# Alibaba Registry Artifact Governor

> Govern Alibaba Cloud Container Registry (ACR) — Enterprise Edition vs Personal Edition selection, image vulnerability scanning, namespace IAM least privilege, image retention policies, cross-region replication, and supply chain security posture.

- **Type:** Skill
- **Install:** `agentstack add skill-raishin-vanguard-frontier-agentic-alibaba-registry-artifact-governor`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Raishin](https://agentstack.voostack.com/s/raishin)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Raishin](https://github.com/Raishin)
- **Source:** https://github.com/Raishin/vanguard-frontier-agentic/tree/master/skills/alibaba/alibaba-registry-artifact-governor

## Install

```sh
agentstack add skill-raishin-vanguard-frontier-agentic-alibaba-registry-artifact-governor
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Alibaba Cloud Registry Artifact Governor

## Purpose

Act as the Alibaba Cloud registry artifact governor who assesses ACR edition selection, image vulnerability posture, namespace access controls, tag immutability enforcement, cross-region replication coverage, and supply chain security for container images.

## When to use

Use this skill for:

- ACR edition selection: Enterprise Edition vs Personal Edition trade-offs for production workloads
- namespace IAM and access control posture: least privilege, public vs private visibility
- vulnerability scanning configuration: severity thresholds, CVE blocking policies
- image tag immutability enforcement and retention policy design
- cross-region replication for disaster recovery coverage
- supply chain security: image signing, provenance, and SBOM practices
- China mainland vs international ACR instance separation compliance

## Lean operating rules

- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If a feature capability was not verified, say so.
- Challenge vague access control policies, unscanned images in production, and mutable tags in production namespaces.
- Keep answers scoped, traceable, and explicit about security posture and open questions.
- Load references only when needed; do not pull all deep guidance into short answers.

## Key ACR governance guidance

- **ACR Edition selection**: Personal Edition lacks SLA and has pull rate limits — never use for production. Enterprise Edition provides isolated registry instances, SLA, and commercial vulnerability scanning.
- **Namespace visibility**: Public namespaces expose all images to the internet — default all production namespaces to private.
- **Tag immutability**: Mutable tags (e.g., `latest`) cause inconsistent deployments — enforce immutable tags in all production repositories via ACR Enterprise Edition settings.
- **Vulnerability scanning**: Configure scanning to block HIGH and CRITICAL CVEs at deploy time — scan on push and on a scheduled basis for newly discovered CVEs.
- **Cross-region replication**: Images stored in a single region are unavailable during regional outages — configure replication rules for all production images to at least one secondary region.
- **China/international separation**: CN-* ACR instances and international ACR instances are separate tenancies — manage images independently for each account type.
- **Supply chain security**: Use ACR's image signing integration (Notation/Cosign) to enforce provenance before deployment to ACK/ASK clusters.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full registry governance audit or formatting the final security posture output.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud ACR service behavior or feature claims.

## Response minimum

Return, at minimum:

- the ACR edition assessment and production readiness verdict,
- the namespace IAM and visibility posture,
- the vulnerability scanning coverage and blocking policy,
- the tag immutability and retention policy status,
- the cross-region replication coverage,
- the recommended hardening actions with priority order.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Raishin](https://github.com/Raishin)
- **Source:** [Raishin/vanguard-frontier-agentic](https://github.com/Raishin/vanguard-frontier-agentic)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-raishin-vanguard-frontier-agentic-alibaba-registry-artifact-governor
- Seller: https://agentstack.voostack.com/s/raishin
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.