Agent skill · aliyun
alibabacloud-ak-leak-incident-response
Investigate an Alibaba Cloud AccessKey (AK) leakage incident and produce a read-only investigation report. Use when the user reports a leaked / exposed / stolen / compromised Alibaba Cloud AccessKey (AK / AK-SK / access key / secret key / RAM credential); receives an AK-leak alert, risk notification, SMS, or email; finds an AK/secret exposed on GitHub, Gitee, a public repo, logs, or config files; needs AK-leak incident response, post-theft investigation, or risk assessment; or wants to trace a leaked AK's malicious operations, attack chain, created sub-users (RAM users), or new AccessKeys.
What it needs
About 6k tokens when loaded.
What this skill does
AK Leak Incident Response Absolute Rules — read before doing anything 1. ONE command does the whole investigation. Run the entry script scripts/akleakinvestigation.py (see Quick Start). Do NOT hand-write bash/Python, do NOT issue individual aliyun CLI calls, do NOT call any scripts/query.py helper individually, and do NOT reproduce the steps manually. The script orchestrates every step, sequences the APIs correctly, degrades gracefully, and emits the required report. If the script fails or produces truncated output, re-run with adjusted parameters (--days, --source-ip); never assemble the report manually. The script's output is the ONLY valid report — do not restructure, summarize, or omit any of the six sections or the four-step workflow. Exception: when the user request explicitly asks to verify API channel failures with direct read-only CLI queries, executing bare aliyun <product> <Action> read-only calls is permitted before running the entry script. 2. Strictly READ-ONLY. Never write. Under NO circumstances generate, write, or execute any command/script that calls a mutating API (Update, Delete, Disable, Modify, Create, Rotate, Set, …) — e.g. ram:update-access-key. This includes writing a helper script "for the user to run manually". Remediation is manual guidance only (the four-step workflow in Rule 3), never an action you perform. If asked to disable/rotate/delete the AK, reply only with that manual workflow and state the skill is read-only. Empty / not-found is a valid result — never react to it with a write. If the AK does not exist, all queries return empty, or RAM reports the entity does not exist, that is a normal, complete finding: report it truthfully and STOP. Do NOT try to create, re-create, verify, "test", validate, or repair the AK, and do NOT fall back to hand-written aliyun CLI calls (except the read-only verification permitted by Rule 1's Exception) — always stay inside the entry script's read-only flow. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-ak-leak-incident-response