Run

aliyun version

to verify >= 3.3.3. If not installed or version too low, see references/cli-installation-guide.md for installation instructions.

[MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation. [MUST] run

aliyun plugin update

to ensure that any existing plugins are always up-to-date.

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

bash

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason (workflow success, failure, error, user cancellation, or session end), always disable AI-mode first. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

bash

aliyun configure ai-mode disable

[MUST] Install the SLS CLI plugin before any log query operations:

bash

aliyun component install sls

Verify the plugin is available:

bash

aliyun sls --help

If

aliyun component install

is not available, use the legacy command:

bash

aliyun plugin install --names aliyun-cli-sls

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, or print AK/SK values (e.g.,

  echo $ALIBABA_CLOUD_ACCESS_KEY_ID

  is FORBIDDEN)
• NEVER ask the user to input AK/SK directly in the conversation or command line
• NEVER use

  aliyun configure set

  with literal credential values
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside of this session (via

   aliyun configure

   in terminal or environment variables in shell profile)
3. Return and re-run after

   aliyun configure list

   shows a valid profile

Note on 401 Unauthorized errors: A

401 The security token has expired

error means the STS temporary credential has expired — this is not a RAM permission issue. Ask the user to refresh credentials outside this session via

aliyun configure

, then retry.

[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:

1. Read

   references/ram-policies.md

   to get the full list of permissions required by this SKILL
2. Use

   ram-permission-diagnose

   skill to guide the user through requesting the necessary permissions
3. Pause and wait until the user confirms that the required permissions have been granted

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks, passwords, domain names, resource specifications, etc.) MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

cn-hangzhou

ap-southeast-1

[MUST] Required API Call Sequence — The following API calls MUST be executed in order for every invocation of this skill. Do NOT skip any step, even if you believe the result is known in advance:

1. Step 2a →

   ddoscoo DescribeInstances

   (both regions) + if domain unknown:

   DescribeWebAccessLogDispatchStatus

   for domain discovery only
2. Step 2b →

   ddoscoo DescribeSlsOpenStatus

   +

   DescribeLogStoreExistStatus

   +

   DescribeSlsLogstoreInfo

3. Step 2c →

   ddoscoo DescribeWebAccessLogStatus

   only (domain must be known from user or Step 2a;

   DescribeWebAccessLogDispatchStatus

   is NOT permitted here)
4. Step 3 →

   sls GetLogs

   (query block log by Request ID)
5. Step 5 → Output analysis report

[MUST] User-Agent Header — Every

aliyun

CLI command in this skill MUST include

--header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

to identify the caller.

[MUST] 敏感数据脱敏 — 全局规则，贯穿所有输出 — 以下规则适用于整个工作流的所有输出，包括最终报告、中间分析、日志引用、补充说明的任何段落，不得在任何位置还原已脱敏的数据：

• Client IP：仅保留第一段，其余用

  *

  替代。适用于所有输出格式（JSON 字段、纯文本段落均须脱敏）：
  • 纯文本段落：

    140.205.11.30

    →

    140.*.*.*

    ；"来自 IP 140.205.11.30 的请求" → "来自 IP 140...* 的请求"
  • JSON 字段引用：

    "real_client_ip": "140.205.11.30"

    →

    "real_client_ip": "140.*.*.*"

• Cookie / Authorization / Token：整个值替换为

  [MASKED]

  ，包括在引用原始日志字段时
• Query Parameters：所有参数值替换为

  ***

  。示例：

  ?token=abc&name=test

  →

  ?token=***&name=***

• User-Agent 字符串：截取前 32 个字符

1. The block page displayed in the browser (shows Request ID directly)
2. The HTML body of DDoS Pro's block (intercept) response (contains traceid)

aliyun ddoscoo describe-sls-open-status --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query
aliyun ddoscoo describe-log-store-exist-status --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

aliyun ddoscoo describe-sls-logstore-info --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

[IMPORTANT] Fallback for SLS Info Retrieval: If

describe-sls-logstore-info

returns an error (e.g.,

400 InvalidRosettaRegionId

in

ap-southeast-1

), use the following fallback methods in order:

Fallback 1 — Get SLS info from domain log status (requires knowing a domain):

bash

aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Extract

SlsProject

and

SlsLogstore

from the response.

Fallback 2 — List all SLS projects and find the ddoscoo one:

bash

aliyun sls list-project --region cn-hangzhou --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Look for project names containing

ddoscoo

or

ddosdip

. Note: International DDoS Pro SLS projects may also be hosted in

cn-hangzhou

.

⛔ FORBIDDEN:

describe-web-access-log-dispatch-status

is NOT used in this step. Domain discovery was completed in Step 2a. This step has exactly ONE permitted API call.

aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

• 若返回

  SlsConfigStatus=true

  ，说明已开启，直接进入 Step 3。
• 若未开启，告知用户并征得同意后开启：

aliyun ddoscoo enable-web-access-log-config --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Constraint: This skill only supports enabling full log (

enable-web-access-log-config

). Disabling is not permitted via this skill. Never call

disable-web-access-log-config

.

[IMPORTANT] Error Handling for Enable: If

enable-web-access-log-config

returns an error:

• DomainDoNotBelongToYou

  — Domain is not configured in this DDoS Pro instance. Verify the domain belongs to this instance, or try the other region (

  cn-hangzhou

  ↔

  ap-southeast-1

  ).

• 403 Forbidden

  / RAM permission error — See references/ram-policies.md.

[IMPORTANT] Historical Logs: Enabling full log only records future requests. If the block event occurred before enabling, no SLS log will exist for that Request ID. Inform the user: "Full log has been enabled, but the historical block event cannot be queried via SLS. Please reproduce the block and retry with the new Request ID."

[MUST] Use the SLS CLI plugin (

aliyun sls get-logs

) for all log queries.

undefined

• cc_phase

  — Identifies which protection module triggered the block

• last_owner

  — Format is

  <rule_name>|<source>

  , where

  source

  is

  manual

  (user-created) or

  clover

  (auto-generated)

cc_phase

cc_phase

gfcc

cc

describe-web-cc-rules-v2

gfacl

acl

describe-web-precise-access-rule

gfai

ai

describe-web-cc-protect-switch

gfglobal

global

gf_rule

describe-l7-global-rule

gfbwip

blacklist

describe-web-rules

gfareaban

region

geo

describe-web-area-block-configs

cc_action

block

captcha

close

watch

cc_rule_id

cc_blocks

1

final_action

final_plugin

traceid

matched_host

host

real_client_ip

last_owner

<rule_name>|<source>

isp_line

Extract `BlackList` and `WhiteList` arrays from the response.

**If `cc_phase` = `region` or `geo` → Region Blocking:**
```bash
aliyun ddoscoo describe-web-area-block-configs --domains.1 '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

Block = 1

[IMPORTANT] Domain Not Found: If the domain query returns

DomainNotExist

, the domain may have been removed from DDoS Pro after the block event. Report this to the user — the log is still valid but rule details cannot be retrieved.

[MUST] Sensitive Data Masking — Apply the global masking rules defined in Core Workflow to all fields in this report, including any supplementary paragraphs. Never restore masked data in any section.

undefined

• Request ID: {request_traceid}
• Block Time: {time}
• Client IP: {masked_real_client_ip, e.g. 192...***}
• ISP Line: {isp_line}（DDoS Pro 接入线路，非客户端实际位置）
• Domain: {matched_host}
• Request URL: {host}{request_path}?{masked_query_params}

• Rule ID: {final_rule_id 或 cc_rule_id；若日志中两个字段均不存在，输出 "N/A - 日志中未记录规则 ID"，不可省略此行}
• Block Type: {final_plugin / cc_phase}
• Action: {final_action or cc_action}

1. Re-check SLS and log store status (Step 2b)
2. Check domain full log switch:
   bash

   aliyun ddoscoo describe-web-access-log-status --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

3. Enable if disabled (check-then-act):
   bash

   aliyun ddoscoo enable-web-access-log-config --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

4. Check all domain log dispatch status:
   bash

   aliyun ddoscoo describe-web-access-log-dispatch-status --page-number 1 --page-size 50 --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

1. Verify Request ID format (typically 30+ hex characters)
2. Script auto-expands search up to 90 days
3. Try both regions (

   cn-hangzhou

   and

   ap-southeast-1

   )
4. Check log retention (TTL) via

   describe-sls-logstore-info

1. Check current status first (idempotent check-then-act)
2. Only disable operations are permitted; never delete rules
3. Confirm with user before executing

aliyun ddoscoo disable-web-cc-rule --domain '<domain>' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

aliyun ddoscoo modify-web-precise-access-switch --domain '<domain>' --config '{"PreciseRuleEnable": 0}' --region <region-id> --header User-Agent=AlibabaCloud-Agent-Skills/alibabacloud-ddoscoo-intercept-query

• Full log was enabled for a domain during execution (inform user; this skill only enables, never disables)
• CC rules were disabled (can be re-enabled via

  enable-web-cc-rule

  )

1. Always query both regions (

   cn-hangzhou

   and

   ap-southeast-1

   ) for instance discovery
2. [MUST] Use

   aliyun sls get-logs

   (plugin mode, kebab-case) for SLS log queries
3. Do NOT guess SLS project/logstore names — always obtain them from

   describe-sls-logstore-info

   or

   describe-web-access-log-status

4. Check domain full log status before querying to avoid empty results
5. [MUST] Mask sensitive data in output reports: Client IP →

   first_octet.*.*.*

   , query parameters →

   ***

   , cookies/tokens →

   [MASKED]

6. Use idempotent check-then-act pattern before any write operations
7. Never delete rules — only disable/enable operations are permitted