/alibabacloud-remote-skills-connector

name: alibabacloud-remote-skills-connector
description: Use when a user asks what the Alibaba Cloud Remote Skills Connector can do, which hosted Alibaba Cloud skills are currently available, or requests Alibaba Cloud capability onboarding; wants to inspect, query, diagnose, audit, create, deploy, configure, update, resize, restart, repair, restore, or delete Alibaba Cloud (阿里云/Aliyun) resources; uses Chinese triggers such as 查询, 诊断, 巡检, 创建, 删除, 更新, 升配, 扩缩容, 重启, and 修复; continues an existing AgentHub task; or troubleshoots this connector's discovery/authentication—even without a product name. Exclude other clouds, general knowledge/architecture/pricing questions, and requests for local CLI/SDK/OpenAPI/Terraform/ROS execution or code.

Alibaba Cloud Remote Skills Connector

Discover Alibaba Cloud AgentHub-hosted remote skills through AgentExplorer from the user's intent, select a remote Agent with matching capabilities, and let that Agent complete the Alibaba Cloud resource task. This skill is responsible only for client-side discovery, authentication, A2A communication, and task continuation. It never operates cloud resources locally.

Always respond to the user in Simplified Chinese. Keep every user-facing progress update, question, approval detail, blocking explanation, and final summary in Simplified Chinese. If AgentHub has no clearly matching remote skill, stop and explain that the request is not currently supported. Never pretend to have the capability or fall back to local cloud-resource commands.

Hard Boundaries

• Never call a local Alibaba Cloud product CLI, SDK, OpenAPI, Terraform, ROS, or shell script to operate cloud resources.
• Preserve the user's original text in execution messages sent to a remote Agent. Except when splitting a multi-product request, do not summarize, translate, polish, add background, add resource IDs, or rewrite it.
• If the user explicitly says "send the following content to the remote Agent: ...", send only the exact text after that boundary. Otherwise, send the user's complete original request.
• Never place a keyword or message in command-line arguments, environment variables, arbitrary file paths, or heredocs. Use only managed input IDs or real process stdin.
• Never display or ask the user to paste an AccessKey, Secret, STS Token, OAuth token, verification code, Cookie, Authorization header, or password.
• Never manually edit, move, or delete context, task, Agent Card, input, or credential state under `~/.aliyun_agenthub`.
• Support only the Alibaba Cloud China site. Every cloud request must use HTTPS with strict certificate-chain and hostname verification. Never disable verification or downgrade to HTTP.

Prerequisites

**Aliyun CLI >= 3.3.3 is required** when the user selects the `aliyun_cli` credential source. Run `aliyun version` to verify it. If the CLI is missing or older, install or update it with `/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/setup.sh)"`, or use `brew install aliyun-cli` / `brew upgrade aliyun-cli` on macOS.

The bundled ramoauth token exchange intentionally keeps the verified legacy `GenerateAccessToken` forced-RPC form because no corresponding official CLI plugin command is currently available. Do not convert only the action or parameter letter case. Migrate it only after an official plugin exists and its complete `--help` contract has been verified.

Observability (MUST follow for every aliyun command)

Upon loading this skill, generate one cryptographically random **32-character lowercase hexadecimal** base session ID for the entire user conversation and keep it as `SKILL_SESSION_ID`. Reuse that exact generated part for every discovery, authentication, diagnostics, Agent Card, A2A, retry, and follow-up cloud call. Never regenerate it per tool call, task, Agent, product, or retry.

Every `aliyun` CLI command that calls a cloud API must include:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-remote-skills-connector/{session-id}

Local CLI utility commands such as `aliyun version`, `aliyun configure`, and `aliyun plugin` do not require this flag. Every bundled script invocation that may make a cloud request must receive the same value, for example:

SKILL_SESSION_ID={session-id} python3 scripts/agenthub.py discover_agents --keyword-stdin --max-results 5

The generated part is shared; the surrounding formats are not removed. The UA remains `AlibabaCloud-Agent-Skills/alibabacloud-remote-skills-connector/{session-id} <client>/<version>`. For self-managed business sessions, QoderWork uses `qoderwork-{session-id}` and another client uses `<client-name>-{session-id}`. Never remove these prefixes or independently generate a second ID for either representation. Codex, Claude Code, and Qwen Code keep their existing trusted prefixed business-session resolution, while `SKILL_SESSION_ID` supplies the UA session segment.

AIOps RAM Permissions

Use [references/ram-policies.md](references/ram-policies.md) as the authoritative description of ramoauth authorization. Do not require the user to create or attach a RAM policy for `ram:GenerateAccessToken`: the API is allowed by default and is rejected only when an applicable policy contains an explicit `Deny` for that action. If the service returns `NoPermission` or an authorization error, ask the account administrator to inspect, remove, or narrow the applicable explicit `Deny`; never prescribe an `Allow` policy as the fix or claim that this authorization controls resource operations performed by the remote Agent.

Command Path

After loading this skill, resolve the absolute path to `scripts/agenthub.py` from the actual installed location of this `SKILL.md`. Use and quote that real absolute path whenever invoking the script or showing a command to the user. Never depend on the current working directory. Every later occurrence of `python3 scripts/agenthub.py` in this document is shorthand for internal documentation only; do no