by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and SKILL.md clearly implement Alibaba Cloud ALB management, but the package metadata omits required credential and install declarations and contains some path inconsistencies — these mismatches warrant caution before use.
评估建议
This package implements real Alibaba Cloud ALB management scripts and will need valid Alibaba Cloud credentials to operate. Before installing or granting it access: 1) Inspect the scripts (you already have them) and confirm they only call Alibaba SDK APIs (they do). 2) Provide credentials with least privilege (create an IAM user/role limited to ALB actions) and prefer a temporary STS token rather than long-lived keys. 3) Run the provided validation (py_compile) and run scripts in an isolated env...详细分析 ▾
ℹ 用途与能力
The name/description match the included Python scripts (create/list/update/delete ALB resources). The code uses the Alibaba Cloud ALB SDK and calls ALB API endpoints as expected, so the functionality aligns with the stated purpose. However, the registry metadata lists no required environment variables or credentials while the scripts and SKILL.md both require Alibaba Cloud credentials and a shared config file — this is an important inconsistency.
⚠ 指令范围
SKILL.md instructs installing specific Python packages, running multiple scripts, and using environment variables or ~/.alibabacloud/credentials for credentials. The validation snippet references a path 'skills/network/slb/aliyun-alb-manage/scripts/*.py' which does not match the provided manifest organization (scripts/*.py), indicating sloppy or incorrect runtime instructions. The runtime instructions direct the agent to read environment credentials and to save outputs locally under output/aliyun-alb-manage/ (expected), but they also assume the presence of credentials without the registry declaring them.
⚠ 安装机制
There is no formal install specification in the registry, but SKILL.md asks the user/agent to pip install alibabacloud_alb20200616, alibabacloud_tea_openapi, and alibabacloud_credentials. Installing from PyPI is normal for Python tools, but the lack of an install spec in the package metadata means the runtime may fail or do unexpected installs. No remote download URLs or obfuscated installers were found in the provided files (good).
⚠ 凭证需求
The scripts require Alibaba Cloud credentials (ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET or ALIBABA_CLOUD_... alternates and optional security token) and implicitly the shared credentials file; these are reasonable for ALB management. However, the registry metadata declares no required env vars or config paths — an incoherence. Multiple environment variable names are accepted (ALICLOUD_* and ALIBABA_CLOUD_*), which is reasonable for compatibility but should be explicitly declared so users know what secrets will be accessed.
✓ 持久化与权限
The skill is not marked always:true and does not request persistent/system-wide privileges. Scripts write outputs to a local output/ directory and rely on normal SDK credential resolution; they do not attempt to modify other skill configs or set themselves as always-enabled. Autonomous invocation is allowed by default but is not combined with other high-risk indicators here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
Initial release of aliyun-alb-manage skill. - Supports management and troubleshooting of Alibaba Cloud Application Load Balancer (ALB) resources. - Provides Python scripts and workflow guidance for inspecting, creating, modifying, and debugging ALB instances, listeners, server groups, rules, certificates, ACLs, security policies, and health checks. - Includes validation steps, output storage conventions, and credential handling instructions. - Offers playbooks for common inventory, inspection, health validation, and change workflows. - Documentation includes references for APIs, script usage, troubleshooting, and resource dependencies.
● 无害
安装命令 点击复制
官方npx clawhub@latest install aliyun-alb-manage
镜像加速npx clawhub@latest install aliyun-alb-manage --registry https://cn.clawhub-mirror.com
技能文档
Category: service
# Application Load Balancer (ALB)
Use this skill for end-to-end ALB operations via local Python scripts and OpenAPI-compatible workflows.
Validation
mkdir -p output/aliyun-alb-manage
for f in skills/network/slb/aliyun-alb-manage/scripts/.py; do
python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-alb-manage/validate.txt
Pass criteria: command exits 0 and output/aliyun-alb-manage/validate.txt is generated.
Output And Evidence
- Save all command outputs, request parameters, and API responses under
output/aliyun-alb-manage/. - For change operations, keep before/after snapshots plus health-check results.
Prerequisites
pip install alibabacloud_alb20200616 alibabacloud_tea_openapi alibabacloud_credentials
Credential priority:
ALICLOUD_ACCESS_KEY_ID/ALICLOUD_ACCESS_KEY_SECRET- Optional STS token:
ALICLOUD_SECURITY_TOKEN - Shared config:
~/.alibabacloud/credentials
Workflow
- Confirm region, VPC context, target ALB resource IDs, and expected change window.
- Run inventory scripts first (
list_,get_*) and save baseline outputs. - Apply one change at a time (listener/server-group/rule/lb lifecycle).
- Wait for async completion when needed (
scripts/wait_for_job.py). - Validate final state with health checks and state re-query.
Top task playbooks
1) Read-only inventory and quick diagnosis
python3 scripts/list_instances.py --region cn-hangzhou --json --output output/aliyun-alb-manage/instances.json
python3 scripts/list_server_groups.py --region cn-hangzhou --json --output output/aliyun-alb-manage/server-groups.json
python3 scripts/list_acls.py --region cn-hangzhou --json --output output/aliyun-alb-manage/acls.json
2) Inspect one ALB and listener details
python3 scripts/get_instance_status.py --region cn-hangzhou --lb-id alb-xxx --view detail --output output/aliyun-alb-manage/lb-detail.json
python3 scripts/list_listeners.py --region cn-hangzhou --lb-id alb-xxx --json --output output/aliyun-alb-manage/listeners.json
python3 scripts/get_listener_attribute.py --region cn-hangzhou --listener-id lsn-xxx --output output/aliyun-alb-manage/listener-attr.json
3) Validate traffic path health
python3 scripts/check_health_status.py --region cn-hangzhou --listener-id lsn-xxx --output output/aliyun-alb-manage/health.json
python3 scripts/list_server_group_servers.py --region cn-hangzhou --server-group-id sgp-xxx --output output/aliyun-alb-manage/server-group-members.json
4) Controlled change flow (example: update listener)
python3 scripts/update_listener.py --region cn-hangzhou --listener-id lsn-xxx --request-timeout 120 --output output/aliyun-alb-manage/update-listener.json
python3 scripts/check_health_status.py --region cn-hangzhou --listener-id lsn-xxx --output output/aliyun-alb-manage/health-after-update.json
5) Resource lifecycle operations
- ALB lifecycle:
create_load_balancer.py,delete_load_balancer.py,deletion_protection.py - Listener lifecycle:
create_listener.py,start_listener.py,stop_listener.py,delete_listener.py - Server-group lifecycle:
create_server_group.py,add_servers.py,remove_servers.py,delete_server_group.py - Rule lifecycle:
create_rule.py,update_rule.py,delete_rule.py
References
- API quick map:
references/api_quick_map.md - Script catalog:
references/scripts_catalog.md - Troubleshooting:
references/troubleshooting.md - Logs and analysis:
references/log-analysis.md - Dependencies/order:
references/resource-dependencies.md - Sources:
references/sources.md
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制