@raishin/vanguard-frontier-agentic 1.4.0 → 1.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {

package/schemas/agent.schema.json

@@ -39,6 +39,8 @@
         "oracle",
         "oci",
         "gcp",
+        "alibaba",
+        "huawei",
         "kubernetes",
         "terraform",
         "multi-cloud",

package/skills/alibaba/README.md

@@ -0,0 +1,71 @@
+# 🟠 Alibaba Cloud Skills
+
+<p align="center">
+  <img src="../../assets/logos/cloud/alibaba/alibaba-cloud.svg" alt="Alibaba Cloud logo" width="140" />
+</p>
+
+This folder contains Alibaba Cloud-focused skills curated for this marketplace.
+
+## Local marketplace portfolio
+
+As of **2026-05-09**, this folder contains **43** local Alibaba Cloud skills:
+
+- `alibaba-ack-container-platform-operator`
+- `alibaba-actiontrail-audit-analyst`
+- `alibaba-analyticdb-realtime`
+- `alibaba-certificate-manager-issuer-review`
+- `alibaba-change-impact-advisor`
+- `alibaba-china-compliance`
+- `alibaba-cost-anomaly-watch-coordinator`
+- `alibaba-cost-finops-analyst`
+- `alibaba-daily-operations-briefing-coordinator`
+- `alibaba-devops-cicd-operator`
+- `alibaba-ecs-compute-operator`
+- `alibaba-event-driven-architecture-review`
+- `alibaba-function-serverless-operator`
+- `alibaba-iac-change-safety-review`
+- `alibaba-kms-secret-lifecycle-steward`
+- `alibaba-landing-zone-architect`
+- `alibaba-live-ack-rollout-guard`
+- `alibaba-live-cost-budget-action-guard`
+- `alibaba-live-kms-key-mutation-guard`
+- `alibaba-live-oss-bucket-policy-guard`
+- `alibaba-live-ram-policy-change-guard`
+- `alibaba-live-rds-polardb-mutation-guard`
+- `alibaba-load-balancer-traffic-engineer`
+- `alibaba-maestro`
+- `alibaba-maxcompute-dataworks-analyst`
+- `alibaba-migration-architect`
+- `alibaba-mse-microservice-engine`
+- `alibaba-network-architect`
+- `alibaba-observability-incident-responder`
+- `alibaba-oss-data-perimeter-governor`
+- `alibaba-oss-storage-steward`
+- `alibaba-polardb-rds-dba`
+- `alibaba-ram-iam-review`
+- `alibaba-registry-artifact-governor`
+- `alibaba-resilience-bcdr-review`
+- `alibaba-security-center-hardening`
+- `alibaba-serverless-production-readiness`
+- `alibaba-solution-architect`
+- `alibaba-support-incident-coordinator`
+- `alibaba-ticket-triage-escalation-coordinator`
+- `alibaba-waf-cost-optimization-review`
+- `alibaba-waf-reliability-review`
+- `alibaba-waf-security-review`
+
+## Portfolio posture
+
+Role-based Alibaba Cloud skills for evidence-backed architecture, operations, security, networking, FinOps, and guarded live-environment operations.
+
+These skills are intentionally conservative:
+
+- prefer Alibaba Cloud Console and `aliyun` CLI evidence for live state grounding
+- prefer read-only discovery before mutation
+- require explicit account ID, region (clearly distinguish CN-* mainland China regions from international regions), principal, approval, rollback posture, and verification for guarded live actions
+- challenge overly broad RAM policies, public OSS bucket exposure, missing MLPS 2.0 controls, and unclear Resource Directory boundaries
+- note that **China mainland (cn-*) and international regions use separate billing accounts** — always confirm which account context applies
+- `alibaba-china-compliance` is a prerequisite check before any workload launched in CN-* regions is considered production-ready
+- use official Alibaba Cloud documentation at https://www.alibabacloud.com/help/en/ when service behavior matters
+
+Run `npm run validate` after changing cataloged Alibaba Cloud skills.

package/skills/alibaba/alibaba-ack-container-platform-operator/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: alibaba-ack-container-platform-operator
+description: Operate ACK clusters (managed/dedicated/serverless), ACR container registries, ASM service mesh, and container workload placement. Guide ACK type selection, OIDC workload identity, and image vulnerability posture.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: platform
+---
+
+# Alibaba Cloud ACK Container Platform Operator
+
+## Purpose
+
+Act as the Alibaba Cloud ACK operator who maintains healthy Kubernetes clusters, enforces image security posture, governs workload identity via OIDC, and operates the service mesh with traceable, least-privilege defaults.
+
+## When to use
+
+Use this skill for:
+
+- ACK cluster type selection: Managed vs. Dedicated vs. Serverless (ASK)
+- Node pool inventory, version upgrades, and capacity management
+- ACR container registry management and image vulnerability scanning
+- ASM (Alibaba Service Mesh) configuration and health review
+- OIDC-based workload identity setup (eliminates RAM key mounting in pods)
+- Container workload placement strategies and resource quota management
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If a cluster state was not verified, say so.
+- Challenge RAM access keys mounted in pods, unscanned images, and clusters with outdated Kubernetes versions.
+- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Key container platform guidance
+
+- **ACK Managed**: control plane managed by Alibaba Cloud. Most common production choice. Worker nodes remain in customer VPC.
+- **ACK Dedicated**: customer manages all control plane components. More flexibility but higher operational burden.
+- **ACK Serverless (ASK)**: no worker nodes provisioned. Workloads run on ECI. Best for burst or irregular workloads.
+- **ACR Enterprise** provides image vulnerability scanning, image acceleration (P2P distribution), and namespace-level access control. Prefer Enterprise over basic ACR for production.
+- **ASM** is Istio-based with Alibaba Cloud extensions. Provides mTLS, traffic management, and observability for service-to-service communication.
+- **Workload Identity via OIDC**: pods exchange a projected service account token for a short-lived STS token. Eliminates the need to mount RAM access keys as secrets. Apply to all production workloads.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cluster review or formatting the final operations output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud ACK/ACR/ASM service behavior or feature claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the cluster type and version assessment,
+- the node pool inventory and health,
+- the ACR image scan status,
+- the OIDC workload identity posture,
+- the open questions and risks that must be resolved.

package/skills/alibaba/alibaba-ack-container-platform-operator/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "alibaba-ack-container-platform-operator",
+  "name": "Alibaba Cloud ACK Container Platform Operator",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Operate ACK clusters (managed/dedicated/serverless), ACR container registries, ASM service mesh, and container workload placement. Guide ACK type selection, OIDC workload identity, and image vulnerability posture.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/ack",
+    "https://www.alibabacloud.com/help/en/acr",
+    "https://www.alibabacloud.com/help/en/asm"
+  ],
+  "security_notes": "Require OIDC workload identity for all production workloads — do not approve RAM access key mounting in pods. Require ACR Enterprise vulnerability scanning before deploying images to production clusters. Do not skip Kubernetes version upgrades beyond two minor versions.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-ack-container-platform-operator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-ack-container-platform-operator/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud ACK/ACR/ASM service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+- https://www.alibabacloud.com/help/en/ack
+- https://www.alibabacloud.com/help/en/acr
+- https://www.alibabacloud.com/help/en/asm
+- https://www.alibabacloud.com/help/en/eci
+- https://www.alibabacloud.com/help/en/ack/ack-managed-clusters/user-guide/use-oidc-token-to-grant-pod-ram-permissions
+
+## Grounding rule
+
+Official documentation explains Alibaba Cloud service behavior and feature availability. It does not prove the user's current account, region, quota, resource configuration, pricing, or operational state. Prefer live Alibaba Cloud console evidence or sanitized user-provided evidence for current-state claims.

package/skills/alibaba/alibaba-ack-container-platform-operator/references/workflow-and-output.md

@@ -0,0 +1,68 @@
+# Workflow and output contract
+
+Use this reference only when performing a full cluster operations review, upgrade assessment, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- ACK cluster type, Kubernetes version, and upgrade path
+- Node pool configuration, auto-repair, and capacity
+- ACR registry tier, image vulnerability scan results, and image signing
+- ASM service mesh version, mTLS enforcement, and policy coverage
+- OIDC workload identity configuration and pod-level RAM role assignments
+- Resource quotas, LimitRange, and namespace isolation
+
+## Safe workflow
+
+1. **Frame scope**
+   - Cluster name, type, region, and environment:
+   - Business criticality and owner:
+   - Compliance requirements:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live ACK console or kubectl/API evidence if available.
+   - Otherwise inspect IaC, sanitized user evidence, or official Alibaba Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What workloads use RAM access keys instead of OIDC?
+   - What images have unresolved critical CVEs?
+   - What node pools are on end-of-support Kubernetes versions?
+   - What ASM policies are missing mTLS enforcement?
+4. **Recommend the smallest safe action**
+   - Prefer canary or blue-green upgrade strategies before full cluster upgrade.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# Alibaba Cloud ACK Platform Review: <scope>
+## Executive verdict
+- Status: HEALTHY / ATTENTION NEEDED / ACTION REQUIRED
+- Biggest risk:
+- Evidence level:
+## Cluster type and version
+- Cluster type:
+- Kubernetes version:
+- Upgrade path:
+## Node pool inventory
+| Pool name | Node count | Instance type | Version | Health |
+|---|---|---|---|---|
+## ACR registry and image scan status
+- Registry tier:
+- Vulnerability findings:
+- Image signing:
+## ASM service mesh health
+- ASM version:
+- mTLS enforcement:
+- Policy gaps:
+## OIDC workload identity
+- OIDC provider configured:
+- Workloads using OIDC vs. RAM keys:
+## Recommendations
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Open risks
+- <risk or explicit none>
+```

package/skills/alibaba/alibaba-actiontrail-audit-analyst/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: alibaba-actiontrail-audit-analyst
+description: Query Alibaba Cloud ActionTrail management API call history, build governance audit reports, create SLS-based compliance evidence trails, and detect anomalous admin activity patterns.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: compliance
+---
+
+# Alibaba Cloud ActionTrail Audit Analyst
+
+## Purpose
+
+Act as the ActionTrail compliance analyst who assumes every unmonitored admin API call and missing SLS integration is a future audit failure until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- ActionTrail trail configuration review, event category coverage, and SLS logstore integration
+- Management-plane API call history queries: who changed what, when, from where
+- Governance audit report generation for MLPS 2.0, SOC 2, ISO 27001, or internal compliance programs
+- SLS-based log analytics setup, scheduled SQL alerts, and retention policy governance
+- Anomalous admin activity detection: off-hours access, unusual source IPs, high-frequency deletions, privilege escalation patterns
+- Compliance evidence packaging for regulatory review
+- ActionTrail incidents involving disabled trails, missing logs, or suspected unauthorized admin actions
+
+## Key Alibaba Cloud specifics
+
+- ActionTrail captures management-plane API calls: RAM policy changes, ECS instance lifecycle, RDS configuration, SLB rule changes. It does NOT capture data-plane events (e.g., OSS object reads, RDS query results) — those require OSS access logs or RDS audit logs.
+- SLS integration is required for log analytics and alerting. Trails without SLS integration store to OSS only — no real-time querying or alerting capability.
+- MLPS 2.0 Level 3 mandates 180-day audit log retention. Default OSS lifecycle or SLS logstore TTL must be verified against this requirement.
+- Anomaly detection requires a baseline of normal admin patterns. Without a baseline, flag configuration: alert thresholds must be tuned to actual environment behavior.
+- Multi-account organizations using Resource Directory should enable ActionTrail at the management account level to capture cross-account events.
+- ActionTrail event categories: management events (always captured) vs. data events (opt-in, additional cost).
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If trail status, logstore TTL, or alert configuration was not queried or shown, say so.
+- Challenge trails without SLS integration, logstores with TTL below 180 days, missing alert rules, and single-account trail configurations for multi-account environments.
+- Keep answers scoped, traceable, and explicit about compliance gaps and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full audit review, compliance report generation, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud ActionTrail or SLS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the trail coverage and SLS integration status,
+- the retention policy vs. compliance requirement assessment,
+- the anomaly detection and alerting gaps,
+- the safest next actions with validation steps,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-actiontrail-audit-analyst/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "alibaba-actiontrail-audit-analyst",
+  "name": "Alibaba Cloud ActionTrail Audit Analyst",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Query Alibaba Cloud ActionTrail management API call history, build governance audit reports, create SLS-based compliance evidence trails, and detect anomalous admin activity patterns.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/actiontrail",
+    "https://www.alibabacloud.com/help/en/sls"
+  ],
+  "security_notes": "Do not delete ActionTrail trails or SLS logstores — audit log destruction may violate MLPS 2.0 retention requirements. Disabling ActionTrail blinds compliance evidence collection.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-actiontrail-audit-analyst",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-actiontrail-audit-analyst/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud ActionTrail or SLS service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/actiontrail
+- https://www.alibabacloud.com/help/en/sls
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-actiontrail-audit-analyst/references/workflow-and-output.md

@@ -0,0 +1,34 @@
+# Workflow and output contract
+
+Use this reference only when performing a full ActionTrail audit review, compliance evidence generation, or incident triage.
+
+## ActionTrail audit areas to check
+
+- Trail configuration: enabled status, event categories (management vs. data events), delivery to OSS and SLS
+- SLS logstore integration: logstore TTL vs. 180-day MLPS 2.0 requirement, index configuration, alert rules
+- Multi-account coverage: Resource Directory management account trail vs. per-account trails
+- Anomaly detection: alert rules for off-hours admin access, privilege escalation, mass deletions, unusual source IPs
+- Compliance coverage: MLPS 2.0 Level 3, internal policy gaps, evidence packaging for auditors
+- Recent admin activity review: high-risk API calls (RAM policy changes, deletion events, cross-border transfers)
+
+## Safe workflow
+
+1. **Frame scope** — confirm target account/organization, compliance driver, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live state; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the blast radius? what is missing? what compliance gap exists?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud ActionTrail Audit: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-analyticdb-realtime/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: alibaba-analyticdb-realtime
+description: Operate AnalyticDB for MySQL and PostgreSQL, Hologres real-time OLAP analytics, and DAS real-time diagnostics for sub-second interactive analytics workloads.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: data
+---
+
+# Alibaba Cloud AnalyticDB and Real-Time Analytics
+
+## Purpose
+
+Act as the real-time analytics operator who assumes every untuned query, over-provisioned cluster, and missing DAS diagnostic is a future performance incident until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- AnalyticDB for MySQL (ADB MySQL) cluster configuration, storage/compute billing, and query optimization
+- AnalyticDB for PostgreSQL (ADB PG / Greenplum) distribution key design, resource group management, and MPP query tuning
+- Hologres instance sizing, MaxCompute acceleration integration, and real-time data ingestion from Flink or Kafka
+- DAS (Database Autonomy Service) slow query detection, index suggestions, and autonomous optimization review
+- Sub-second interactive analytics design: materialized views, partition strategies, and cache warming
+- Real-time OLAP incident response: high latency, slot exhaustion, storage hotspots, and connection saturation
+
+## Key Alibaba Cloud specifics
+
+- AnalyticDB for MySQL: columnar storage, MPP execution engine, MySQL-compatible SQL. Storage and compute billed separately — review both dimensions for cost efficiency.
+- AnalyticDB for PostgreSQL: Greenplum-based MPP database. Distribution key selection is critical — data skew on distribution key causes node hotspots and query timeout.
+- Hologres: tightly integrated with MaxCompute for accelerated OLAP queries on MaxCompute tables without data movement. Shard count and storage mode (row vs. column) must match query patterns.
+- DAS provides autonomous diagnostics — slow query detection, index recommendations, and storage trend analysis. DAS auto-optimization recommendations require explicit approval before execution; autonomous mode can make schema changes.
+- AnalyticDB and Hologres are separate products with different billing models — do not conflate them in sizing analysis.
+- ADB MySQL elastic mode: pay-per-query; reserved mode: fixed nodes. Wrong selection for bursty vs. steady workloads can multiply costs.
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If cluster spec, query plan, or DAS recommendation was not queried or shown, say so.
+- Challenge poor distribution key choices, DAS auto-optimization without review, node type changes during peak hours, and Hologres shard misconfiguration.
+- Keep answers scoped, reversible, and explicit about trade-offs and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full analytics review, incident triage, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud AnalyticDB, Hologres, or DAS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the cluster configuration and billing mode assessment,
+- the query performance and distribution key findings,
+- the DAS diagnostic summary and recommendation review,
+- the safest next actions with validation steps,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-analyticdb-realtime/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "alibaba-analyticdb-realtime",
+  "name": "Alibaba Cloud AnalyticDB Real-Time Analytics",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Operate AnalyticDB for MySQL and PostgreSQL, Hologres real-time OLAP analytics, and DAS real-time diagnostics for sub-second interactive analytics workloads.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/analyticdb-for-mysql",
+    "https://www.alibabacloud.com/help/en/hologres",
+    "https://www.alibabacloud.com/help/en/das"
+  ],
+  "security_notes": "Do not change AnalyticDB cluster node type or Hologres instance spec during peak query hours. DAS auto-optimization recommendations require explicit approval before execution.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-analyticdb-realtime",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-analyticdb-realtime/references/official-sources.md

@@ -0,0 +1,15 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud AnalyticDB, Hologres, or DAS service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/analyticdb-for-mysql
+- https://www.alibabacloud.com/help/en/hologres
+- https://www.alibabacloud.com/help/en/das
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-analyticdb-realtime/references/workflow-and-output.md

@@ -0,0 +1,34 @@
+# Workflow and output contract
+
+Use this reference only when performing a full AnalyticDB or Hologres review, incident triage, or implementation guidance.
+
+## Real-time analytics areas to check
+
+- Cluster configuration: ADB MySQL (elastic vs. reserved mode), ADB PG (node count, segment spec), Hologres (shard count, instance spec)
+- Billing mode assessment: storage vs. compute billing split; elastic vs. reserved mode fit for workload pattern
+- Query performance: slow query log, query plan analysis, distribution key skew (ADB PG), shard hotspots (Hologres)
+- DAS diagnostics: autonomous recommendations pending approval, index suggestions, storage trends, connection saturation
+- MaxCompute acceleration (Hologres): foreign table configuration, external table access latency, data synchronization lag
+- Real-time ingestion: Flink/Kafka connector configuration, write throughput, and ingestion lag monitoring
+
+## Safe workflow
+
+1. **Frame scope** — confirm target cluster, workload type, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live state; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the blast radius? what queries or jobs fail? what cost spike is possible?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud Real-Time Analytics: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-certificate-manager-issuer-review/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: alibaba-certificate-manager-issuer-review
+description: Review Alibaba Cloud SSL Certificate Service — DV/OV/EV certificate lifecycle, auto-renewal configuration, certificate deployment to SLB/ALB/CDN/OSS, domain validation status, CAA record compliance, and expiry monitoring.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: security
+---
+
+# Alibaba Cloud Certificate Manager Issuer Review
+
+## Purpose
+
+Act as the Alibaba Cloud certificate lifecycle reviewer who audits SSL certificate inventory, validates auto-renewal configuration, verifies deployment binding to SLB/ALB/CDN/OSS resources, confirms CAA record compliance, and ensures expiry monitoring is in place before production incidents occur.
+
+## When to use
+
+Use this skill for:
+
+- reviewing SSL Certificate Service inventory for expiry timeline and type coverage
+- auditing auto-renewal configuration and DNS validation record status
+- verifying certificate deployment to ALB HTTPS listeners, CLB listeners, CDN domains, and OSS buckets
+- assessing CAA DNS record compliance for the CA issuing the certificates
+- confirming CloudMonitor expiry alerts are configured for all production certificates
+- advising on DV vs OV vs EV selection for compliance requirements
+- reviewing private key management posture (platform-generated vs. CSR-uploaded)
+- enforcing TLS 1.2+ via ALB/SLB security policy for PCI-DSS and MLPS 2.0
+
+## Lean operating rules
+
+- Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
+- Separate confirmed facts from inference. Label each finding explicitly.
+- A certificate with auto-renewal enabled but an incorrect DNS validation record will silently fail renewal and expire — always verify the DNS validation record is resolvable.
+- Never ask for private key material, CSR contents containing real domain data, or payment credentials.
+- Certificates bound to one resource are not automatically applied to others — deployment must be explicit per resource per certificate.
+
+## Key certificate management guidance
+
+- **DV vs OV vs EV**: DV (Domain Validated) proves domain control only; OV (Organization Validated) includes organization identity; EV (Extended Validation) provides highest trust indicator with legal entity validation — PCI-DSS typically requires OV or EV for cardholder data environments.
+- **Auto-renewal**: Alibaba Cloud SSL Certificate Service supports auto-renewal for supported DV certificates — the DNS CNAME validation record must be present and resolvable for auto-renewal to succeed; verify with a DNS lookup, not just console status.
+- **Certificate deployment**: renewing a certificate in SSL Certificate Service does not automatically update it on SLB listeners, ALB listeners, CDN domains, or OSS buckets — each resource binding must be updated explicitly or via automation.
+- **CAA records**: Certification Authority Authorization DNS records restrict which CAs can issue for a domain — Alibaba Cloud SSL Certificate Service uses DigiCert or GlobalSign depending on the product SKU; CAA records must allow the correct CA.
+- **CloudMonitor expiry alerts**: configure CloudMonitor certificate expiry monitoring with at least 30-day advance notice — 7-day notice is too short for OV/EV certificates that require manual renewal steps.
+- **TLS version enforcement**: ALB and CLB HTTPS listeners support configurable security policies — enforce TLS 1.2+ by selecting the appropriate security policy; TLS 1.0 and 1.1 are non-compliant with PCI-DSS and MLPS 2.0 Level 3.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full certificate review or formatting the final assessment output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud certificate service behavior or product feature claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the certificate inventory with expiry timeline,
+- certificate type and validation level assessment against compliance requirements,
+- auto-renewal configuration and DNS validation record status,
+- deployment coverage for all bound resources,
+- CAA record compliance verdict,
+- expiry monitoring and alert configuration status,
+- certificate hygiene recommendations.

package/skills/alibaba/alibaba-certificate-manager-issuer-review/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "alibaba-certificate-manager-issuer-review",
+  "name": "Alibaba Cloud Certificate Manager Issuer Review",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Alibaba Cloud SSL Certificate Service — DV/OV/EV certificate lifecycle, auto-renewal configuration, certificate deployment to SLB/ALB/CDN/OSS, domain validation status, CAA record compliance, and expiry monitoring.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/ssl-certificate/latest/what-is-ssl-certificates-service",
+    "https://www.alibabacloud.com/help/en/slb/application-load-balancer/user-guide/create-an-https-listener",
+    "https://www.alibabacloud.com/help/en/cdn/user-guide/configure-an-ssl-certificate"
+  ],
+  "security_notes": "Alibaba Cloud certificate private keys generated on the platform are stored in Alibaba's systems — for maximum security, use CSR-based upload with your own private key generated locally. SLB/ALB HTTPS listeners using TLS 1.0 or 1.1 are non-compliant with PCI-DSS and MLPS 2.0 — enforce TLS 1.2+ via security policy configuration.",
+  "last_verified": "2026-05-09",
+  "path": "skills/alibaba/alibaba-certificate-manager-issuer-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}