安装指南

1. ClawHub CLI 从源直接安装技能的最快方式。
   npx clawhub@latest install alibabacloud-cloud-native-internet-diagnostics
2. 手动安装 将技能文件夹复制到以下位置之一
   全局模式
   ~/.openclaw/skills/
   工作区
   /skills/
   优先级：工作区 > 本地 > 内置
3. 提示词安装 将此提示词复制到 OpenClaw 即可自动安装。
   请帮我使用 Clawhub 安装 alibabacloud-cloud-native-internet-diagnostics。如果尚未安装 Clawhub，请先安装（npm i -g clawhub）。
   更倾向于下载？
   获取包含原生技能文件的ZIP压缩包。
   下载技能 (.zip)

什么是

此 Openclaw Skills 诊断工具会解析 VPC 和 vSwitch，然后验证相关 vSwitch 的 NAT 网关 SNAT 出口，以检查阿里云云原生产品是否能够访问公网。它支持 MSE 云原生网关、云原生 API 网关、AI 网关、Serverless App Engine 应用和 Function Compute 函数。
该技能专为安全、聚焦的故障排查而设计：只查询用户指定的资源，从不创建或修改云资源，并同时生成机器可读的 JSON 和人类可读的诊断报告。Openclaw Skills 用户可以获得清晰的结论、警告、实例事实和建议的后续步骤，同时不会暴露凭据。

应用场景

验证 MSE 云原生网关是否具有公网访问能力。
排查阿里云 API 网关或 AI 网关的出站连接故障。
检查 Serverless App Engine 应用是否能够访问外部服务。
确定 Function Compute 函数是否具有公网出口或固定公网 IP 路径。
验证特定云原生工作负载的 vSwitch NAT 网关和 SNAT 配置。
为事件响应或部署验证生成可执行的只读连接报告。
调查以
gw-
为前缀的网关 ID，同时区分 MSE、API Gateway 或 AI Gateway API。

工作原理

与用户确认产品类型、阿里云地域和准确的实例 ID。任何查询运行前，都必须确认 gw- ID 属于 MSE 网关还是 API/AI 网关。
通过 scripts/sts_token.py 验证调用者身份并获取账户 UID，使用 aliyun CLI 默认凭据链，且不读取或打印访问密钥。
使用选定的产品、地域和实例 ID 运行 scripts/cloud_native_internet_diag.py。所有云查询均通过此单一入口执行。
通过适当的产品 API 解析实例：mse:GetGateway、apig:GetGateway、sae:DescribeApplicationConfig 或 fc:GetFunction。
提取绑定的 VPC 和 vSwitch 信息。对于 Function Compute，应用四象限决策逻辑；只有 internetAccess=false 且已配置 vSwitch ID 的象限 D 需要进行 NAT/SNAT 验证。
检查每个适用绑定 vSwitch 的 NAT 网关 SNAT 出口，并记录成功、缺失、未授权或降级结果。
输出双层结果：stdout 上的结构化 JSON，以及 stderr 上的进度跟踪和格式化人工报告。
使用结论、通俗摘要、建议操作、信息来源、警告和任何必需的自动填充声明生成最终诊断。

配置指南

Python 3.8 或更高版本。脚本仅使用 Python 标准库。
PATH 中已安装 Alibaba Cloud CLI 3.3.3 或更高版本。旧版本会阻止运行，因为此技能依赖插件模式元数据和 --user-agent 选项。
通过 aliyun CLI 默认凭据链配置凭据，例如环境配置或 ~/ .aliyun/config.json。
诊断 API 所需的只读 RAM 权限。最低操作列表请参阅技能的 references/ram-policies.md。
验证 CLI
aliyun version
诊断前升级旧版本：

使用 Homebrew 的 macOS 或 Linux

brew upgrade aliyun-cli

验证当前版本

aliyun version
也可以从 Alibaba Cloud CLI GitHub releases 页面下载当前版本并替换二进制文件。绝不要退回到手工组装的 HTTP 调用或临时 CLI 链。
运行技能
SKILL_DIR=~/ .qoderwork/skills/alibabacloud-cloud-native-internet-diagnostics
cd "$SKILL_DIR" && python3 scripts/sts_token.py --json
确认产品、地域和实例 ID 后，运行诊断：
cd "$SKILL_DIR" && python3 scripts/cloud_native_internet_diag.py \ --product \ --region \ --instance-id 支持的产品值为 mse_gateway、apig_gateway、ai_gateway、sae 和 fc。不要将访问密钥、Secret 密钥或 STS 令牌作为命令行参数提供。如果脚本以非零状态退出，请停止并报告保留的错误。

数据架构

必需输入
字段 必需 描述
product 是 mse_gateway、apig_gateway、ai_gateway、sae 或 fc
region 是 Alibaba Cloud 地域 ID，例如 cn-hangzhou
instance-id 是 网关 ID、SAE AppId 或 FC 函数名称
uid 否 账户 UID；省略时通过 sts:GetCallerIdentity 自动获取
产品解析
产品 实例格式 查询 API
MSE 云原生网关 以 gw- 为前缀的 ID mse:GetGateway
云原生 API Gateway 以 gw- 为前缀的 ID apig:GetGateway
AI Gateway 以 gw- 为前缀的 ID apig:GetGateway
Serverless App Engine 应用 UUID sae:DescribeApplicationConfig
Function Compute 函数名称 fc:GetFunction
诊断输出
该命令向 stdout 写入一份结构化 JSON 报告，并向 stderr 写入面向用户的报告。JSON 可能包含：
实例事实，例如产品类型、地域、网关类型、vpc_id 和 vswitch_id。
产品为 FC 时的 Function Compute fc_quadrant 分类。
每个适用 vSwitch 的 NAT 网关和 SNAT 出口结果。
summary：适合非技术用户的通俗英文结论。
plain_language_conclusion：一句话最终结论。
recommended_actions：后续操作数组；无需操作时为空。
关于授权失败、资源缺失或参数无效的警告和可执行的降级路径信息。
人类可读报告围绕 Product、Instance、Region、Conclusion、Details、How it works、Next steps 和 Information Sources 组织。自动派生的值，尤其是 UID，必须在最终响应中明确声明。

高级特性

严格只读执行：不创建、修改、删除、扫描、枚举或探测无关资源。
单资源范围确保诊断仅限于用户明确提供的实例或应用。
面向产品的 API 路由避免 MSE 与 API/AI 网关
gw-
ID 的关键歧义。
Function Compute 四象限逻辑可在
GetFunction
已确定网络结果时避免不必要的 NAT 检查。
双层报告同时支持通过 JSON 进行下游自动化，以及通过格式化人工报告进行直接沟通。
可执行的降级路径处理会保留授权警告，并返回面向用户的摘要，而不是只暴露原始错误代码。
会话可观测性会将单个 32 字符小写十六进制会话 ID 添加到技能 User-Agent，以关联 Alibaba Cloud API 跟踪。
一次诊断中的多次调用（包括身份验证和云资源查询）会复用同一会话 ID。
按需参考模块提供实例查询详情、vSwitch 出口规则、报告模板和最低 RAM 策略，无需加载每个参考文件。
快速失败顺序确保确定性行为：参数确认、身份验证、诊断和报告渲染按顺序执行。

name: alibabacloud-cloud-native-internet-diagnostics description: | Read-only diagnostics for the public internet egress capability of Alibaba
Cloud cloud-native products: cloud-native gateway (MSE), cloud-native API
gateway, AI gateway, Serverless App Engine (SAE), and Function Compute (FC).
Use when the user asks whether such an instance can access the public
internet, reports outbound connectivity failure, or wants to check a fixed
public egress IP. Resolves the VPC/vSwitch bound to the instance, then
verifies NAT gateway SNAT egress for that vSwitch; produces a diagnosis
report. Read-only: never creates, modifies, or deletes any resource.
Triggers: "cloud-native gateway public internet", "MSE gateway outbound",
"APIG outbound connectivity", "AI gateway public network",
"SAE public internet", "SAE outbound connectivity", "FC fixed public IP",
"FC function outbound", "cloud-native internet diagnostics",
"vSwitch NAT SNAT egress".

Cloud-Native Product Public Internet Egress Diagnostics

Diagnose whether an Alibaba Cloud cloud-native product instance (MSE gateway, cloud-native API gateway, AI gateway, SAE application, FC function) can reach the public internet. The flow queries the instance to obtain its bound VPC and vSwitch, then checks whether that vSwitch has a NAT gateway SNAT public egress.

Execution Principle

MANDATORY:

Read-only: this skill only queries and reports. It never creates, modifies, or deletes any resource.
Single entry point: all cloud queries MUST be executed through scripts/cloud_native_internet_diag.py. Do not hand-assemble CLI command chains or inline Python.
Single-resource scope: only the instance / application / function explicitly provided by the user is queried. No scanning, enumeration, or probing of other resources.
Fail fast: if the script exits non-zero, stop and report the error. Do not retry with ad-hoc CLI variants.
Strict sequencing: steps below run in order; any step failure aborts the diagnosis with the error preserved.
Prerequisites (Runtime and aliyun CLI Version)

Requirement Value Why

Python 3.8 or newer runs the two scripts; standard library only, no third-party packages

aliyun CLI version 3.3.3 or newer, on PATH all cloud queries go through the CLI in lowercase-hyphenated plugin mode (e.g. aliyun vpc describe-nat-gateways); older builds lack the plugin-mode metadata and the --user-agent flag this skill relies on

Check the installed version first:

aliyun version

If the reported version is older than 3.3.3, upgrade the CLI before running any diagnosis (any one of these routes):

# macOS / Linux with Homebrew

brew upgrade aliyun-cli

# any platform: replace the binary with the latest release from
# https://github.com/aliyun/aliyun-cli/releases

# verify the upgrade took effect

aliyun version

A CLI older than 3.3.3 is a hard blocker: report the version gap and the upgrade command to the user instead of falling back to hand-assembled HTTP calls.

Credentials

Credentials are resolved automatically by the aliyun CLI default credential chain (environment or ~/.aliyun/config.json). Do not read, print, or pass AK/SK/STS tokens explicitly.
No script in this skill accepts --access-key-id / --access-key-secret / --sts-token parameters. Never export or echo plaintext credentials on the command line.
scripts/sts_token.py only performs identity verification and UID derivation (via aliyun sts get-caller-identity); it never carries credentials.

User Confirmation

Before running any query, confirm the target product type, region, and instance id with the user.

If the user provides a gw- prefixed instance id without naming the product, you MUST ask whether it is a cloud-native gateway (MSE) or a cloud-native API gateway / AI gateway — both families share the gw- prefix but use completely different APIs. Never guess.

UID is informational only and can be auto-derived; product / region / instance-id are never auto-filled silently.

Trigger Conditions

Keyword triggers:

cloud-native gateway public internet / MSE gateway outbound / gateway public access
cloud-native API gateway public / APIG outbound connectivity / AI gateway public network
SAE public internet / SAE outbound connectivity / Serverless App Engine public

Function Compute public / FC outbound / FC fixed public IP

cloud-native internet diagnostics

Intent triggers:

User asks whether a cloud-native gateway / API gateway / AI gateway / SAE app / FC function can access the public internet
User reports such a product cannot reach the public internet
User asks to verify the egress capability or the fixed public IP of a cloud-native product

Input Parameters

Parameter Type Required Description Example

product string Yes Product type: mse_gateway / apig_gateway / ai_gateway / sae / fc mse_gateway
region string Yes Region id where the instance lives cn-hangzhou
instance-id string Yes Instance id (gateway/SAE) or function name (FC) gw-cuqp1e6m1hkgu37dj3ag
uid string No Customer account UID; auto-derived via aliyun sts get-caller-identity when omitted 1534830445234223

Required inputs: product, region, instance-id (three items). If the user omits any of them, ask before proceeding; do not run with guessed values.

Auto-fill first, ask second: never ask the user for the UID when it can be derived via sts_token.py. Whenever any parameter is auto-filled (e.g. UID), the Agent MUST explicitly declare it in the response, e.g. "UID auto-derived via sts:GetCallerIdentity: 1772241626973633". This declaration is mandatory and must appear in the final output.

Covered Products

# Product Key Instance id shape Query API

1 Cloud-native Gateway (MSE) mse_gateway starts with gw- mse:GetGateway 2 Cloud-native API Gateway apig_gateway starts with gw- apig:GetGateway 3 AI Gateway ai_gateway starts with gw- apig:GetGateway 4 Serverless App Engine sae UUID, e.g. xxxx-xxx-xxxx sae:DescribeApplicationConfig 5 Function Compute fc function name (string) fc:GetFunction

Critical distinction: MSE gateways and API/AI gateways both use gw- prefixed ids but different APIs. Confirm the exact product first. See references/module1_instance_lookup.md.

Module Index

Module Purpose File

Instance Lookup Five-product API details and response field parsing references/module1_instance_lookup.md
vSwitch Egress NAT/SNAT egress determination and FC four-quadrant table references/module2_vswitch_egress.md
Report Template Diagnosis report structure (with Information Sources) references/report-template.md
RAM Policies Minimum read-only RAM policy, action by action references/ram-policies.md

Load references on demand. Do not read all reference files unless the task requires them.

Orchestration

User request

|
v
Step 1: confirm product / region / instance-id (gw- prefix => must clarify)
|
v
Step 2: identity verification + UID derivation (sts_token.py)
|
v
Step 3: run cloud_native_internet_diag.py
| (instance lookup -> FC four-quadrant -> vSwitch NAT/SNAT check)
|
v
Step 4: render the diagnosis report (dual-layer: machine JSON + human report)

Execution Flow

Step 1: Parameter Clarification and Confirmation
Product type (cannot be skipped):
"cloud-native gateway" / "MSE gateway" → mse_gateway
"cloud-native API gateway" / "APIG" → apig_gateway
"AI gateway" → ai_gateway
"SAE" / "Serverless App Engine" → sae
"Function Compute" / "FC" → fc
A gw- prefixed id without a named product → MUST ask: MSE gateway or API/AI gateway?
Region id: e.g. cn-hangzhou, cn-shanghai, cn-beijing.
Instance id: gateway id / SAE AppId / FC function name.

If the user refuses or cannot provide these, stop and explain that they are mandatory for diagnosis.

Step 2: Identity Verification and UID Derivation
SKILL_DIR=~/.qoderwork/skills/alibabacloud-cloud-native-internet-diagnostics

cd $SKILL_DIR && python3 scripts/sts_token.py --json

Prints the caller identity (AccountId / Arn / IdentityType) and derives the UID. On failure, guide the user to configure the aliyun CLI default credential chain or authorize the RAM role (see references/ram-policies.md).

Step 3: Run the Diagnostics
cd $SKILL_DIR && python3 scripts/cloud_native_internet_diag.py
--product --region --instance-id

The script emits a dual-layer output:

stdout (machine layer): one structured JSON report. It carries instance facts (vpc_id / vswitch_id / gateway_type), the FC four-quadrant diagnosis when applicable, the inline vSwitch NAT/SNAT egress check, and the final conclusion, plus three stable user-facing fields: summary (plain-English verdict for non-technical users), plain_language_conclusion (one-sentence conclusion), and recommended_actions (array of next steps, empty when no action is needed). This JSON is the input for downstream processing.
stderr (user layer): [INFO] / [WARN] / [ERROR] progress traces, followed by a formatted human-readable report block (Product / Instance / Region / Conclusion / Details / How it works / Next steps) that can be shown to the user directly.

Degraded paths (authorization errors, instance not found, invalid parameters) produce the same dual-layer output with an actionable summary instead of a raw error code.

Step 4: Render the Diagnosis Report

Build the final report per references/report-template.md, including the Information Sources section and any auto-fill declarations. Prefer the script's own summary / plain_language_conclusion / recommended_actions for the user-facing conclusion; the stderr report block can be quoted for non-technical users.

Observability (User-Agent and Session ID)

Every OpenAPI call MUST carry the skill User-Agent built from this template:

--user-agent AlibabaCloud-Agent-Skills/{SKILL_NAME}/{session-id}

Template fields:

SKILL_NAME: alibabacloud-cloud-native-internet-diagnostics (fixed, equals the frontmatter name)
session-id: a 32-character lowercase hex string (uuid.uuid4().hex)

session-id rules (MANDATORY):

Generated once per session: one session-id is produced at the start of a diagnostic session and reused by every subsequent call; never regenerated per call. 32-character lowercase hex format: exactly 32 hex characters, no dashes. Consistent across backends: the same session-id is reused by every execution backend of that session (aliyun CLI, SDK, Terraform), so all calls of one diagnosis correlate under a single trace id.

Code-layer implementation: scripts/cloud_native_internet_diag.py and scripts/sts_token.py each build _USER_AGENT from this template with uuid.uuid4().hex and pass --user-agent on every aliyun CLI invocation.

Important Notes

Product distinction: MSE gateway and API/AI gateway ids both start with gw- but use different APIs. Always confirm the product; never guess.
Credential safety: no AK/SK hardcoding anywhere; credentials come only from the CLI default chain.
FC four-quadrant rule: only quadrant D (internetAccess=false + vSwitchIds configured) needs the NAT/SNAT check, which runs against every bound vSwitch; quadrants A/B/C conclude directly from GetFunction. See references/module2_vswitch_egress.md.
Degradation trace: authorization errors during VPC sub-queries do not abort the report; they are recorded as [WARN] on stderr and surfaced in the report warnings.
Dependencies: Python 3.8+ and the aliyun CLI version 3.3.3 or newer on PATH — see the Prerequisites section above for the version check and the upgrade routes. No third-party Python packages are required.

Examples

Example 1: User: "Does cloud-native gateway gw-685f661467b54f in Hangzhou have public internet access?"

The user said "cloud-native gateway" but also used a gw- id; confirm whether it is MSE or API/AI gateway first. Assuming MSE:

cd $SKILL_DIR && python3 scripts/sts_token.py --json
cd $SKILL_DIR && python3 scripts/cloud_native_internet_diag.py
--product mse_gateway --region cn-hangzhou --instance-id gw-685f661467b54f

Example 2: User: "Does FC function my-function have a fixed public IP?" (region cn-hangzhou)

cd $SKILL_DIR && python3 scripts/cloud_native_internet_diag.py
--product fc --region cn-hangzhou --instance-id my-function

If the JSON shows fc_quadrant: "D", the script automatically verifies NAT SNAT egress of the bound vSwitch; quadrants A/B/C conclude directly.

Example 3: User: "SAE application 7171a6ca-d1cd-4928-8642-7d5cfe69abcd cannot reach the public internet in Beijing."

cd $SKILL_DIR && python3 scripts/cloud_native_internet_diag.py
--product sae --region cn-beijing --instance-id 7171a6ca-d1cd-4928-8642-7d5cfe69abcd

Example 4: User: "Does APIG gateway gw-xxx in Shanghai have public egress?"

cd $SKILL_DIR && python3 scripts/cloud_native_internet_diag.py
--product apig_gateway --region cn-shanghai --instance-id gw-xxx

Note: a gw- prefixed id of the APIG / AI gateway family is resolved via apig:GetGateway, not mse:GetGateway — confirm the product family before running.

PostKing Reddit Growth

glassdoor-salary-data