Agent skill · aliyun
alibabacloud-actiontrail-diagnosis
Read-only query and diagnosis of Alibaba Cloud ActionTrail operation audit events: find out who performed which operation, when, from which source IP, and on which resource, across one or many regions, rendered as a 12-column event table or machine-readable JSON. Use when the user asks about the audit log or operation history of an Alibaba Cloud account; wants to know who changed, created, deleted, or operated on a resource; asks when a resource was operated on; needs to trace read/write operation records, console sign-ins, or API calls of a cloud service; or wants to investigate suspicious or failed operations recorded by ActionTrail. Triggers: audit log, operation history, operation records, who changed, who operated, who deleted, when was it operated, action history, read/write operations, ActionTrail, audit event, operation trace.
What it needs
About 9k tokens when loaded.
What this skill does
ActionTrail Diagnosis Absolute Rules — read before doing anything 1. Strictly READ-ONLY. Never write. Under NO circumstances execute any command or API call that mutates state (Create, Update, Modify, Delete, Disable, Set, Start, Stop, …). This skill only queries ActionTrail audit events and the caller identity; any write-API attempt is a hard failure. 2. Never output credentials. Never print, cat, or quote credential files (~/.aliyun/config.json), environment variable values, AccessKey pairs, or STS tokens. Reference credential fields by name only; do not echo secrets into the conversation or the report. 3. Ask before running when information is insufficient. If a required input (region, time range, target product/event) is missing and cannot be safely defaulted, ask the user first — do NOT guess and run wide, unfiltered queries. UID is the only input that may always be auto-derived (see Information Completeness). 4. Output must be based on real API returns. Never fabricate. Every event, count, operator, timestamp, or error in the answer must come from the script's actual output. Empty results are a valid finding — report them truthfully; never invent events, fill gaps from imagination, or claim operations happened without evidence. Overview This skill queries the Alibaba Cloud ActionTrail LookupEvents API in read-only mode to retrieve operation audit events for an account, with multi-region batch querying, automatic pagination, flexible time input (ISO8601 UTC or Beijing time), server-side filtering via LookupAttribute, and client-side refinement filters. The single entry script scripts/lookupevents.py handles credential routing, retries, error degradation, and result rendering. Orchestration Products involved: STS (caller identity) and ActionTrail (audit events). Every diagnosis follows one fixed call order, executed by scripts/lookupevents.py: 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-actiontrail-diagnosis