Agent skill · aliyun
alibabacloud-mining-attack-diagnosis
Alibaba Cloud Security Center cryptomining (cryptojacking) diagnosis skill. Use when the user reports or suspects a mining infection, receives a mining alert, or asks for mining alert detection, IOC extraction (pool IPs, malicious domains, sample hashes, malicious processes), affected-asset scoping, attack-surface analysis, entry-vector analysis, risk assessment, prioritized remediation reporting, cryptomining incident response, or mining risk detection. Triggers: "mining", "cryptomining", "cryptojacking", "coin mining", "coin-mining", "miner", "mining alert", "mining alerts", "mining pool", "pool IPs", "malicious domains", "sample hashes", "malicious processes", "mining IOC", "IOC extraction", "mining alert detection", "affected-asset scoping", "attack-surface analysis", "entry-vector analysis", "risk assessment", "prioritized remediation reporting", "cryptomining incident response", "mining risk detection", "xmrig", "kdevtmpfsi", "kinsing", "sysrv", "minerd", "Security Center", "ECS high CPU mining
What it needs
About 6k tokens when loaded.
What this skill does
Mining Attack Diagnosis (Read-Only) Absolute Rules 1. CRITICAL — MANDATORY EXECUTION: You MUST run the investigation via the entry script scripts/mininginvestigation.py. Do NOT hand-write bash/python, do NOT issue individual aliyun CLI calls, do NOT skip any step. If the script fails or times out, re-run it once before falling back — never abandon the 6-step SOP. The entry script internally invokes every Step 1–4 API (DescribeSuspEvents, DescribeAlarmEventDetail, DescribeSuspEventDetail, DescribeSecurityStatInfo, DescribeFieldStatistics, DescribeExposedInstanceList, DescribeVulList) regardless of intermediate results, and auto-retries transient ServiceUnavailable/Throttling/InternalError responses — so you must not pre-empt or short-circuit it with ad-hoc calls. 2. ABSOLUTE PROHIBITION (read-only enforcement): Under NO circumstances may you generate, write, or execute any command/script calling a mutating API (Update/Delete/Disable/Modify/Create/Rotate/Set/Operate) — e.g. OperateSuspiciousTargetBatch, ModifySecurityGroupRule, DeleteInstance. This includes scripts "for the user to run manually". If the user asks to quarantine/kill/isolate, only output the manual remediation workflow and declare this skill is read-only. 3. MANDATORY OUTPUT FORMAT: When mining is confirmed, the report MUST start with the URGENT banner (see Report Output section); the Conclusion section MUST include the 4-phase remediation workflow verbatim. Partial output is forbidden. 4. EXECUTION RULE FOR ERRORS: On any API error, log [WARN] <error> to stderr and continue to the next step — never silently skip. On Forbidden/NoPermission, record the missing permission and continue. On empty results, set fields to N/A and proceed. On transient errors (ServiceUnavailable/Throttling/InternalError), the entry script retries automatically — do not conclude "service down" from a single failed call. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-mining-attack-diagnosis