Alibaba Cloud Script Generator

Turn a natural-language Alibaba Cloud request into one RunScript-compatible Python script. The script must use await call_cli(...), assign the final value to result, and pass check_sandbox.py validation before output. Do not execute the script unless the user asks.

Scope Check Before You Start

• RunScript sandbox scripts (this skill): generates call_cli()-based Python for the RunScript sandbox — no SDK imports, no credentials, no local execution.
• SDK project code → alibabacloud-sdk-usage: generates typed/generic SDK code with imports, credential providers, and dependency management for user projects.
• Operational patterns (batch ops, audits, rotations) → alibabacloud-find-skills first.

Workflow

1. Split the request into atomic cloud operations. For each operation, you must call at least one of the following methods to discover API parameters before writing any code:

   Method A — MCP tools (preferred): call AlibabaCloud___SearchApis with a natural language description, then AlibabaCloud___GetApiDefinition with the confirmed product, action, and version. Batch search calls in one parallel round.

   Method B — HTTP metadata (when MCP tools return errors): The endpoint https://next.api.aliyun.com/meta/v1/products/{product}/versions/{version}/api-docs.json contains all API definitions for a product. If WebFetch cannot extract the target API (response too large), download the full JSON with curl and extract the target API's parameters array locally — use any method that works (e.g. python3 -c, grep, jq).

   You must actually execute one of these methods — reading about them is not sufficient. Only if your tool call returns an error may you fall back to best-known parameter names, adding: # WARNING: API parameters not verified — confirm before use.

2. Generate one Python script body following the Sandbox Contract and Script Patterns below. Only whitelisted modules may be imported. When multiple tool calls are needed, batch them in parallel. Never repeat the same tool call with the same arguments.

3. Write to /tmp/aliyun-runscript.py and validate with the local sandbox checker (<SKILL_DIR>/scripts/check_sandbox.py):

   cat > /tmp/aliyun-runscript.py <<'PYEOF'
   <script body here>
   PYEOF
   python3 <SKILL_DIR>/scripts/check_sandbox.py /tmp/aliyun-runscript.py
   

4. If validation fails, read the → fix suggestion for each violation, fix ONLY the listed issues, and re-validate. Maximum 3 rounds. If violations persist, show them to the user.

5. After validation passes, output only the Python script body — no Markdown fences, headings, or explanatory text unless the user asks.

Sandbox Contract

All rules below are enforced by scripts/check_sandbox.py (local pre-check) and remote validation. See references/runscript-contract.md for full definitions with examples.

Script Patterns

Sequential (dependent calls):

vpc = await call_cli(product="Vpc", version="2016-04-28", action="CreateVpc", params={"RegionId": region_id, "CidrBlock": "10.0.0.0/8"})
vsw = await call_cli(product="Vpc", version="2016-04-28", action="CreateVSwitch", params={"VpcId": vpc["VpcId"], "CidrBlock": "10.0.0.0/16", "ZoneId": "cn-hangzhou-a"})
result = {"VpcId": vpc["VpcId"], "VSwitchId": vsw["VSwitchId"]}

Pagination (list tasks):

items, page = [], 1
while True:
    resp = await call_cli(product="Ecs", version="2014-05-26", action="DescribeInstances", params={"RegionId": region_id, "PageNumber": page, "PageSize": 100})
    batch = resp.get("Instances", {}).get("Instance", [])
    items.extend(batch)
    if len(batch) < 100:
        break
    page += 1
result = items

Parallel (independent calls):

responses = await asyncio.gather(*[
    call_cli(product="Ecs", version="2014-05-26", action="DescribeInstances", params={"RegionId": rid})
    for rid in region_ids
], return_exceptions=True)
result = {rid: r if isinstance(r, dict) else {"error": str(r)} for rid, r in zip(region_ids, responses)}

Guardrails

• Do not execute the generated script unless the user explicitly asks.
• Do not use any MCP server except the local alibabacloud-core server for API discovery.
• Do not generate boilerplate, redundant error handling, or unused imports.
• Always validate before output. Do not skip validation.
• If the request is ambiguous but not dangerous, use placeholders instead of asking. Use the pre-injected runtime variable (e.g. region_id) or a string placeholder like "<your-vpc-name>".

References

• references/runscript-contract.md — full rule definitions and additional patterns. Read only when validation fails repeatedly.