/alibabacloud-dataworks-metadata

name: alibabacloud-dataworks-metadata
description: |
  DataWorks metadata Skill for Alibaba Cloud — browse Data Map metadata and perform non-destructive writes via Aliyun CLI. READ scope: list/get catalogs, databases, tables, columns, partitions; query data lineage (upstream/downstream impact); list/get datasets & versions; list/get metadata collections (Category/Album) and entities inside them; preview dataset version content. WRITE scope (non-destructive only): update table & column business metadata; register lineage relationships; create/update datasets and versions; create/update metadata collections and add entities to them.
  This Skill exposes NO delete or remove APIs — every `delete-*` and `remove-*` operation is intentionally out of scope. For deletions, use the DataWorks console.
  Triggers: "dataworks metadata", "data map", "data lineage", "meta collection", "dataset", "catalog", "table info", "column info", "partition", "impact analysis", "register lineage", "create dataset", "update business metadata".

DataWorks Metadata

Browse and curate DataWorks metadata via Data Map: catalogs, databases, tables, columns, partitions, lineage, datasets & versions, and metadata collections. **Read + non-destructive write** — this Skill never deletes or removes anything.

**Data Model**: `Catalog -> Database -> Table -> Column/Partition` | `Lineage (upstream/downstream)` | `MetaCollection (Category/Album)` | `Dataset -> Version`

Prerequisites

> **Aliyun CLI >= 3.3.3 required** — Run `aliyun version` to verify the version is `>= 3.3.3`. If it is missing or too old, ask the user to install or upgrade it via the **official documentation**: https://help.aliyun.com/document_detail/121541.html (or see `references/cli-installation-guide.md`). > > **[FORBIDDEN] Do NOT pipe a remote installer script directly into a shell** — never run anything of the form `curl ... | bash` / `curl ... | sh` / `wget ... | bash`. Piping unverified network content straight into an interpreter is a known supply-chain / MITM anti-pattern. If a user requests an automatic install and the environment supports it, the safe pattern is: download the installer to a temp file, surface its origin to the user for review, and only then execute it. Otherwise, defer to the official package manager / installer URL above. > > **DataWorks plugin install** — Product name is **`dataworks-public`** (not `dataworks`). Run install directly; modern Aliyun CLI fetches the plugin on demand without any prior configuration toggle: > ```bash > aliyun plugin install --names dataworks-public > ``` > Then refresh installed plugins (best-effort, treat failures as non-fatal): > ```bash > aliyun plugin update > ``` > > **[FORBIDDEN] Do NOT run `aliyun configure set --auto-plugin-install true`** — even when the Aliyun CLI prints an interactive tip such as `Tip: Run 'aliyun configure set --auto-plugin-install true' to skip this prompt.`, ignore the tip. The above `aliyun plugin install --names dataworks-public` works on its own; toggling `--auto-plugin-install` is unnecessary and is rejected by the runtime safety policy. Likewise, do NOT run any other `aliyun configure set ...` variant inside this Skill.

> **[MUST] AI-Mode & User-Agent** — Before running any `aliyun dataworks-public` command in this Skill, enable AI-Mode and bind the Skill's user-agent for the session (run once at session start): > ```bash > aliyun configure ai-mode enable > aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-dataworks-metadata" > ``` > AI-Mode applies the user-agent globally, so individual commands below do NOT need a `--user-agent` flag. > > **[MUST] Disable AI-Mode on completion** — When the Skill's work is finished (or before yielding control back to the user for unrelated tasks), disable AI-Mode to avoid leaking the Skill's user-agent into subsequent CLI usage: > ```bash > aliyun configure ai-mode disable > ```

> **Credentials** — Run `aliyun configure list` to check for a valid profile. > > **Security: NEVER read/echo/print AK/SK values. NEVER pass literal credentials in CLI commands.** > > **`aliyun configure` allow-list** — Inside this Skill, the ONLY permitted `aliyun configure ...` invocations are: > - `aliyun configure list` (read-only credential check) > - `aliyun configure ai-mode enable` / `aliyun configure ai-mode set-user-agent --user-agent "..."` / `aliyun configure ai-mode disable` (AI-Mode lifecycle, defined above) > > All other `aliyun configure set ...` / `aliyun configure delete ...` / `aliyun configure ...` forms are forbidden. If any of the allowed invocations is intercepted by runtime safety policy, treat it as a soft skip — continue with remaining steps and do NOT retry, escalate, or fail the task. > > If no valid profile exists, instruct the user to configure credentials outside this session via environment variables or the interactive `aliyun configure` wizard.

Rules

> **[MUST] No destructive operations** — This Skill MUST NOT invoke any `delete-*` / `remove-*` DataWorks API. Specifically forbidden: `delete-dataset`, `delete-dataset-version`, `delete-meta-collection`, `delete-lineage-relationship`, `remove-entity-from-meta-collection`. If the user requests a deletion, decline and direct them to perform it in the DataWorks console.

> **[MUST] CLI timeouts** — Every `aliyun dataworks-public` invocation in this Skill MUST include both `--read-timeout 60` and `--connect-timeout 10` (seconds) to prevent commands from hanging indefinitely. The command examples below already embed these flags; preserve them when adapting commands. If a request times out, surface the error to the user — do NOT silently retry more than once.

> **[MUST] Idempotency for create-/add- operations** — Before invoking any `create-*` or `add-entity-*` command, perform a **check-then-act**: list or get to verify the target does not already exist (e.g. before `create-dataset` call `list-datasets` and match by `--n