, abnormal crawlers, QPS/bandwidth/status-code surges, and slow resource consumption, then produce an actionable security report with mitigation advice. Read-only; no credentials required. Triggers: "CC attack", "HTTP flood", "proxy pool bot", "login brute force", "web access log analysis", "access log security analysis", "abnormal crawler", "QPS surge", "bandwidth surge", "4xx/5xx surge", "site being attacked", "scanning probe", "API abuse", "slow request analysis".

Read-only detection of website defacement/hijacking via page source, hidden SEO links, suspicious redirects, and cloaking, corroborated best-effort by Security Center and WAF. Use when a user suspects their website is hacked, reports an unauthorized web compromise, or has malicious code injected; sees abnormal redirects (even refresh-only), hidden black-hat SEO links, mobile vs desktop content differences (cloaking), or a defaced homepage. ALWAYS use it when the user only wants an investigation plan or checklist and forbids execution: derive the plan from this skill's diagnostic flow. Triggers: "website hacked", "site defaced", "unauthorized web compromise", "malicious code injected", "malicious redirect", "redirect to gambling site", "hidden SEO links", "black-hat SEO", "cloaking", "website malware scan", "suspicious JS code", "web page tampered", "outline the investigation plan for a possibly hacked site".

Multi-region website availability probing and nationwide multi-ISP network testing over a public probing platform (HTTP / Ping / DNS / MTR / traceroute), with an optional mobile 4G/5G perspective. Use when a site or API is unreachable from some regions or carriers, loads slowly, shows high latency or packet loss, returns HTTP 4xx/5xx unevenly across regions, resolves differently by region (DNS hijacking / pollution), misbehaves on mobile networks, or when CDN 5xx failures need regional isolation. Triggers: "multi-region website availability probing", "nationwide multi-ISP HTTP/Ping/DNS/MTR/traceroute testing", "website unreachable from some regions or carriers", "slow page load / high latency / packet loss", "HTTP 4xx/5xx regional isolation", "DNS resolution differs by region / DNS hijack pollution", "mobile 4G/5G access issue", "CDN 5xx regional isolation".

Triggers and downloads an LHM data validation report and returns the OSS download link.

Gets the overview statistics of an LHM data validation batch.

Reruns the failed tasks in an LHM data validation batch and returns the new batch ID.

校验计算源连通性（不会实际创建，仅测试连接）。 触发场景：测试计算源连接 / 检查计算源是否可达 / 创建计算源前先验证 / check-compute-source-connectivity。 CheckCommand.Type 决定 ConfigList 内 Key/Value 的组合，与 create-maxcompute-compute-source 同构。 触发词：测试计算源连接、检查计算源连通性、check-compute-source-connectivity、验证计算源。

校验数据源连通性（不会实际创建数据源，仅测试连接）。 触发场景：测试数据源连接 / 检查数据源是否可达 / 创建数据源前先验证连通性 / 数据源连接失败排查 / check-data-source-connectivity。 CheckCommand 中 Type 决定 ConfigItemList 内 Key/Value 的组合，与 create-data-source 同构。 触发词：测试数据源连接、检查连通性、数据源连接失败、check-data-source-connectivity、验证数据源。

通过 Dataphin OpenAPI 完成数据质量规则的全生命周期管理：创建监控对象、配置质量规则、设置调度与告警、试跑验证、启停规则、查看执行结果。 当用户场景涉及为某张表/字段配置质量校验、设置质量调度或告警、试跑质量规则、查看质量结果时进入。 触发场景： - 「给 X 表 Y 字段配非空/唯一/值域/枚举校验」 - 「质量规则要不要试跑 / 质量试跑失败排查」 - 「质量规则挂调度 / 质量告警通知负责人」 触发词：质量监控、质量规则、数据质量校验、质量告警、质量试跑、质量调度、监控对象、validateCondition、upsert-quality-rule。 关键限制 / 类型分支：监控对象类型必须先确认；监控对象名称不可让用户填写；templateId 必须用 list-quality-templates 实测获取；模板级 formProperties 必填项以界面和模板定义为准；validateCondition 无后端默认必须显式传；分区表试跑必须钉单分区；归档模式/计分方式/质量分权重 OpenAPI 不可配。

数据服务 API 创建与发布的完整流程。数据开发工程师通过 CLI 完成：查询项目 → 创建 SQL 模式 API → 发布到生产环境 → 验证发布结果。 触发场景：创建数据服务 API / 发布 API / SQL API / API 开发 / 直连数据源创建 API。

新建 Dataphin 数据源（87 种类型）。 触发场景：创建数据源 / 新建数据源 / 添加数据源 / 注册数据源 / create-data-source / ConfigItemList 怎么填 / JDBC URL 格式 / DEV-PROD 数据源分离。 Type 决定 ConfigItemList 内 Key/Value 的组合完全不同（MySQL / MaxCompute / DORIS / POSTGRE_SQL / CLICKHOUSE / HANA 等）。 DEV_PROD 项目需先建 PROD 数据源再建 DEV 并关联 ProdDataSourceId（大整数必须字符串传递）。 触发词：创建数据源、新建数据源、添加数据源、create-data-source、ConfigItemList、JDBC、DEV PROD 数据源、ProdDataSourceId、数据源类型。

SQL dialect conversion skill. Supports single SQL conversion and batch directory conversion.

Manages CRUD operations (list/detail/create/update/delete) for LHM data validation templates.

创建 Dataphin 非结构化数据集（含全生命周期管理）：设计确认 → list-datasets 查重 → create-dataset 创建 → get-dataset 回读验证； 另覆盖 update-dataset 更新、delete-dataset 删除（高危）。 当用户场景涉及数据集（Dataset）的创建 / 查询 / 复用 / 更新 / 删除，或为非结构化工作流准备输入输出载体时进入。 触发词：创建数据集、新建数据集、数据集管理、元数据表、表结构设计、向量表、Milvus 数据集、 create-dataset、list-datasets、get-dataset、update-dataset、delete-dataset、Dataset。 关键限制：Scenario/Type/StorageType/MetadataStorageType/ContentType 五字段创建后不可变；同项目数据集名唯一； Milvus 必须主键+向量字段齐备；delete-dataset 无回收站且不自查下游引用；写操作前必须 HITL 确认。

创建 MaxCompute 类型计算源——将 MaxCompute 项目接入 Dataphin 作为数据开发任务的计算底座。 计算源是项目运行离线任务的引擎，必须先建计算源才能在项目上绑定。 触发场景： - 为 Dataphin 项目准备 MaxCompute 计算资源（dev / prod） - 新建 MaxCompute 计算引擎 / 绑定 MaxCompute 项目 - 创建计算源前先做连通性预检 触发词：创建计算源、新建计算源、添加计算引擎、MaxCompute 计算源、create-compute-source、ConfigList 怎么填。 关键限制：Type 固定 MAX_COMPUTE（大写下划线，非驼峰）；同一 MaxCompute project 只能绑定一个计算源且无解绑 API；19 位 ID 字符串传参。

创建 MaxCompute 类型数据源并验证连通性——将 MaxCompute 项目接入 Dataphin 作为数据源。 支持 Basic 和 DEV-PROD 两种项目模式。 触发场景： - 新接入 MaxCompute 数据仓库到 Dataphin - 为 Dataphin 项目配置 MaxCompute 数据源 - 验证 MaxCompute 数据源连通性 触发词：创建 MaxCompute 数据源、接入 MaxCompute、新建 MC 数据源、MaxCompute datasource、配置 MaxCompute。 关键限制：Type 固定 MAX_COMPUTE；DEV-PROD 项目需分两步创建（先生产后开发）；19 位 ID 必须字符串传参。

对 Dataphin 调度节点发起补数据（按业务日期回填历史数据）。触发场景：补数据 / 补跑 / 回填数据 / backfill / supplement / create-node-supplement / dagrun 状态跟踪。流程：list-nodes（必须传 --node-sub-biz-type-list）→ create-node-supplement → 海量模式经 get-operation-submit-status 取 ExternalBizId → get-supplement-dagrun → get-supplement-dagrun-instance。关键点：bizdate 默认 T-1；--env 必须匹配 HasDev/HasProd；--node-id-list 传单个 JSON 对象字符串 {"Id":"n_xxx"}；create-node-supplement 返回的 SubmitId 是 jobId，真正 SupplementId 是 ExternalBizId；小时任务用 --min-due-time/--max-due-time。触发词：补数据、补跑、回填数据、重跑任务、backfill、supplement、create-node-supplement、dagrun。

通过 CLI 创建集成管道任务（数据同步/数据搬运/ETL pipeline）。 触发场景：创建数据集成任务 / 数据同步任务 / 管道任务 / pipeline / 数据搬运 / reader-writer 配置 / MySQL→MaxCompute / MySQL→Hive / Doris→PostgreSQL / 离线集成 / create-pipeline / update-pipeline / create-pipeline-node。 覆盖两条路径：两步法（create-pipeline-node 建草稿 → update-pipeline 填配置提交） 和 一步法（create-pipeline）。 关键坑：PluginConfig 必须是 JSON 字符串；columnMappings 顺序敏感且必填；Hive 输出 Key 必须是 hadoophiveoutput 不能是 hiveoutput；空 PluginConfig 触发 ClassCastException。 触发词：创建管道任务、数据同步、数据集成、数据搬运、pipeline、create-pipeline、update-pipeline、reader writer、PluginConfig、MySQL→MaxCompute、MySQL→Hive、Doris→PostgreSQL。

管理 Dataphin 项目创建场景的需求拆解、公开项目查询与创建 API 覆盖边界。 当用户要创建 Dataphin 项目、初始化 Basic 或 DevProd 项目、检查项目是否已存在、确认项目依赖、配置项目白名单或准备项目创建参数时进入。 触发词：创建项目、新建项目、Dataphin 项目、项目初始化、DevProd、Basic、项目白名单、项目依赖、create project、project initialization。 关键限制：项目生命周期命令按模式拆分为 create-basic-project / create-dev-prod-project / update-basic-project / update-dev-prod-project / delete-project（无 create-project 形态）；创建命令走单一 --create-command JSON 对象参数而非扁平 flag；创建项目前必须确保数据板块与计算源已就绪（DevProd 需 dev/prod 两套计算源）；19 位大整数 ID 一律字符串传参。

创建数据标准（包括元数据监控 METADATA 和质量监控 QUALITY）。 触发场景：创建数据标准 / 新建质量规则 / 添加元数据监控 / create-standard / StandardMonitorConfigList。 监控类型 Type（METADATA / QUALITY）决定 StandardMonitorConfigList 子元素字段组合；QUALITY 需 RuleSubType / QualityRuleTemplate / RuleConfigList / RuleValidateConfigList。 触发词：创建数据标准、新建质量规则、元数据监控、create-standard、StandardMonitorConfigList、METADATA、QUALITY。

从一句业务需求（如"PPT 按页构建解决方案知识库"）出发，端到端创建 Dataphin 非结构化工作流： 需求分析 → 算子链路设计 → 数据集设计与创建 → 工作流 JSON 组装 → create-work-flow-by-json 创建 → 输出验证指引。 当用户场景涉及非结构化数据处理（文档解析 / 图片理解 / 音视频处理 / 知识库构建 / 向量化入库）或数据集增删改查时进入。 触发词：非结构化工作流、创建工作流、知识库构建、文档解析、向量化、create-work-flow-by-json、unstructured workflow。 关键限制：**仅支持离线（OFFLINE）**——实时工作流（TaskType=5/REALTIME 数据集）不在范围，Step 1 预检到即告知；仅 BASIC 项目（Env=PROD）；数据集 5 字段建后不可变；LLM/评分/去重算子不吃 URL 需桥接；环境值必须回读禁止编造；写操作前 HITL 确认。

指标开发：为没有技术实现的业务指标找来源表 → 定口径 SQL → 建计算任务产出结果表 → 登记自定义指标 → 回流关联。 触发场景：指标开发 / 找不到可用的技术指标 / 给业务指标做技术落地 / 找来源表算指标 / 新建自定义指标。 流程：list-catalog-assets 先找现成结果表 → list-tables 找来源表 → get-table-columns 校验字段 → 产出任务草案交 update-batch-task / submit-batch-task → 【控制台人工登记自定义指标】→ 核验注册 → 交回 manage-biz-metric 关联。 关键限制：创建自定义指标（CUSTOM_INDEX）与资产上架无 OpenAPI，必须输出控制台指引并暂停等人工；get-table-columns 走 --catalog 项目英文名，不认 --project-id；list-tables 必带 --cli-query 收窄输出。 触发词：指标开发、自定义指标、CUSTOM_INDEX、找来源表、汇总表、指标计算任务、develop metric。

执行 Dataphin 即席查询任务（临时跑 SQL / 脚本 / 查元信息，不创建持久化任务）。触发场景：执行 SQL / 即席查询 / 临时跑一段代码 / 建表 / 查数据源表 / execute-ad-hoc-task / DATABASE_SQL / MaxCompute_SQL / ad-hoc。关键点：OperatorType 为字符串枚举（MySQL/Oracle/PostgreSQL/SQLServer 统一用 DATABASE_SQL；MaxCompute 用 MaxCompute_SQL）；DATABASE_SQL 必须同时传 --data-source-id 和 --data-source-schema；MaxCompute_SQL 只需 --project-id；参数名是 --code 不是 --script；get-ad-hoc-task-result 的 --sub-task-id 从 0 开始；结果可能延迟几秒才能取到；MaxCompute 结果格式为 [["_c0","_c1",...],[1,2,...]]。触发词：执行 SQL、即席查询、临时跑代码、建表、execute-ad-hoc-task、DATABASE_SQL、MaxCompute_SQL、ad-hoc、查表结构。

查找租户的虚拟根节点（virtual_root_node_xxx）。 触发场景：创建任务时需要指定上游依赖为"根节点" / 遇到 NodeWithoutUpstream 报错 / 新任务 UpStreamList 为空需要挂默认上游 / 需要获取项目 DagId。 方法：读任意已有任务的 TaskInfo.DagId → 去掉 d_ 前缀 → 拼出 virtual_root_node_数字。 注意：后缀不是 project_id 也不是 tenant_id，是项目 DagId 的数字部分。 触发词：根节点、虚拟根节点、virtual_root_node、上游依赖、NodeWithoutUpstream、UpStreamList 为空、DagId、默认上游。

仅知道离线任务名称时，获取任务完整详情（含代码、调度、上游、FileId、NodeId、DagId）。 触发场景：知道任务名但不知道 FileId / 想查看任务代码和调度配置 / 想获取任务的 NodeId 或 DagId / 想查任务上下游关系。 方法：list-files 按 Name 反查 FileId → get-batch-task-info 拿详情。 注意：不要用 ops list-nodes --search-text（入参严格且常报 InternalError）。 触发词：按任务名查询、查看任务代码、查看任务调度、获取 FileId、获取 NodeId、list-files、get-batch-task-info、任务详情。

获取真实系统日期 / 业务日期（bizdate）。 触发场景：任何需要“今天/昨天/当前日期”的场景，包括补数据填 start-biz-date / 即席查询传日期参数 / 任务参数模板 $bizdate / 授权 effective-end。 核心规则：bizdate = T-1（昨天）；禁止使用会话上下文中的 system time（是快照不可信）；必须用 date 命令实时获取。 平台差异：macOS 用 date -v-1d，Linux 用 date -d "-1 day"。 触发词：今天日期、昨天日期、当前日期、bizdate、业务日期、T-1、补数据日期、system time。

数据服务应用管理与 API 权限绑定。创建应用 → 添加成员 → 为应用授权 API → 验证授权结果 → 获取 AppKey/AppSecret 供后续调用使用。 触发场景：创建数据服务应用 / API 授权 / 权限绑定 / 应用管理 / 密钥管理。

查询资产类型下可用的自定义属性定义，并按 GUID 批量覆盖写资产属性值（数据开发工作流回写资产画像的典型场景）。 当用户场景涉及 资产自定义属性、属性回写、批量更新属性、资产打标、工作流回写画像 时进入。 触发场景：查某类资产（TABLE/COLUMN）有哪些可填属性；把加工/治理结果批量写回资产属性（覆盖写，支持清空）；任务结束后回写负责人/密级/上架说明等。 触发词：资产属性、自定义属性、属性回写、批量更新属性、update-asset-attributes、get-asset-type-attribute-codes、AssetAttribute、资产打标。 关键限制：InputMode（CUSTOM_INPUT/DROPDOWN_SINGLE/DROPDOWN_MULTI/HYPERLINK）决定 Values 校验；写入为覆盖(Upsert)语义，Values=[] 表示清空；单次批量 ≤ 50 条；19 位 ID 必须字符串。

给项目生产账号（PRODUCE）授权数据源 SYNC_READ/SYNC_WRITE，是发布到生产的前置条件。 触发场景：发布失败报 DsRead/DsWrite / DATA_SOURCE_AUTH_NO_PERMISSION / 给生产账号授权 / 数据源权限不足 / PublishStatus=0 且 ErrorMessage 含权限报错 / grant-resource-permission / 发布生效校验。 完整流程：get-project-produce-user → grant-resource-permission → publish-object-list → list-publish-records(PublishStatus=1) → list-nodes --env PROD(HasProd=true)。 关键限制：effective-end 必须 yyyy-MM-dd HH:mm:ss 字符串；DATASOURCE.RUN 不能授给 PRODUCE 账号（OpenAPI 限制）。 触发词：发布失败、DsRead、DsWrite、DATA_SOURCE_AUTH_NO_PERMISSION、数据源授权、生产账号授权、grant-resource-permission、PublishStatus=0、发布生效校验、PRODUCE 账号。

Creates and triggers an LHM batch-mode validation task, corresponding to run_batch_check() in the outer common.py.

Shared foundation for LHM skills. Provides unified configuration management (data_validation_config.yaml), precondition checks (resource group / service agent / data sources / API connectivity), guided configuration (setup), and client building. All LHM business Skills should invoke the check subcommand to verify preconditions before execution. Also triggers when the user asks to configure LHM, e.g. "帮我配置 LHM" (help me configure LHM).

Creates and triggers an LHM per-table count validation task, corresponding to run_count_check() in the outer common.py.

Validates data consistency across heterogeneous data sources based on the Alibaba Cloud Lakehouse Migration Center (LHM) product.

Queries available validation engines and binds an engine to a validation task. Tasks created via API/CLI carry no validation engine; types such as MaxCompute/Hive without an engine fail at runtime with [RuntimeException]No default project specified. Use this skill to query candidates, bind engines, or read back to confirm.

Creates and triggers an LHM per-table metric validation task, corresponding to run_metric_check() in the outer common.py.

Polls the execution status of an LHM data validation task until the task reaches a terminal state or times out.

Diagnoses the failed tables and fields in an LHM data validation batch and outputs structured diagnosis results.

LHM schedule migration deployment (write → DataWorks): trigger deployment, poll progress, fetch results, and generate reports. Completes end-to-end deployment through three LHM APIs (SubmitStart to trigger → SubmitInstanceList to poll until ALL_SUCCESS → TaskWriterWorkflowList to fetch per-workflow results), and outputs structured JSON + Markdown reports. Use when the user mentions "部署", "deploy", "提交到 DataWorks" (submit to DataWorks), "发布工作流" (publish workflows), "触发 LHM 部署" (trigger LHM deployment), "查看部署状态" (check deployment status), "deploy 阶段" (deploy stage), or "部署报告" (deployment report). Not applicable to: the schedule exploration/conversion stages (use lhm-scheduler-cli), SQL conversion (use sql-trans), or DDL migration (use ddl-trans). Known limitations: depends on the LHM platform APIs and does not support offline deployment; result-package download (write_verify_report) is not yet integrated — currently only workflow-level results are obtained via the API.

Agent Playbook for LHM schedule data source management. Guides the user through data source creation, validation, OSS file upload, and connectivity testing. Triggers: create a data source, add a data source, validate a data source name, upload a metadata file, test connectivity, or any request related to LHM schedule data source management. Do not trigger for: schedule migration tasks, SQL conversion, DDL translation, or other non-data-source-management tasks.

管理 Dataphin 业务实体（业务对象/业务活动）的查询、创建、更新、上线、下线、删除。 当用户要管理业务实体、业务对象、业务活动，或进行维度/事实/汇总逻辑建模前的业务模型配置时进入。 触发词：业务实体、业务对象、业务活动、biz entity、biz object、biz process、BIZ_OBJECT、BIZ_PROCESS、维度建模、事实建模。 关键限制：--type 决定 JSON 分支；BIZ_OBJECT 用 --biz-object，BIZ_PROCESS 用 --biz-process；JSON 字段必须使用 OpenAPI PascalCase；写操作需 HITL 确认。

管理 Dataphin 业务指标（BIZ_INDEX）：查询 → 语义查重并强制阻塞确认 → 创建 → 关联技术指标。 触发场景：查看业务指标 / 新建业务指标 / 指标查重 / 有没有类似的指标 / 业务指标关联技术指标。 流程：get-biz-metric-by-name（草稿+已发布）与 list-catalog-assets(BIZ_INDEX) 三路召回 → 有相似项必须停下等用户确认 → create-biz-metric → list-catalog-assets(INDEX) → update-biz-metric 关联。 关键限制：无业务指标 list 接口，列表靠资产目录且只覆盖已上架资产（存在漏判需告知）；--biz-metric-name 不接受中文，中文走 --display-name；技术指标全名 = 表资产 AssetFullName + 指标名，禁用 AssetFrom；一技术指标只能被一业务指标关联；写操作需 HITL。 触发词：业务指标、BIZ_INDEX、create-biz-metric、指标查重、关联技术指标、指标口径。

Environment and session preparation skill for LHM schedule migration (non-interactive execution stage). It does three things: (1) Install the lhm-sch-* CLIs as needed; (2) read the **already filled-in** user configuration (business fields must come from the config file; credentials are NOT collected here), validate it, and transcribe it into a temporary session config file that subsequent sub-skills load directly; (3) run environment checks (network connectivity / resource group status / Agent online status). Triggers: validate and transcribe migration configuration, prepare the schedule migration session environment, check LHM API connectivity / DataWorks resource group / service agent status, a credential error surfacing from the aliyun CLI default credential chain, lhm-sch-ds / lhm-sch-read-exec / lhm-sch-deploy command not found, install or uninstall the lhm schedule migration CLIs, confirm whether the current target is staging or production, clean up the session config after migration ends. Do not trigger for: guiding the user to fill in the configuration template (handled by the upper-level entry flow); and concrete migration business operations (creating data sources, exploring/converting workflows, deployment & upload), which are handled by lhm-sch-ds, lhm-sch-read-exec, and lhm-sch-deploy respectively.

CLI tool and Agent Playbook for LHM schedule migration (schedule reading and conversion). Provides both a standalone CLI (`lhm-scheduler`) and an Agent-driven workflow guide. Triggers: lhm-scheduler commands, schedule migration tasks, PostInnerReader, GetInnerReadAsyncResult, PostInnerConvert, GetInnerConvertAsyncResult, or any request interacting with the LHM Inner Scheduler API — even without explicitly mentioning "LHM". Conversion-only triggers include "直接转换" (convert directly), "跳过探查" (skip exploration), and "只跑转换阶段" (run only the conversion stage). Do not trigger for: DataCheck workflows, DDL translation, SQL conversion, or other non-schedule-migration tasks.

User-facing entry Skill for LHM schedule migration (workflow migration). Provides three capabilities: (1) Query skill capabilities — output the skill introduction document; (2) Create data source — recognize "建数据源/创建数据源" (create data source) instructions and route to lhm-sch-ds to complete data source creation, name validation, metadata upload, and connectivity testing; (3) Schedule migration — complete a migration instruction end-to-end: config validation → environment initialization (lhm-sch-env) → data source existence check (lhm-sch-ds) → workflow exploration & conversion (lhm-sch-read-exec) → deployment & upload to DataWorks (lhm-sch-deploy). Triggers: asking what this skill can do / introducing capabilities; instructions such as "建数据源 / 创建（新增、添加）一个 XX 类型的数据源" (create a data source of type XX); or migration instructions such as "把 <源数据源> 迁移到 <目标数据源>" (migrate <source> to <target>), in natural language or the -source/-tag/-exStr/-dir parameter form, as well as any request mentioning migrating scheduler systems such as DolphinScheduler / Airflow to DataWorks. Do not trigger for: SQL conversion (sql-trans), DDL migration (ddl-trans), data validation (DataCheck), or other non-schedule-migration tasks.

管理 Dataphin 列级/字段级资源权限的授权、回收、查询、操作日志和权限点校验。 当用户要控制敏感字段可见性，给手机号、身份证号、薪资等字段授予或回收 SELECT 权限，查询某张表/某个字段当前授权记录，或验证某个用户是否拥有字段权限时进入。 触发词：列级权限、字段权限、字段级权限、column permission、field permission、敏感字段可见性、授权字段、回收字段权限、PHYSICAL_FIELD、LOGICAL_FIELD。 关键限制：公共 OpenAPI 通过资源点授权/回收，不提供内部 grantByResource 形态；字段授权前必须先定位字段资源标识；--resource-list 元素需传 JSON 对象（如 '{"ResourceId":"field_guid"}'）；写操作需 HITL 确认。

管理 Dataphin 数据分级、数据分类目录、数据分类和字段级安全识别结果。 当用户要把手机号、身份证号、姓名、薪资等字段标记为 C1/C2/C3/C4 或 L1/L2/L3/L4，创建或调整分类分级体系，查询字段当前分类分级标签，或批量启停/删除识别结果时进入。 触发词：数据分级分类、分类分级、数据分类、数据分级、安全等级、敏感数据标签、识别结果、identify result、security classify、security level、C1、C2、C3、C4、L1、L2、L3、L4。 关键限制：公共 OpenAPI 管理的是分级、分类、识别结果三层对象；字段打标用 create-security-identify-result；批量覆盖需确认 conflict-strategy；写操作需 HITL 确认。

管理 Dataphin 数据脱敏规则配置的需求拆解、前置分类分级检查和公开 API 覆盖边界。 当用户要给手机号、身份证号、邮箱、姓名等敏感字段配置掩码、加密、哈希、保留首尾、白名单绕过或验证查询脱敏效果时进入。 触发词：数据脱敏、脱敏规则、动态脱敏、字段脱敏、手机号打星、身份证脱敏、邮箱脱敏、白名单、desensitize、masking、mask、FPE、MD5、NO_MASK。 关键限制：当前 dataphin-public CLI 和版本感知 OpenAPI 索引未暴露脱敏规则 CRUD；本 Skill 不伪造内部 REST 为外部命令，只执行公开分类分级前置检查并输出可交付参数清单。

管理 Dataphin 数据标准的完整生命周期：创建、更新、发布、下线、删除、查询，支持元数据监控（METADATA）与数据质量监控（QUALITY）。 触发场景：管理数据标准 / 新建标准 / 修改标准 / 发布标准 / 下线标准 / 删除标准 / 查询标准列表 / 质量规则 / 元数据监控。 流程：list-standards/get-standard 查询 → create-standard 创建 → publish-standard 发布 → update-standard 修订 → offline/delete-standard 下线删除。 关键点：19 位大整数 ID 用字符串传参；monitor-config 的 Type（METADATA/QUALITY）决定字段组合；写操作需 HITL 确认。 触发词：数据标准、管理标准、发布标准、下线标准、删除标准、标准列表、质量规则、元数据监控、data standard、METADATA、QUALITY。

知识图谱知识数据管理与查询。通过 CLI 原生命令完成：实体与关系的增删改查、批量写入、Cypher 图查询、邻居节点遍历。 触发场景：知识图谱数据 / 创建实体 / 创建关系 / 批量导入 / Cypher 查询 / 邻居遍历 / 知识数据管理。

知识图谱本体模型（Schema）管理。通过 CLI 原生命令完成：整体 Schema 的导出（YAML）、导入（YAML）、发布到图引擎并查询发布结果。实体类型/关系类型/属性的增删改通过编辑 Schema YAML 后整体导入实现，不提供细粒度的单类型 CRUD 接口。 触发场景：知识图谱 Schema / 本体模型 / 实体类型 / 关系类型 / Schema 导入导出 / Schema 发布。

管理 Dataphin 数据标准码表（Lookup Table）的完整生命周期：创建、查询、更新、删除，码值列表整体覆盖式维护。 触发场景：创建码表 / 新建标准代码 / 维护码值 / 更新码表 / 删除码表 / 查看码表详情 / lookup table。 流程：get-standard-lookup-table 查询 → create-standard-lookup-table 创建 → update-standard-lookup-table 更新 → delete-standard-lookup-table 删除。 关键点：码值元素为 JSON {Value,Name,EnglishName,Description}，Value/Name 必填且 ≤64 字符、Value 码表内唯一；码表名称目录内唯一、编码租户内唯一；无 list 型命令，查询按码表 ID 走 get；写操作需 HITL 确认。 触发词：码表、标准代码、码值、代码值、lookup table、create-standard-lookup-table、LookupTableValueList。

管理 Dataphin 项目成员（添加 / 移除 / 更新角色 / 查询列表）。 当用户场景涉及项目成员变更、角色分配、权限调整时进入。 触发场景： - 需要给项目添加开发者或运维人员 - 需要调整成员角色（如从访客改为开发者） - 需要批量移除项目成员 - 查询项目当前成员列表 触发词：项目成员、添加成员、移除成员、更新角色、成员管理、add-project-member、remove-project-member、update-project-member。 关键限制：角色码为整数枚举（1-5）；DEV_PROD 模式项目需指定 Env（DEV/PROD）；19 位 ID 必须字符串呈现。

管理 Dataphin 资源文件（上传 JAR/配置文件等 UDF 资源并创建/更新/查询/删除 Dataphin 资源）。 当用户场景涉及上传资源文件、创建资源、UDF 所需 JAR、更新资源、查询资源版本、删除资源时进入。 触发场景： - 上传 JAR/配置文件作为 Dataphin 资源（UDF 依赖的 JAR 包等） - 创建资源（create-resource） - 查询资源最新版本或指定版本 - 更新资源（先 get-resource 再 update-resource） - 删除资源 触发词：上传资源、资源文件、UDF 资源、JAR 资源、创建资源、create-resource、get-resource、get-resource-by-version、update-resource、delete-resource、get-file-storage-credential、ossutil、minio mc、ceph。 关键限制：StorageType 决定上传工具（oss 用 ossutil，ceph 用 minio mc）；oss 凭证带临时 SecurityToken（sts-token），ceph 无；create-resource 的 compute-engine-type 仅 UDF 资源需指定引擎，非 UDF 用 NONE；19 位 ID 一律字符串传参。

管理 Dataphin 行级权限的查询、创建、更新、删除、按表查询、按用户查询和授权账号查询。 当用户要按字段值控制表数据行可见范围，维护行级权限规则、管控列、关联表、规则授权账号，或排查某张表/某个用户拥有哪些行级权限时进入。 触发词：行级权限、行权限、row permission、row-level permission、按行过滤、管控规则、规则授权账号、受影响账号、数据行可见范围。 关键限制：create 返回 true 不返回 ID，需 list 反查；复杂数组参数每个元素传 JSON 对象字符串；update 需完整回填 mappingColumns/rules/tables；写操作需 HITL 确认。

提交离线计算任务（从开发区提交到运维区）。 触发场景：提交任务 / submit 离线任务 / 任务从 DEV 提交到生产 / submit-batch-task / 获取 SubmitId 和 NodeId。 关键点：TaskType × Engine 两级分支决定 Code 语言和 ParamList Key 规则（Python / Shell / Hive_SQL / MaxCompute_SQL 等）。 注意：不支持 --data-source-id 参数（数据源在 update-batch-task 阶段已保存）。 触发词：提交离线任务、submit-batch-task、任务提交、获取 SubmitId、获取 NodeId、DEV 提交到生产。

编辑/更新已存在的离线计算任务（代码、数据源、调度配置、上下游依赖）。触发场景：修改任务代码 / 更新任务调度 / 切换数据源 / 设置 cron 表达式 / 配置 CustomScheduleConfig / 调整上游依赖 / update-batch-task。关键点：TaskType 必填且不可改类型；FileId 不能从 list-nodes 直接获得，需通过 list-files 按任务名查找；大整数 DataSourceId 必须按字符串传参，否则报 NumberFormatException；DEV_PROD 项目里 update-batch-task 即使 --env DEV 也要用生产数据源 ID；分钟级调度分"每小时重置"与"全天连续"两种，后者 CronExpression 固定为 "0 0 0 * * ?" 并用 CustomScheduleConfig 表达间隔；Update 后若要生效到 PROD 仍需 submit + publish-object-list。触发词：修改任务代码、更新任务调度、切换数据源、update-batch-task、设置 cron、配置 CustomScheduleConfig、更新上游依赖、每5分钟调度。

管理 Dataphin「字段-数据标准」落标映射关系：按资产/标准双向查询映射、批量创建有效/无效映射、置为无效映射、删除有效/无效映射。 触发场景：落标 / 字段关联标准 / 标准映射 / 解除映射 / 查字段映射了哪些标准 / 查标准落到哪些字段。 流程：get-asset-mapping-relations / get-belong-asset-mapping 查现状 → create-standard-mapping 建映射 → update-standard-mapping-to-invalid 置无效 → delete-standard-valid-mapping / delete-standard-invalid-mapping 删除。 关键点：仅「已生效」标准可建有效映射；关系已在无效映射列表时由 invalid-mapping-relation-operation-type 决定转有效或跳过；GUID 列表单次上限 1000；写操作需 HITL 确认。 触发词：落标、标准映射、映射关系、有效映射、无效映射、create-standard-mapping、get-asset-mapping-relations、落标监控。

管理 Dataphin 租户成员，包括添加成员、移除成员、查询可添加用户、查询租户成员列表、配置全局角色。触发场景：添加租户成员 / 移除租户成员 / 租户角色配置 / 批量加人 / tenant member / 租户管理员。流程：list-addable-users 定位用户 → add-tenant-members 添加 → list-tenant-members 验证；更新角色用 update-tenant-member；移除用 remove-tenant-member。关键点：add-tenant-members 的 --user-list 必须传单个 JSON 对象字符串 {"Id":"xxx"}，不能传数组；仅 SuperAdmin / 系统管理员可调用；全局角色包括 SYSTEM_ADMIN / DATASOURCE_MANAGER / SECURITY_ADMIN / QUALITY_MANAGER / EXPORT_ADMIN / DATA_STANDARD_MANAGER / LABELS_BUSINESS_MEMBER / DATAPRO_OPERATE_ADMIN 等（完整枚举以 list-addable-roles 实际返回的 Code 字段为准）。触发词：租户成员、添加租户成员、移除租户成员、租户角色、tenant member、tenant administration。

管理 Dataphin 主题域（Data Domain）的完整生命周期：查询、创建、更新、删除，用于组织数据仓库的业务分层架构。 主题域挂在「数据板块（业务单元 BizUnit）」之下，创建/更新/删除必须先确定所属 --biz-unit-id。 触发场景：管理主题域 / 新建主题域 / 修改主题域 / 删除主题域 / 查询主题域列表 / 组织数据仓库分层 / 数据板块下建主题域 / 配置上级主题域（层级）。 流程：list-data-domains/get-data-domain-info 查询 → create-data-domain 创建 → update-data-domain 修订 → delete-data-domain 删除。 关键点：主题域无发布流程，创建即生效；biz-unit-id 为硬前置依赖；大整数 ID 用字符串传参；写操作需 HITL 确认。 触发词：主题域、数据域、data domain、topic domain、data-domain、数据板块、业务单元、biz-unit、数据仓库分层、主题域列表、上级主题域。

数据服务 API 运维监控。查看 API 调用汇总、趋势分析、调用日志明细和异常影响分析，支持日常运维和问题排查。 触发场景：API 监控 / 调用日志 / 运维分析 / 异常分析 / 调用趋势 / 调用统计。

编辑/更新已存在的计算源配置。 触发场景：修改计算源配置 / 更新计算源密码 / 调整计算源参数 / update-compute-source。 UpdateCommand 需要 Id，Type + ConfigList 的 Key 规则与 create-maxcompute-compute-source 完全相同。 触发词：修改计算源、更新计算源、编辑计算源、update-compute-source。

监控 Dataphin 调度任务实例的运行状态、获取执行日志、排查未运行或失败原因。触发场景：查看实例状态 / 查日志 / 任务没跑 / 实例 WAIT_SCHEDULE / 实例 FAILED / 任务运行失败 / 排查未运行原因 / 获取 taskrun 日志。流程：list-instances 定位实例 → get-physical-instance 查看详情 → get-physical-instance-log 获取日志。关键点：bizdate 默认 T-1；list-instances 返回字段在 .PageResult.Data[].NodeInfo.Name 和 .StatusList；多时点调度的同一业务日期会有多个实例；WAIT_SCHEDULE 且 DueTime 未到、BlockType/WaitReason 为空属正常；SchedulePaused=true 表示节点被暂停。触发词：实例状态、查看日志、任务没跑、WAIT_SCHEDULE、FAILED、任务监控、实例监控、taskrun、运行日志、排查实例。

暂停/恢复 Dataphin 调度任务实例（按任务名 + 业务日期 + 运行时点定位并触发 PAUSE/RESUME）。触发场景：实例暂停 / 暂停调度 / 恢复调度 / pause / resume / operate-instance PAUSE / 阻止实例被调度拉起 / 小时任务暂停某个时点。完整流程：list-instances（按 bizdate + DueTime 筛选）→ operate-instance(PAUSE/RESUME) → get-physical-instance 验证 SchedulePaused。关键点：bizdate 默认 T-1（今日运行的实例业务日期通常是昨天）；小时任务一个 bizdate 有多个实例，需按 DueTime 选定时点；PAUSE 成功后实例 StatusList 可能仍为 WAIT_SCHEDULE，真正判据是 NodeInfo.SchedulePaused=true。触发词：暂停实例、pause、恢复实例、resume、operate-instance PAUSE、暂停调度、阻止调度。

一站式拼出资产目录里一个资产的完整详情页，**覆盖 5 类资产**：表（属性/字段/使用说明 + 数据预览 + 表与字段血缘 + 质量概况）、技术指标（属性 + 数据预览 + 所属字段血缘 + 所属字段质量规则）、业务指标（属性 + 相关指标 + 使用说明）、数据服务 API（属性 + API 文档）、仪表板（属性 + 图表信息）。 当用户场景涉及 资产详情、资产画像、看这张表/这个指标/这个 API/这个报表、字段列表、使用说明、数据预览、上下游血缘、字段血缘、质量概况、相关指标、指标口径、API 文档、请求/返回参数、图表列表、目录层级 时进入。 触发场景：给一个 GUID/名称要“这个资产的全貌”；只看其中某一板块；属性写入后回读校验。 触发词：资产详情、资产画像、目录详情、字段列表、使用说明、数据预览、前50条、血缘、上下游、字段血缘、质量概况、质量分、相关指标、指标口径、业务指标、技术指标、API 文档、仪表板、图表信息、get-catalog-asset-details、get-biz-metric-by-name、get-data-service-api-document。 关键限制：**先认资产类型再选板块**（业务指标无预览/无血缘；API与仪表板无预览/血缘/质量）；**汇报术语必须对齐界面**（`SimpleNodeInfos`=「产出任务」不是「调度节点」；`ReadCount`=「浏览量」；`CollectionCount`=「收藏数」）；**`IncludeDetailedAttributes` 不传则 `ReadCount`/`CollectionCount`/`SimpleNodeInfos` 恒为 null**；字段级 `Standards`/`ClassifyName`/`LevelShortName` 是活字段**必须逐列输出**，只有 `Columns[].QualityScore` 是恒 null 的死字段；**表级质量分无 OpenAPI**；**API 错误码无 OpenAPI**；**仪表板图表信息只有 GUID+名称**且放在 `Columns[]` 里；**质量模块响应体在 `PageResult`/具名键下，不在 `Data` 下**，只读 Data 会恒得 null 并误判成未授权；**质量输出不得透出「监控对象/watch」等内部词**，只说这张表下配了多少条质量规则；字段名与 SDK 文档不一致（`Id`/`Type`/`TableInfo`/`Strength`/`TestRun*`/`ValidateSuccess`）；`GetQualityWatchByObjectId` 的 WatchType/WatchObjectId 是 **query 位参数**且 TABLE 类型的 WatchObjectId **就是资产 GUID**；`ListQualityRules` 的 watchId **事实必填**；`GetBizMetricByName` 必须用 `BizMetricByNameQuery` 包裹且 **`draft` 必填**；PagedQuery* 是旧裸名会报 Unknown API；`GetTableLineages` 的 NeedUpstream/NeedDownstream **默认 false 必须显式传 true** 且 FilterQuery 必传，**单次只返回 1 跳，全链路必须客户端 BFS 递归且要先让用户选范围**；数据预览会起即席查询**消耗计算资源，需 HITL 确认**且分区表必须带分区谓词；`Instruction` 是富文本 JSON 不能直展；GetAssetAttributes 单次 GuidList ≤ 50；19 位 ID 必须字符串。

知识图谱图数据查询。通过 CLI 原生命令完成：Cypher 图查询（仅 Neo4j 引擎）、邻居节点遍历与关键词/语义混合搜索（引擎无关）。纯查询 Skill，不含任何写操作。查询前必须先确认图谱空间绑定的图引擎（Neo4j / Lindorm）——Lindorm 不支持 Cypher。 触发场景：知识图谱查询 / Cypher 查询 / 邻居遍历 / 图查询 / 关系路径查询 / 语义搜索 / 知识图谱探索。

更新 Dataphin 非结构化数据集的元数据表结构（加列/改列）。核心约束：**表结构不能在线编辑**—— 正确流程是「即席查询执行 ALTER SQL 改库表 → update-dataset 重新提交表结构 → 回读验证」三段式。 当用户场景涉及数据集表结构变更（加字段/加向量列/改注释）、"数据集表结构怎么改"、"重新加载表结构"时进入。 触发词：更新数据集表结构、数据集加列、修改元数据表、加字段、重新加载表结构、ALTER TABLE 数据集、 update-dataset-schema、表结构变更。 关键限制：表结构无在线编辑入口，必须 SQL + 重新提交两步走；Milvus 不支持 DDL（仅 PG/Lindorm 适用）； 已有工作流引用的列禁止删改（只加不减最安全）；写操作前必须 HITL 确认。

重跑 Dataphin 调度任务实例，支持两种模式：①单实例/批量重跑（operate-instance RERUN）；②重跑下游链路（fix-data，联动重跑根实例及所有下游）。触发场景：周期实例失败需要重跑 / rerun / 重跑实例 / operate-instance / fix-data / 重跑下游 / 修复链路数据 / 实例恢复 / 任务运维。模式①流程：list-projects → list-instances → operate-instance(RERUN) → get-physical-instance-log 验证。模式②流程：list-instances → fix-data(--root-instance-id) → get-physical-instance-log 验证 taskrun。关键点：实例必须属于指定的 project-id；bizdate 默认 T-1；fix-data 的 --root-instance-id 必须传 JSON 对象 {"Id":"t_xxx"}；fix-data 不创建新实例而是创建新 taskrun，验证需查 taskrun 日志。触发词：重跑实例、rerun、任务重跑、operate-instance、fix-data、重跑下游、修复链路数据、实例恢复、补跑实例。

把用户能说出的业务信息（板块/项目/数据源 + 表名/字段名/资产名）拼成资产 GUID，回读校验后交给下游 skill。 当用户要 GUID、界面查不到 GUID、下游接口要传 Guid/TableGuid/WatchObjectId 时进入。 触发场景：只知表名却要 GUID（写资产属性/配质量规则/查资产详情/落标）；问 GUID 怎么拼；核对已有 GUID。 触发词：资产GUID、拼GUID、Guid、TableGuid、dp_table、dp_ds_table、odps.、dp_index、cust_index、biz_index、dp_api、qbi_page。 关键限制：**开场必问两事（资产类型 + 该类型所需信息），类型不得从名字推断；每段取值须逐段确认后才能拼**，禁止按表名相似外推；含内部ID的类型(dp_index/biz_index/dp_api/qbi_page)只能查；逻辑表第三段是板块名；项目名转小写不加_dev；前缀由引擎定(19种)、表名大小写看引擎；dp_ds_table 段数不定；GUID 错了接口不报错，必须回读校验。

Single SQL dialect conversion skill. The agent autonomously analyzes SQL semantics and browses rules by category, suitable for non-nested simple SQL. For complex SQL (multi-level nesting requiring recursive decomposition), use the sql-conversion skill instead.

修改已存在的集成管道任务配置（调度 / 通道 / 组件 / 基本信息），采用「先查后改、全量回写」模式。 触发场景：修改管道任务调度周期 / cron / 重跑策略 / 优先级 / 上游依赖 / 资源组；修改并发数、脏数据上限、超时；修改 reader-writer 字段映射 / 过滤条件 / 分区表达式；修改后重新提交。 触发词：修改管道任务、更新管道、修改调度配置、改 cron、修改同步任务、update-pipeline、修改并发、修改脏数据、修改字段映射、重新提交管道。 关键限制：update-pipeline 是全量覆盖而非增量 patch——node-info / pipeline-config / schedule-config 均必填，必须先 get-pipeline-by-id 回读再改；19 位大整数 ID 字符串传参。

更新/编辑已有数据标准（含元数据监控 METADATA 和质量监控 QUALITY）。 触发场景：修改数据标准 / 更新质量规则 / 调整监控配置 / update-standard。 监控类型 Type（METADATA / QUALITY）决定 StandardMonitorConfigList 子元素字段组合，QUALITY 需 RuleSubType / QualityRuleTemplate 等。 StandardMonitorConfigList 子元素的 Id 决定新增/更新/删除。 触发词：修改数据标准、更新质量规则、调整监控配置、update-standard、StandardMonitorConfigList、METADATA、QUALITY。

更新指定的 Dataphin 非结构化工作流：get-pipeline-by-id 回读现有配置 → 局部修改算子/连线/提示词/模型参数 → update-pipeline 提交（PipelineType=14）→ 回读验证。 当用户场景涉及修改已存在的非结构化工作流（调整提示词 / 换模型 / 增删算子 / 调整连线 / 切换数据集版本 / 改资源规格 / 改调度）时进入。 触发词：更新工作流、修改工作流、update-pipeline、调整算子、改提示词、换模型、加一个算子、 删除算子、修改非结构化工作流、update unstructured workflow。 关键限制：必须先 get-pipeline-by-id 回读、在回读结果上就地修改，禁止凭记忆重建整个 JSON； update-pipeline 是全量覆盖式更新（提交什么就变成什么）；已有 step 的 UUID/stepId 不可改； 写操作前必须 HITL 确认。