Alibaba Cloud ECS Troubleshooting Skills

English | 简体中文

A collection of Agent Skills for structured, reproducible troubleshooting and security assessment of Alibaba Cloud ECS instances.

Overview

This repository provides four self-contained Skills that AI agents can load to diagnose Linux and Windows operating-system issues, investigate Linux userspace compromises, and assess Linux kernel vulnerabilities.

Each Skill uses its own SKILL.md as the entry point. The file defines when the Skill applies, how the agent should work, which dependencies it needs, and where to find detailed references.

Choose a Skill

Need	Skill	Primary scope
Diagnose an ECS Linux OS issue	alibabacloud-ecs-linux-os-troubleshooting	Boot, access, network, disk/filesystem, performance, crash/hang, clock, and configuration issues
Diagnose or repair an ECS Windows issue	alibabacloud-ecs-windows-os-troubleshooting	Online or offline Windows diagnosis through local PowerShell or Cloud Assistant
Investigate a suspected Linux userspace compromise	alibabacloud-ecs-sec-userspace	Intrusion detection, evidence collection, and attack-chain analysis
Assess Linux kernel CVEs	alibabacloud-ecs-sec-kernel	Kernel CVE detection and controlled PoC validation

Skill Capabilities

Linux OS Troubleshooting

alibabacloud-ecs-linux-os-troubleshooting follows a six-stage workflow that clarifies the symptom, classifies the problem domain, verifies whether the GuestOS is responsible, uses Alibaba Cloud diagnostic capabilities, investigates affected components, and summarizes evidence and recommendations.

It covers instances stuck during startup, SSH/VNC/Workbench access failures, network loss or latency, disk and filesystem issues, performance anomalies, suspected mining or hidden processes, crashes or hangs, clock drift, and configuration changes that do not take effect. The primary cloud-side path uses aliyun CLI and the ECS plugin; the CMS plugin is optional when CloudMonitor metrics are needed.

See the complete Linux troubleshooting workflow.

Windows OS Troubleshooting

alibabacloud-ecs-windows-os-troubleshooting supports both online diagnosis of a running Windows system and offline diagnosis when a faulty system disk is attached to a helper instance. It can run directly inside the GuestOS with PowerShell or remotely through Cloud Assistant.

Its problem domains include boot failures, crashes or hangs, RDP/VNC access, network and external-port reachability, storage, activation, Windows Update, time synchronization, accounts and permissions, BitLocker, drivers, application failures, certificates and TLS, scheduled tasks, performance, and management channels.

See the complete Windows troubleshooting workflow.

Userspace Security Detection

alibabacloud-ecs-sec-userspace provides Linux userspace intrusion detection and forensics with 51 security analyzers and 10 data collectors. It covers 12 detection categories and maps findings to 103+ MITRE ATT&CK techniques.

It supports standalone, Docker, and Kubernetes modes and produces Markdown reports, JSON evidence, attack-chain analysis, and execution logs. Use it together with the kernel security Skill when both userspace compromise and kernel exposure need assessment.

See the complete userspace security workflow.

Kernel CVE Detection

alibabacloud-ecs-sec-kernel provides 88 Linux kernel CVE detectors spanning 2003–2026. It supports source-based dynamic PoC compilation and controlled CTF challenge validation through write_root_file, read_root_file, and uaf modes.

The Skill complements userspace security analysis by validating whether supported local privilege-escalation vulnerabilities are exploitable on the current kernel.

See the complete kernel security workflow.

Prerequisites

Requirements depend on the selected Skill:

Skill	Requirements
Linux OS troubleshooting	Configured aliyun CLI, aliyun-cli-ecs, suitable RAM permissions, and optionally aliyun-cli-cms for CloudMonitor metrics
Windows OS troubleshooting	Local GuestOS execution requires PowerShell only; remote execution requires aliyun CLI v3.4.11+, aliyun-cli-ecs, a running instance, and Cloud Assistant Agent
Userspace security detection	Linux x86_64, Python 3.11+, and root/sudo access
Kernel CVE detection	Linux x86_64, Python 3.8+, root/sudo access, kernel-module loading capability, and an isolated recoverable environment for PoC execution

Consult each Skill's SKILL.md and referenced RAM policy before granting permissions or running diagnostics.

Installation

Install all Skills globally with skills.sh:

npx skills add aliyun/alibabacloud-ecs-troubleshoot-skills -g

Alternatively, install them manually:

git clone https://github.com/aliyun/alibabacloud-ecs-troubleshoot-skills.git
mkdir -p ~/.agents/skills
cp -r alibabacloud-ecs-troubleshoot-skills/skills/* ~/.agents/skills/

For cloud-based OS troubleshooting, configure aliyun CLI and its plugins:

aliyun configure
aliyun plugin install --names aliyun-cli-ecs
# Optional: required only when the Linux Skill queries CloudMonitor metrics
aliyun plugin install --names aliyun-cli-cms

Windows troubleshooting performed directly inside the GuestOS does not require aliyun CLI.

Quick Start

After installation, describe the target instance and symptom to your AI agent. For example:

• “Diagnose why my ECS Linux instance is stuck during startup.”
• “Investigate why RDP connections to this ECS Windows instance fail.”
• “Check this Linux server for signs of compromise and produce an evidence report.”
• “Assess this Linux kernel for supported local privilege-escalation CVEs.”

The agent selects the matching Skill, validates required inputs and permissions, gathers evidence, and reports conclusions according to that Skill's workflow.

Security Notes

[!CAUTION] Kernel PoCs can crash or destabilize a system. Run them in an isolated virtual machine or snapshot-enabled environment.

• Grant only the RAM and operating-system privileges required by the selected workflow.
• Review each proposed action before allowing an agent to modify a production instance.
• Review every action yourself and take responsibility for the outcome.

Contributing

Contributions are welcome through Issues and Pull Requests.

• New Skills must follow the Agent Skills specification.
• Use Conventional Commits for commit messages.
• All contributions must be suitable for public release.
• Troubleshooting steps must be reproducible and include clear evaluation criteria.

Related Links

• Alibaba Cloud ECS self-service troubleshooting
• Agent Skills specification
• aliyun CLI

License

This project is licensed under the Apache License 2.0.