alibabacloud-sas-install-agent

What this skill does

# Security Center Agent Onboarding and Management

Manage Alibaba Cloud Security Center agent installation, version authorization, asset queries, and security risk detection via the `aliyun` CLI.

**Architecture**: `Security Center (SAS) + ECS + Cloud Assistant + Proxy Cluster (optional)`

Execution model: read operations execute directly (ReAct), write operations display details and require user confirmation before execution (Command). Keep analysis concise -- output a brief reasoning for each action.

> **Pre-check: Aliyun CLI >= 3.3.3 required**
> Run `aliyun version` to verify >= 3.3.3. If not installed or version too low,
> run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update,
> or see `references/cli-installation-guide.md` for installation instructions.
> Then [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
> Then [MUST] run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

> **Pre-check: Alibaba Cloud Credentials Required**
>
> **Security Rules:**
> - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN)
> - **NEVER** ask the user to input AK/SK directly in the conversation or command line
> - **NEVER** use `aliyun configure set` with literal credential values
> - **ONLY** use `aliyun configure list` to check credential status
>
> ```bash
> aliyun configure list
> ```
> Check the output for a valid profile (AK, STS, or OAuth identity).
>
> **If no valid profile exists, STOP here.**
> 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak)
> 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile)
> 3. Return and re-run after `aliyun configure list` shows a valid profile

## Security Guidelines

- Never expose sensitive information (AccessKey, passwords) in output, because leaking credentials could compromise the account
- Never call any Delete-class API, because delete operations are irreversible and may disrupt protection
- Write operations (create install codes, create clusters, install proxies, run commands via cloud assistant, bind authorization, modify switches) must display operation details and wait for user confirmation before execution, because these operations modify live resources
- Display the full command content before dispatching commands via cloud assistant, because executing arbitrary commands on production servers is high-risk

## RAM Policy

Detailed permissions required by this skill: `references/ram-policies.md`

> **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process:
> 1. Read `references/ram-policies.md` to get the full list of permissions required by this SKILL
> 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions
> 3. Pause and wait until the user confirms that the required permissions have been granted

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks,
> passwords, domain names, resource specifications, etc.) MUST be confirmed with the
> user. Do NOT assume or use default values without explicit user approval.

At the **start** of the Core Workflow (before any CLI invocation):
**[MUST] Enable AI-Mode** — AI-mode is required for Agent Skill execution.
Run the following commands before any CLI invocation:
```bash
aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-sas-install-agent"
```
**[MUST] Disable AI-Mode at EVERY exit point** — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed.
AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.
```bash
aliyun configure ai-mode disable
```

---

## Tool Inventory

All APIs are invoked via the `aliyun` CLI. Every `aliyun` command MUST include `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-install-agent`.

| CLI Command | Purpose |
|-------------|---------|
| `aliyun sas describe-cloud-center-instances` | Query server client status by instance ID/IP |
| `aliyun ecs describe-instances` | Query ECS instance info and running status |
| `aliyun ecs describe-cloud-assistant-status` | Check if cloud assistant is online |
| `aliyun ecs run-command` | Remote install command execution (write) |
| `aliyun ecs invoke-command` | Trigger existing command on instances (write) |
| `aliyun ecs describe-invocation-results` | Query command execution results |
| `aliyun sas refresh-assets` | Sync latest asset data |
| `aliyun sas describe-install-codes` | Get existing install code list |
| `aliyun sas add-install-code` | Generate new install code (write) |
| `aliyun sas create-or-update-asset-group` | Create or update asset group (write) |
| `aliyun sas get-auth-summary` | Get authorization quota and usage per version |
| `aliyun sas describe-version-config` | Get version, feature modules, expiration |
| `aliyun sas get-serverless-auth-summary` | Get pay-as-you-go serverless status |
| `aliyun sas modify-post-pay-module-switch` | Toggle pay-as-you-go module switches (write) |
| `aliyun sas bind-auth-to-machine` | Bind/unbind authorization version (write) |
| `aliyun sas update-post-paid-bind-rel` | Change pay-as-you-go version binding or downgrade to free version (write) |
| `aliyun sas describe-property-sca-detail` | Query software info on servers |
| `aliyun sas add-uninstall-clients-by-uuids` | Uninstall agent from specified servers (write) |
| `aliyun sas modify-push-all-task` | Dispatch security check tasks to servers (write) — use this for targeted single-server scans |
| `aliyun sas modify-start-vul-scan` | Trigger global full-scan across ALL servers (write) — NEVER use for targeted single-server scans |
| `aliyun sas describe-grouped-vul` | Query grouped vulnerability statistics |
| `aliyun sas exec-strategy` | Execute baseline check strategy (write) |
| `aliyun sas describe-strategy` | Query baseline check strategy list |
| `aliyun sas list-check-item-warning-summary` | Get baseline check risk statistics |
| `aliyun sas describe-susp-events` | Query security alert events |
| `aliyun sas generate-once-task` | Trigger full asset fingerprint collection (write) |
| `aliyun sas create-asset-selection-config` | Create virus scan asset selection (write) |
| `aliyun sas add-asset-selection-criteria` | Add assets to selection config (write) |
| `aliyun sas update-selection-key-by-type` | Associate selection to virus scan (write) |
| `aliyun sas create-virus-scan-once-task` | Create one-time virus scan task (write) |
| `aliyun sas get-virus-scan-latest-task-statistic` | Query latest virus scan task stats |
| `aliyun sas list-virus-scan-machine` | Query machines involved in virus scan |
| `aliyun sas list-virus-scan-machine-event` | Query virus events on a specific machine |
| `aliyun sas describe-once-task` | Poll vulnerability scan task progress |

> Detailed API parameters: `references/api-reference.md`. RAM permissions: `references/ram-policies.md`. Full command list: `references/related-commands.md`.

---

## Common Flow: Get or Create Install Code

When any installation scenario requires an install code, follow this unified flow.

**Step 1: Query existing install codes**

```bash
aliyun sas describe-install-codes --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-install-agent
```

Display as table: install code, OS, vendor, group, image flag, expiration.

**Step 2: Ask user to cho