Alicloud Ecs Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud ECS Operations Skill

Common JSON Paths (Centralized)

# Create/Describe Instance: $.Instances.Instance[].{InstanceId,Status,RegionId,ZoneId,InstanceName}
# Create Disk:              $.DiskId
# Describe Disks:           $.Disks.Disk[].{DiskId,Status}
# Create Snapshot:          $.SnapshotId
# Describe Snapshots:       $.Snapshots.Snapshot[].SnapshotId
# Create SecurityGroup:     $.SecurityGroupId
# AuthorizeSG/Delete/etc:   $.RequestId
# RunInstances:             $.InstanceIdSets.InstanceIdSet[]
# RunCommand:               $.InvokeId
# Describe Images:          $.Images.Image[].ImageId

Overview

Alibaba Cloud ECS (Elastic Compute Service) provides scalable virtual servers in the cloud. This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, cli-first execution (official aliyun CLI as primary path, JIT Go SDK as fallback), response validation, and failure recovery.

CLI applicability (repository policy)

• cli_applicability: cli-first: Official aliyun fully supports ECS. CLI is the primary execution path for all operations. JIT Go SDK is the fallback only when CLI lacks support for a specific edge-case operation.

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/ecs-skillopt-wrapper.sh for all ECS CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun ecs only when the wrapper is unavailable or skillopt-lib.sh is missing. For runtime enforcement (physical interception of all aliyun ecs calls), source the shared shim: source ../../alicloud-skill-generator/scripts/skillopt-shim/aliyun-shim.sh. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md), [Shim](file://../../alicloud-skill-generator/scripts/skillopt-shim/SHIM-README.md) | | CLI verification | Run --help before first use to verify parameter formats | [CLI](references/cli-usage.md) | | Credentials | Read {{env.*}} only from environment; never ask user to paste or print secrets | [Integration](references/integration.md) | | GCL | All write operations MUST pass GCL adversarial review before execution | [GCL Rubric](references/rubric.md) |

Quick Start

不知道从哪里开始？直接看 [Prompt Examples](references/prompt-examples.md)，里面有 50+ 条自然语言提示词示例，覆盖实例管理、云盘操作、安全组配置、云助手远程执行、故障诊断等场景，复制即用。

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud ECS" OR "云服务器" OR "Elastic Compute Service" OR "ECS实例"
• Task involves CRUD or lifecycle operations on ECS instances (create, start, stop, restart, delete, describe, list)
• Task involves disks (create, attach, detach, delete, describe, resize)
• Task involves images (create, describe, delete, copy, share)
• Task involves snapshots (create, describe, delete, rollback)
• Task involves security groups (create, describe, delete, authorize, revoke rules)
• Task involves batch operations (RunInstances)
• Task involves instance attribute modifications (rename, reset password)
• Task involves Cloud Assistant operations (run commands on instances, send files, query execution results)
• Task keywords: 实例, 云盘, 镜像, 快照, 安全组, 云助手, instance, disk, image, snapshot, security group, batch, run-instances, cloud assistant, run command, send file
• User asks to deploy, configure, troubleshoot, or monitor ECS via API, SDK, CLI, or automation
• User reports "IO wait high", "disk slow", "application timeout", "LoadAverage > CPU×2"
• IO anomaly detected via CloudMonitor: DiskReadIOPS / DiskWriteIOPS > 70% cloud disk limit

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to: alicloud-billing-ops (when present)
• Task is RAM / permission model only → delegate to: alicloud-ram-ops (when present)
• Task is about VPC / networking only → delegate to: alicloud-vpc-ops (when present)
• Task is about RDS / databases → delegate to: alicloud-rds-ops (when present)
• User insists on console-only flows with no API → state limitation; do not invent undocumented HTTP steps

Intent-to-Operation Index (Reverse Lookup)

Reverse index from natural-language user intents to Operation sections below. Use this when the user's phrasing does not map cleanly to a CRUD verb (e.g. "看下 ECS 健康度", "我连不上 ECS 了").

| User intent (verbatim or paraphrase) | Operation section | |---|---| | "创建/起一台 ECS", "买台服务器", "批量创建 web 服务器" | [Operation: Create Instance](#operation-create-instance), [Operation: Run Instances (Batch Create)](#operation-run-instances-batch-create) | | "查看 ECS", "列出我的云服务器", "实例列表" | [Operation: Describe Instances](#operation-describe-instances) | | "启动/停止/重启 ECS" | [Operation: Start Instance](#operation-start-instance), [Operation: Stop Instance](#operation-stop-instance), [Operation: Reboot Instance](#operation-reboot-instance) | | "删除 ECS", "清理实例", "下掉服务器" | [Operation: Delete Instance](#operation-delete-instance) | | "改名/重置密码" | [Operation: Modify Instance Attribute](#operation-modify-instance-attribute) | | "创建/扩容/挂载/卸载/删除云盘", "磁盘满了" | [Operation: Create Disk](#operation-create-disk), [Operation: Resize Disk](#operation-resize-disk), [Operation: Attach Disk](#operation-attach-disk), [Operation: Detach Disk](#operation-detach-disk), [Operation: Delete Disk](#operation-delete-disk) | | "创建/删除快照", "备份系统盘" | [Operation: Create Snapshot](#operation-create-snapshot), [Operation: Delete Snapshot](#operation-delete-snapshot) | | "查看/放通/收回安全组规则", "开放 80 端口" | [Operation: Describe Security Group Attribute](#operation-describe-security-group-attribute), [Operation: Authorize Security Group Rule](#operation-authorize-security-group-rule), [Operation: Revoke Security Group Rule](#operation-revoke-security-group-rule) | | "安全组检查", "合规审计", "高危端口扫描" | [Operation: Security Group Compliance Check](#operation-security-group-compliance-check-安全组合规检查) | | "安全组巡检", "SecOps", "暴露面分析", "安全组审计" | [Operation: Security Group SecOps Inspection](#operation-security-group-secops-inspection-secops安全组巡检) | | "异常检测", "告警分析", "CPU-Memory 双高" | [Operation: Multi-Metric Anomaly Inspection](#operation-multi-metric-anomaly-inspection) | | "IO wait 高", "磁盘慢", "应用超时", "LoadAverage > CPU×2" | [Operation: Host IO Inspection](#operation-host-io-inspection-主机-io-巡检) | | "闲置实例", "成本优化", "哪台没在用" | [Operation: Idle Resource Detection](#operation-idle-resource-detection-闲置资源智能识别) | | "成本分析", "费用报告", "月度账单" | [Operation: Cost Visualization Report](#operation-cost-visualization-report-成本可视化报告) | | "容量预警", "趋势分析", "未来 7 天" | [Operation: Predictive Capacity Analysis](#operation-predictive-capacity-analysis-预测性容量分析) | | "诊断", "故障排查", "实例卡在 Starting" | [Operation: LLM-Assisted Diagnosis](#operation-llm-assisted-diagnosis-llm辅助诊断) | | "连不上 ECS", "SSH 超时", "RDP 不通" | [Operation: Connectivity Diagnostics](#operation-connectivity-diagnostics) | | "云助手执行命令", "远程跑脚本", "df -h 看看" | [Operation: Run Command (Cloud Assistant)](#operation-run-command-cloud-assistant) | | "下发文件", "上传 deploy.sh" | [Operation: Send File (Cloud Assistant)](#operation-send-file-cloud-assistant) | | "查上次执行结果", "命令跑完了吗" | [Operation: Describe Invocation Results](#operation-describe-invocation-results) | | "打/查/删标签", "Environment=Production" | [Operation: Add Tags to Resource](#operation-add-tags-to-resource), [Operation: Describe Tags](#operation-describe-tags), [Operation: Remove Tags from Resource](#operation-remove-tags-from-resource) | | "换操作系统", "重装系统盘", "ReplaceSystemDisk" | [Operation: Replace System Disk](#operation-replace-system-disk) | | "换镜像", "查官方镜像", "推荐 Ubuntu 22.04" | [Operation: Describe Images](#operation-describe-images) | | "创建安全组", "新建 SG" | [Operation: Create Security Group](#operation-create-security-group) | | "调用预创建命令", "用 CommandId 跑命令" | [Operation: Invoke Command (Cloud Assistant)](#operation-invoke-command-cloud-assistant) | | "停止云助手命令", "取消正在执行的命令" | [Operation: Stop Invocation](#operation-stop-invocation) | | "查文件下发结果", "文件传成功没" | [Operation: Describe Send File Results](#operation-describe-send-file-results) | | "云助手装没装", "检查 Cloud Assistant 状态" | [Operation: Describe Cloud Assistant Status](#operation-describe-cloud-assistant-status) |

> Multi-intent messages (e.g. "帮我创建 ECS 并开放 80 端口") MUST be split > into separate Operations and executed in dependency order (instance → SG rule). > See [Multi-Skill Intent Patterns](#multi-skill-intent-patterns) below for > cross-product routing.

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Multi-Skill Intent Patterns

Most real user requests span multiple Alibaba Cloud products. The table below defines composite intent routing — which skill plays primary (主) vs auxiliary (辅) vs optional (可选), and how to propagate HARNESS_SESSION_ID for unified tracing across skills.

| Composite intent | Primary | Auxiliary | Optional | Session propagation | |---|---|---|---|---| | "ECS 上的应用连不上 RDS" | alicloud-ecs-ops | alicloud-rds-ops | alicloud-vpc-ops (若怀疑网络) | export HARNESS_SESSION_ID once before any wrapper call | | "ECS 安全合规扫描" | alicloud-ecs-ops (SG inspection) | alicloud-actiontrail-ops (变更追踪) | alicloud-sas-ops (高级威胁) | shared session, primary collects auxiliary results | | "ECS 费用突然上涨" | alicloud-billing-ops | alicloud-ecs-ops (Cost Visualization) | — | shared session, primary aggregates | | "ECS + SLB 高可用部署" | alicloud-slb-ops | alicloud-ecs-ops (RunInstances) | alicloud-vpc-ops (VSwitch) | primary orchestrates; ECS only creates instances | | "通过 ECS RunCommand 改 Redis 配置" | alicloud-ecs-ops (Cloud Assistant) | alicloud-redis-ops (参数语义) | — | primary invokes; auxiliary provides domain knowledge | | "ECS 性能 + Redis 延迟联合排查" | alicloud-ecs-ops (Host IO + multi-metric) | alicloud-redis-ops (slowlog) | alicloud-cms-ops (统一指标层) | shared session, primary correlates timestamps | | "全栈巡检: ECS + RDS + SLB" | alicloud-cms-ops (统一监控) | alicloud-ecs-ops, alicloud-rds-ops, alicloud-slb-ops | — | auxiliary skills run read-only under one session |

> Routing policy (apply in order): > 1. 主 (primary) owns the failure semantics — if the primary fails, the whole > composite fails; auxiliary failures are reported but do not block. > 2. 辅 (auxiliary) runs only after primary preconditions succeed; may run in > parallel when independent. > 3. 可选 (optional) runs only when the user's intent explicitly mentions the > optional dimension (e.g. "顺便看看网络") or a precondition signals it. > 4. HALT rule — if alicloud-ecs-ops is auxiliary and the primary skill > reports a fatal error, ECS halts immediately; do not silently retry. > > Wrapper hygiene: every cross-skill call MUST go through its own > *-harness-wrapper.sh (see ## Runtime Rules). Do not chain aliyun > commands directly across skills. > > Example workflow (verbatim shell, for "ECS 上的应用连不上 RDS"): > ``bash > export HARNESS_SESSION_ID="sess-$(uuidgen)" > # Primary: ECS status + SG + network probe > cd alicloud-ecs-ops && ./scripts/ecs-harness-wrapper.sh DescribeInstances \ > --harness-session-id "$HARNESS_SESSION_ID" \ > --RegionId "$REGION" --InstanceIds "[\"$INSTANCE_ID\"]" > # Auxiliary: RDS connectivity > cd ../alicloud-rds-ops && ./scripts/rds-harness-wrapper.sh DescribeDBInstanceNetInfo \ > --harness-session-id "$HARNESS_SESSION_ID" \ > --RegionId "$REGION" --DBInstanceId "$RDS_ID" > # Optional: VPC routing (only if Steps 1–2 are inconclusive) > ``

Intent Disambiguation

When user intent is ambiguous between ECS operations, use the table below to select the default candidate based on disambiguation signals. If no signal matches, ask the user to clarify before executing.

| User phrase | Candidate operations | Disambiguation signals | Default if no signal | |---|---|---|---| | "看下 ECS" / "查 ECS" | Describe vs Cost Visualization vs Health Check | contains "费用/账单" → Cost Visualization; contains "健康/异常/诊断" → Health Check (LLM-Assisted Diagnosis + Connectivity); else → Describe | Describe Instances | | "弄好 ECS" / "ECS 修一下" | Start vs Repair vs Replace System Disk | contains "启动/开机" → Start; contains "修/修好" → Repair (LLM-Assisted Diagnosis); contains "重装/换 OS" → Replace System Disk | Ask user | | "删掉 ECS" / "清理实例" | Delete vs Stop | contains "停止/关机 (但保留)" → Stop; else → Delete (with confirmation gate) | Delete Instance (safety gate forced) | | "ECS 慢" / "性能问题" | Multi-Metric Anomaly vs Host IO vs Connectivity | contains "磁盘/IO" → Host IO Inspection; contains "网络/连不上" → Connectivity Diagnostics; else → Multi-Metric Anomaly | Multi-Metric Anomaly Inspection | | "查看 ECS 状态" | Describe Instances vs Status of specific instance | instance ID/Name present → DescribeInstances filter; else → list all | Describe Instances | | "重置/重启" | Reboot vs Replace System Disk vs Stop+Start | contains "重装系统/换 OS" → Replace System Disk; else → Reboot | Reboot Instance | | "释放资源" / "回收" | Delete Instance + Delete Disk + Delete Snapshot | ask which resource(s); default all ECS-owned resources for {{user.instance_id}} | Ask user (destructive) | | "改 ECS 名字" | Modify Instance Attribute vs AddTags | contains "标签/Tag" → AddTags; else → ModifyInstanceAttribute | Modify Instance Attribute |

> Disambiguation principle: When the user phrase maps to multiple ECS > operations AND any of them is destructive (Delete*, Stop*, Reboot*, > ReplaceSystemDisk, AuthorizeSecurityGroup with 0.0.0.0/0), prefer > asking over guessing. The GCL safety gate in > [references/rubric.md](references/rubric.md) §1.2 will ABORT an unconfirmed > destructive op anyway, so clarifying up front saves a round-trip. > > Non-destructive ambiguity (Describe / Cost / Health) MAY be resolved by > default routing; the result is read-only and reversible.

Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | From runtime environment | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region | Ask once; reuse | | {{user.instance_id}} | User-supplied ECS instance ID | Ask once; reuse | | {{user.instance_name}} | User-supplied ECS instance name | Ask once; reuse | | {{user.disk_id}} | User-supplied disk ID | Ask once; reuse | | {{user.image_id}} | User-supplied image ID | Ask once; reuse | | {{user.security_group_id}} | User-supplied security group ID | Ask once; reuse | | {{user.zone_id}} | User-supplied zone ID | Ask once; reuse | | {{user.instance_type}} | User-supplied instance type | Ask once; reuse | | {{user.vswitch_id}} | User-supplied VSwitch ID | Ask once; reuse | | {{user.vpc_id}} | User-supplied VPC ID | Ask once; reuse | | {{user.key_pair_name}} | User-supplied SSH key pair name | Ask once; reuse | | {{output.instance_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.disk_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.snapshot_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.security_group_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.request_id}} | From API response | For support / correlation |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be collected interactively when missing.

> 凭据安全（强制）： 参考 [Credential Masking 规则](../alicloud-skill-ge

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.