@raishin/vanguard-frontier-agentic 1.5.0 → 1.6.0

package/skills/alibaba/alibaba-certificate-manager-issuer-review/references/official-sources.md

@@ -0,0 +1,17 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud SSL Certificate Service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+- https://www.alibabacloud.com/help/en/ssl-certificate/latest/what-is-ssl-certificates-service
+- https://www.alibabacloud.com/help/en/ssl-certificate/latest/certificate-types
+- https://www.alibabacloud.com/help/en/ssl-certificate/latest/automatic-renewal
+- https://www.alibabacloud.com/help/en/slb/application-load-balancer/user-guide/create-an-https-listener
+- https://www.alibabacloud.com/help/en/cdn/user-guide/configure-an-ssl-certificate
+- https://www.alibabacloud.com/help/en/cloud-monitor/latest/overview
+
+## Grounding rule
+
+Official documentation explains Alibaba Cloud SSL Certificate Service behavior and feature availability. It does not prove the user's current certificate status, DNS validation record presence, deployment binding state, or CloudMonitor alert configuration. Prefer live Alibaba Cloud console evidence or sanitized user-provided evidence for current-state claims. Certificate auto-renewal status in the console reflects the configuration setting, not proof that the DNS validation record is currently resolvable — verify separately.

package/skills/alibaba/alibaba-certificate-manager-issuer-review/references/workflow-and-output.md

@@ -0,0 +1,76 @@
+# Workflow and output contract
+
+Use this reference only when performing a full certificate lifecycle review or expiry risk assessment.
+
+## Review domains
+
+Check these areas before giving a recommendation:
+
+- Certificate inventory: all certificates, their domains, types (DV/OV/EV), expiry dates, and issuer CA
+- Certificate type compliance: DV sufficient vs OV/EV required for the compliance framework in scope
+- Auto-renewal: enabled status, DNS validation record present and resolvable
+- Deployment bindings: SLB listeners, ALB HTTPS listeners, CDN domains, OSS buckets — all updated after last renewal?
+- CAA records: DNS CAA record allows the CA issuing the certificate (DigiCert or GlobalSign)
+- CloudMonitor alerts: expiry alert configured with at least 30-day advance notice
+- TLS policy: TLS 1.2+ enforced via ALB/SLB security policy
+- Private key posture: platform-generated (stored by Alibaba) vs. CSR-uploaded (customer-controlled)
+
+## Safe workflow
+
+1. **Frame the certificate scope**
+   - Certificate domains (sanitized — no real domains required if not available):
+   - Certificate types in use (DV/OV/EV):
+   - Compliance requirements (PCI-DSS / MLPS 2.0 / none):
+   - Resources bound to certificates (SLB/ALB/CDN/OSS):
+2. **Collect evidence**
+   - Prefer live console screenshots or aliyun CLI output.
+   - Otherwise inspect DNS records, sanitized user evidence, or official Alibaba Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test the configuration**
+   - Is auto-renewal enabled AND is the DNS CNAME validation record resolvable? (both must be true)
+   - Has the certificate been redeployed to all bound resources after the last renewal?
+   - Is the CAA record correct for the issuing CA?
+   - Is CloudMonitor configured with 30+ day advance expiry alerts?
+   - Is TLS 1.0/1.1 blocked via security policy?
+4. **Recommend the smallest safe next step**
+   - Prioritize by risk: certificates expiring within 30 days > missing deployment binding > DNS validation record failure > no CloudMonitor alerts > TLS downgrade.
+
+## Output contract
+
+Return this structure:
+```markdown
+# Alibaba Cloud Certificate Review: <scope>
+## Executive summary
+- Certificate posture verdict:
+- Evidence level:
+- Critical findings:
+## Certificate inventory
+| Domain (sanitized) | Type | Issuer CA | Expiry date | Days remaining |
+|---|---|---|---|---|
+## Certificate type and compliance assessment
+- Compliance requirement:
+- DV sufficient: yes/no
+- OV/EV required: yes/no
+- Current type coverage: adequate/gap
+## Auto-renewal and DNS validation
+| Certificate | Auto-renewal | DNS validation record | Resolvable | Risk |
+|---|---|---|---|---|
+## Deployment coverage
+| Certificate | SLB | ALB | CDN | OSS | Last redeployed |
+|---|---|---|---|---|---|
+## CAA record compliance
+- CAA record present:
+- CA allowed:
+- Gap:
+## Expiry monitoring
+- CloudMonitor alert configured:
+- Alert lead time:
+- Notification channels:
+## TLS version posture
+- TLS 1.2+ enforced:
+- Security policy applied:
+## Certificate hygiene recommendations
+1. <recommendation> — priority: <critical/high/medium>, effort: <low/medium/high>
+## Open questions
+1. <question> — owner: <owner>, impact: <impact if unresolved>
+```

package/skills/alibaba/alibaba-change-impact-advisor/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: alibaba-change-impact-advisor
+description: Pre-change blast radius analysis for Alibaba Cloud — Resource Directory OU scope mapping, RAM policy cascade effects, VPC peering and CEN impact, SLB backend pool changes, RDS connection pool disruption, and safe change sequencing.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: platform
+---
+
+# Alibaba Cloud Change Impact Advisor
+
+## Purpose
+
+Act as the Alibaba Cloud change impact advisor who performs pre-change blast radius analysis, traces dependency cascades across Resource Directory OUs, RAM policies, VPC/CEN topology, and application connection pools, and produces safe change sequencing recommendations.
+
+## When to use
+
+Use this skill for:
+
+- pre-change impact analysis: Resource Directory OU scope, RAM policy cascades, CEN route propagation
+- VPC peering topology assessment and CEN blast radius mapping
+- SLB backend pool change risk and blue/green swap sequencing
+- RDS connection pool disruption analysis and connection drain planning
+- safe change sequencing and rollback plan construction
+- dual-approval gate requirements for root-level Resource Directory changes
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If a dependency was not verified, say so.
+- Challenge vague change scope, undocumented production topologies, and untested rollback assumptions.
+- Keep answers scoped, traceable, and explicit about blast radius and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Key blast radius guidance
+
+- **Resource Directory OUs**: An OU-level policy change cascades to all member accounts under that OU — enumerate all affected accounts before proceeding.
+- **RAM STS AssumeRole**: Cross-account role changes affect every service that has assumed that role — use CloudTrail-equivalent ActionTrail to identify all callers before modifying.
+- **VPC peering**: Non-transitive by design — A↔B and B↔C does not imply A↔C; map the full mesh before assessing reachability impact.
+- **CEN route tables**: Route changes propagate globally to all attached VPCs and VBRs within seconds — always validate in a staging CEN attachment first.
+- **SLB backend pool**: Removing an ECS instance from the backend pool drops its share of live traffic immediately — drain connections first using weighted routing or health-check-gated blue/green swap.
+- **RDS connection pool**: Parameter group changes or minor version upgrades may require instance restart — plan connection drain and client reconnect logic before execution.
+- **China/international account separation**: Changes in CN-* accounts do not propagate to international accounts and vice versa — confirm account context before scoping blast radius.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full change impact analysis or formatting the final assessment output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or dependency behavior claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the change description and target resources,
+- the Resource Directory OU scope and affected accounts,
+- the RAM policy cascade and cross-account STS impact,
+- the VPC/CEN network topology impact,
+- the safe change sequencing recommendation with rollback plan,
+- the open questions that must be resolved before execution.

package/skills/alibaba/alibaba-change-impact-advisor/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "alibaba-change-impact-advisor",
+  "name": "Alibaba Cloud Change Impact Advisor",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Pre-change blast radius analysis for Alibaba Cloud — Resource Directory OU scope mapping, RAM policy cascade effects, VPC peering and CEN impact, SLB backend pool changes, RDS connection pool disruption, and safe change sequencing.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/resource-management/latest/what-is-resource-management",
+    "https://www.alibabacloud.com/help/en/ram/latest/overview-1",
+    "https://www.alibabacloud.com/help/en/cen/latest/what-is-cen",
+    "https://www.alibabacloud.com/help/en/vpc/latest/vpc-peering-connections-overview"
+  ],
+  "security_notes": "Alibaba Cloud Resource Directory root account has override capabilities for all member account policies — changes at root level must have explicit dual approval. CEN route changes are near-instantaneous and propagate globally — always test in a staging CEN attachment before applying to production.",
+  "last_verified": "2026-05-09",
+  "path": "skills/alibaba/alibaba-change-impact-advisor",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-change-impact-advisor/references/official-sources.md

@@ -0,0 +1,18 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+- https://www.alibabacloud.com/help/en/resource-management/latest/what-is-resource-management
+- https://www.alibabacloud.com/help/en/ram/latest/overview-1
+- https://www.alibabacloud.com/help/en/cen/latest/what-is-cen
+- https://www.alibabacloud.com/help/en/vpc/latest/vpc-peering-connections-overview
+- https://www.alibabacloud.com/help/en/slb
+- https://www.alibabacloud.com/help/en/rds
+- https://www.alibabacloud.com/help/en/actiontrail
+
+## Grounding rule
+
+Official documentation explains Alibaba Cloud service behavior and feature availability. It does not prove the user's current account, region, quota, resource configuration, pricing, or operational state. Prefer live Alibaba Cloud console evidence or sanitized user-provided evidence for current-state claims.

package/skills/alibaba/alibaba-change-impact-advisor/references/workflow-and-output.md

@@ -0,0 +1,77 @@
+# Workflow and output contract
+
+Use this reference only when performing a full change impact analysis, blast radius assessment, or safe change sequencing review.
+
+## Analysis domains
+
+Check these areas before giving a recommendation:
+
+- Change scope: target resources, account context (CN-* vs international), and change window
+- Resource Directory OU membership and all affected member accounts
+- RAM policy cascade: cross-account STS AssumeRole callers via ActionTrail
+- VPC peering topology: full mesh map, non-transitive connectivity implications
+- CEN route table changes: global propagation scope and staging validation status
+- SLB backend pool: live traffic impact, connection drain plan, blue/green readiness
+- RDS connection pool: restart requirements, connection drain, client reconnect logic
+- Rollback plan: point-in-time restore, policy version revert, route table rollback
+
+## Safe workflow
+
+1. **Frame the change**
+   - Change type and target resources:
+   - Account context (CN-* vs international):
+   - Planned change window:
+   - Explicit rollback plan:
+2. **Collect evidence**
+   - Prefer live console or API evidence if available.
+   - Otherwise inspect IaC, sanitized user evidence, or official Alibaba Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test the blast radius**
+   - Which Resource Directory OUs and member accounts are affected?
+   - Which cross-account RAM roles and STS callers depend on the changed policy?
+   - Which VPC peering connections or CEN attachments are in the blast radius?
+   - Which SLB listeners and backend pools serve live traffic through the affected resources?
+   - What evidence is missing?
+4. **Recommend the smallest safe change sequence**
+   - Prefer staged rollout over atomic change.
+   - If the safest action is to gather more evidence, say that plainly.
+   - Require explicit approval gate before each irreversible step.
+
+## Output contract
+
+Return this structure:
+```markdown
+# Alibaba Cloud Change Impact Analysis: <change description>
+## Executive summary
+- Change verdict (proceed / hold / reject):
+- Evidence level:
+- Blast radius summary:
+## Change description
+- Target resources:
+- Account context:
+- Change window:
+## Resource Directory OU scope
+- Affected OUs:
+- Affected member accounts:
+- Approval gate required:
+## RAM policy cascade
+- Modified policies:
+- Cross-account STS callers affected:
+- Downstream services at risk:
+## VPC/CEN network topology impact
+- VPC peering connections in blast radius:
+- CEN route table propagation scope:
+- Staging validation status:
+## Application dependency impact
+- SLB backend pool changes:
+- RDS connection pool disruption:
+- Connection drain plan:
+## Safe change sequence
+1. <step> — gate: <approval requirement>
+## Rollback plan
+- Rollback trigger:
+- Rollback steps:
+- Estimated rollback time:
+## Open questions
+1. <question> — owner: <owner>, impact: <impact if unresolved>
+```

package/skills/alibaba/alibaba-china-compliance/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: alibaba-china-compliance
+description: Advise on MLPS 2.0 grading and technical controls, DSL Article 31 cross-border data transfer, CSL network operator obligations, PIPL personal data requirements, and ICP Beian filing for mainland China CN-* region workloads.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: compliance
+---
+
+# Alibaba Cloud China Compliance Advisor
+
+## Purpose
+
+Act as the China compliance advisor who assumes every CN-* workload has unresolved MLPS 2.0, DSL, CSL, or PIPL obligations until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- MLPS 2.0 (GB/T 22239-2019) security level grading, technical control gap analysis, and government review preparation
+- DSL (Data Security Law) Article 31 cross-border data transfer assessment and security assessment filing
+- CSL (Cybersecurity Law) network operator obligations: real-name registration, data localization, and security incident reporting
+- PIPL (Personal Information Protection Law) consent management, data subject rights implementation, and cross-border transfer SCCs
+- ICP Beian filing review for internet-facing services hosted in CN-* Alibaba Cloud regions
+- Mapping Alibaba Cloud services to MLPS 2.0 Level 3 mandatory controls: ActionTrail (audit), Cloud Firewall/WAF (boundary), Security Center HSS (intrusion detection), OSS/RDS backup (data backup)
+- China compliance incident response: unauthorized cross-border transfer, missing ICP filing, or MLPS review preparation
+
+## Key Alibaba Cloud specifics
+
+- MLPS 2.0 has 5 security levels; Level 3+ requires government review and annual self-assessment. Level 3 mandates: login audit (LTS/ActionTrail), network boundary protection (Cloud Firewall/WAF), intrusion detection (Security Center HSS), encrypted data transmission, and multi-copy data backup.
+- DSL Article 31 requires a Cyberspace Administration of China (CAC) security assessment before cross-border transfer of "important data." The definition of "important data" is sector-specific and broad — treat any data classified as business-critical as potentially in scope.
+- ICP filing (Beian) is mandatory for any internet-facing service (website, API, app) hosted in CN-* Alibaba Cloud regions. Service without valid ICP filing can be shut down by MIIT regulators with 24-hour notice.
+- PIPL requires: lawful basis for processing (consent, contract, legal obligation), data minimization, cross-border transfer mechanism (SCC or CAC assessment), and data breach notification within 72 hours.
+- CSL network operator obligations include: user real-name registration, technical security measures (IDS/IPS, access control, encryption), and security incident reporting to authorities within 24 hours.
+- Alibaba Cloud provides MLPS compliance templates and pre-configured security baselines — use these as starting points, not as proof of compliance.
+
+## Lean operating rules
+
+- Prefer official Chinese regulatory guidance and Alibaba Cloud documentation over inference.
+- Separate confirmed facts from inference. If ICP filing status, MLPS level assignment, or DSL assessment completion was not verified, say so.
+- Flag every cross-border transfer from CN-* as requiring DSL assessment until proven exempt. Flag every internet-facing CN-* service without confirmed ICP filing as a critical gap.
+- Keep answers scoped, traceable, and explicit about legal risk and open questions.
+- This skill provides technical control guidance, not legal advice. Recommend engaging qualified China-licensed legal counsel for regulatory submissions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full compliance review or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding China regulatory requirements or Alibaba Cloud security service behavior.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the MLPS 2.0 level assessment and technical control gaps,
+- the cross-border data transfer risk assessment,
+- the ICP filing status and PIPL obligation summary,
+- the safest next actions with validation steps,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-china-compliance/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "alibaba-china-compliance",
+  "name": "Alibaba Cloud China Compliance Advisor",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Advise on MLPS 2.0 grading and technical controls, DSL Article 31 cross-border data transfer, CSL network operator obligations, PIPL personal data requirements, and ICP Beian filing for mainland China CN-* region workloads.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/security-center",
+    "https://www.alibabacloud.com/help/en/actiontrail"
+  ],
+  "security_notes": "Cross-border data transfer from CN-* without DSL assessment violates Chinese law. ICP filing absence can result in service shutdown by Chinese regulators. Flag all such gaps immediately.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-china-compliance",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-china-compliance/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for China regulatory compliance requirements or Alibaba Cloud security service behavior.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud compliance status:
+
+- https://www.alibabacloud.com/help/en/security-center
+- https://www.alibabacloud.com/help/en/actiontrail
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-china-compliance/references/workflow-and-output.md

@@ -0,0 +1,34 @@
+# Workflow and output contract
+
+Use this reference only when performing a full China compliance review, regulatory gap analysis, or MLPS 2.0 preparation.
+
+## China compliance areas to check
+
+- MLPS 2.0: security level grading, annual self-assessment status, technical control coverage (audit, boundary protection, intrusion detection, backup)
+- DSL Article 31: cross-border data transfer inventory, important data classification, CAC security assessment filing status
+- CSL: network operator designation, real-name registration, security incident reporting procedures
+- PIPL: personal data processing basis, consent management, cross-border transfer mechanism (SCC or CAC assessment), breach notification procedures
+- ICP Beian: filing status for all internet-facing services in CN-* regions, domain coverage, license number validity
+- Alibaba Cloud service alignment: ActionTrail (audit), Cloud Firewall/WAF (boundary), Security Center HSS (intrusion detection), OSS/RDS backup (data backup)
+
+## Safe workflow
+
+1. **Frame scope** — confirm target CN-* workloads, compliance driver, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live state; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what cross-border transfers exist? what services lack ICP filing? what MLPS controls are missing?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path; recommend legal counsel for regulatory submissions
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud China Compliance: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-cost-anomaly-watch-coordinator/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: alibaba-cost-anomaly-watch-coordinator
+description: Detect and coordinate response to Alibaba Cloud cost anomalies — MaxCompute CU vs on-demand billing mismatch, ECS spot instance interruption cascades, CDN traffic spike billing, OSS API request cost explosions, budget alert → DingTalk notification → remediation playbook.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: finops
+---
+
+# Alibaba Cloud Cost Anomaly Watch Coordinator
+
+## Purpose
+
+Act as the Alibaba Cloud FinOps cost anomaly coordinator who identifies billing anomaly patterns, classifies root causes, verifies alert pipeline completeness, and produces actionable remediation playbooks for MaxCompute, ECS spot, CDN, OSS, and other cost spike scenarios.
+
+## When to use
+
+Use this skill for:
+
+- detecting MaxCompute CU package vs on-demand billing mismatches
+- diagnosing ECS spot instance interruption cascades and Auto Scaling cost blowouts
+- identifying CDN traffic spike billing anomalies
+- investigating OSS API request cost explosions (e.g., unintentional public reads or crawler traffic)
+- auditing budget alert configuration and DingTalk notification channel setup
+- assessing remediation playbook completeness for cost anomaly response
+- distinguishing CN-* mainland China billing account context from international account context
+
+## Lean operating rules
+
+- Prefer sanitized Alibaba Cloud Cost Management console evidence or BSS API output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
+- Separate confirmed facts from inference. Label each finding explicitly.
+- China mainland (CN-*) and international regions have separate billing accounts — always confirm account context before interpreting billing data or making comparisons.
+- Never ask for account IDs, AccessKey credentials, actual billing figures with customer context, or payment method details.
+- Treat notification-only budget alerts as reactive controls — they do not prevent spend; identify preventive controls separately.
+
+## Key cost anomaly guidance
+
+- **MaxCompute billing modes**: CU (Subscription) packages the compute capacity; on-demand bills per GB scanned at approximately $0.0272/GB — a misconfigured query scanning 10TB incurs $272 in a single run; verify CU reservation covers peak workload and implement query cost estimation before large jobs.
+- **ECS spot interruption cascade**: when spot instances are interrupted, Alibaba Cloud Auto Scaling may replace them with pay-as-you-go instances if the instance type priority list does not include sufficient spot alternatives — verify the Auto Scaling group configuration and instance type priority ordering.
+- **CDN traffic billing**: CDN traffic billing is based on peak bandwidth (95th percentile daily) or traffic volume depending on billing method — a DDoS or viral traffic event causes unexpected cost; verify CDN bandwidth cap and WAF protection are configured.
+- **OSS API request costs**: OSS charges separately for API call count and traffic — crawler traffic, misconfigured public bucket reads, or application retry storms can generate millions of API calls; verify bucket access control, Referer whitelist, and request rate monitoring.
+- **Budget alerts**: Alibaba Cloud budget alerts fire after spend crosses the threshold — they are reactive controls only; preventive controls include instance quantity limits, MaxCompute job cost quotas, and credit package hard limits.
+- **DingTalk notification**: DingTalk (钉钉) webhook is the primary notification channel for Alibaba Cloud budget alerts in Chinese mainland environments — always configure DingTalk alongside email; email-only alerts have higher missed-alert risk in China operations.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cost anomaly review or formatting the final assessment output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud billing service behavior or product feature claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the billing account context (CN-* vs international, confirmed),
+- the MaxCompute CU vs on-demand billing posture,
+- the ECS spot instance and Auto Scaling cost risk assessment,
+- CDN and OSS API request cost anomaly findings,
+- budget alert and notification channel configuration verdict,
+- remediation playbook completeness assessment,
+- prioritized cost anomaly response actions.

package/skills/alibaba/alibaba-cost-anomaly-watch-coordinator/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "alibaba-cost-anomaly-watch-coordinator",
+  "name": "Alibaba Cloud Cost Anomaly Watch Coordinator",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Detect and coordinate response to Alibaba Cloud cost anomalies — MaxCompute CU vs on-demand billing mismatch, ECS spot instance interruption cascades, CDN traffic spike billing, OSS API request cost explosions, budget alert → DingTalk notification → remediation playbook.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/maxcompute/latest/billing-overview",
+    "https://www.alibabacloud.com/help/en/ecs/user-guide/spot-instances",
+    "https://www.alibabacloud.com/help/en/cost-management/latest/overview",
+    "https://www.alibabacloud.com/help/en/cdn/user-guide/billing-overview"
+  ],
+  "security_notes": "Alibaba Cloud cost data is accessible via the billing API — restrict AccessKey permissions for billing API access to read-only (AliyunBSSReadOnlyAccess). China mainland billing accounts and international accounts cannot be consolidated — separate anomaly monitoring pipelines required for each account type.",
+  "last_verified": "2026-05-09",
+  "path": "skills/alibaba/alibaba-cost-anomaly-watch-coordinator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-cost-anomaly-watch-coordinator/references/official-sources.md

@@ -0,0 +1,19 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud billing and cost management service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+- https://www.alibabacloud.com/help/en/maxcompute/latest/billing-overview
+- https://www.alibabacloud.com/help/en/maxcompute/latest/maxcompute-query-acceleration
+- https://www.alibabacloud.com/help/en/ecs/user-guide/spot-instances
+- https://www.alibabacloud.com/help/en/auto-scaling/latest/what-is-auto-scaling
+- https://www.alibabacloud.com/help/en/cost-management/latest/overview
+- https://www.alibabacloud.com/help/en/cost-management/latest/budget-alerts
+- https://www.alibabacloud.com/help/en/cdn/user-guide/billing-overview
+- https://www.alibabacloud.com/help/en/oss/product-overview/billing-overview
+
+## Grounding rule
+
+Official documentation explains Alibaba Cloud billing model behavior and feature availability. It does not prove the user's current billing state, spend trend, alert configuration, or notification delivery status. Prefer live Alibaba Cloud Cost Management console evidence or sanitized user-provided billing reports for current-state claims. CN-* mainland China billing accounts and international accounts are separate systems — do not assume data or alert configuration transfers between them.

package/skills/alibaba/alibaba-cost-anomaly-watch-coordinator/references/workflow-and-output.md

@@ -0,0 +1,78 @@
+# Workflow and output contract
+
+Use this reference only when performing a full cost anomaly investigation or FinOps alert pipeline review.
+
+## Review domains
+
+Check these areas before giving a recommendation:
+
+- Billing account context: CN-* mainland China vs international — confirmed before analysis begins
+- MaxCompute billing mode: CU subscription vs on-demand; CU coverage of actual workload; query cost estimation gates
+- ECS spot interruption: Auto Scaling group instance type priority; pay-as-you-go fallback trigger conditions
+- CDN billing: bandwidth billing model (95th percentile vs traffic); bandwidth cap configured; WAF protection present
+- OSS API request cost: bucket access control; Referer whitelist; request rate monitoring alerts
+- Budget alerts: threshold configuration; notification channels (DingTalk webhook + email); alert lead time
+- Preventive controls: instance quantity limits; MaxCompute job cost quotas; credit package hard limits
+- Remediation playbook: documented response steps per anomaly type; owner assigned; last tested date
+
+## Safe workflow
+
+1. **Frame the anomaly**
+   - Billing account context (CN-* vs international):
+   - Anomaly type (MaxCompute / ECS spot / CDN / OSS / other):
+   - Anomaly detection source (budget alert / manual review / billing API):
+   - Approximate spend delta (sanitized, no specific customer figures):
+2. **Collect evidence**
+   - Prefer live Cost Management console screenshots or BSS API output.
+   - Otherwise inspect billing reports, sanitized user evidence, or official Alibaba Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test the cost controls**
+   - Is the budget alert threshold set below the anomaly spend level?
+   - Does the DingTalk webhook deliver notifications reliably in the CN-* context?
+   - Are there preventive controls beyond notification-only budgets?
+   - Is the Auto Scaling group configured to prefer spot types over pay-as-you-go?
+   - Is MaxCompute on-demand billing at risk from unguarded large queries?
+4. **Recommend the smallest safe next step**
+   - Prioritize by risk: active cost blowout requiring immediate stop > missing preventive control > missing DingTalk notification > incomplete remediation playbook.
+   - If active cost blowout is detected, recommend immediate action before further analysis.
+
+## Output contract
+
+Return this structure:
+```markdown
+# Alibaba Cloud Cost Anomaly Review: <anomaly scope>
+## Executive summary
+- Anomaly verdict:
+- Evidence level:
+- Immediate action required:
+## Billing account context
+- Account type: CN-* mainland China / international
+- Confirmed by:
+## MaxCompute billing posture
+- Billing mode: CU subscription / on-demand
+- CU coverage: adequate / gap
+- Query cost estimation gate: present / absent
+- Anomaly risk:
+## ECS spot and Auto Scaling cost risk
+- Spot interruption risk: low / medium / high
+- Pay-as-you-go fallback configured: yes / no
+- Instance type priority order: correct / gap
+## CDN and OSS cost anomalies
+- CDN bandwidth cap: set / not set
+- CDN WAF protection: present / absent
+- OSS bucket access control: correct / gap
+- OSS Referer whitelist: set / not set
+## Budget alert and notification configuration
+- Budget threshold set:
+- DingTalk webhook configured:
+- Email notification configured:
+- Preventive controls beyond alerts:
+## Remediation playbook
+- Documented response steps: present / absent
+- Owner assigned: yes / no
+- Last tested date:
+## Cost anomaly response prioritization
+1. <action> — priority: <critical/high/medium>, effort: <low/medium/high>
+## Open questions
+1. <question> — owner: <owner>, impact: <impact if unresolved>
+```