A read-only Alibaba Cloud diagnostic skill that verifies public internet egress for cloud-native gateways, SAE applications, and Function Compute functions.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install alibabacloud-cloud-native-internet-diagnostics
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install alibabacloud-cloud-native-internet-diagnostics using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Alibaba Cloud-Native Internet Diagnostics?
This Openclaw Skills diagnostic checks whether an Alibaba Cloud cloud-native product can reach the public internet by resolving its VPC and vSwitch, then verifying NAT gateway SNAT egress for the relevant vSwitch. It supports MSE cloud-native gateways, cloud-native API gateways, AI gateways, Serverless App Engine applications, and Function Compute functions.
The skill is designed for safe, focused troubleshooting: it queries only the resource specified by the user, never creates or changes cloud resources, and produces both machine-readable JSON and a human-readable diagnosis report. Openclaw Skills users receive a clear verdict, warnings, supporting instance facts, and recommended next steps without exposing credentials.
Alibaba Cloud-Native Internet Diagnostics Use Cases
- Verify whether an MSE cloud-native gateway has public internet access.
- Troubleshoot outbound connectivity failures from an Alibaba Cloud API gateway or AI gateway.
- Check whether a Serverless App Engine application can reach external services.
- Determine whether a Function Compute function has public egress or a fixed public IP path.
- Validate vSwitch NAT gateway and SNAT configuration for a specific cloud-native workload.
- Produce an actionable, read-only connectivity report for incident response or deployment validation.
- Investigate a
gw-prefixed gateway ID while distinguishing MSE from API Gateway or AI Gateway APIs.
How Alibaba Cloud-Native Internet Diagnostics Works
- Confirm the product type, Alibaba Cloud region, and exact instance ID with the user. A
gw-ID must be identified as either an MSE gateway or an API/AI gateway before any query runs. - Verify caller identity and derive the account UID through
scripts/sts_token.py, using the aliyun CLI default credential chain without reading or printing access keys. - Run
scripts/cloud_native_internet_diag.pywith the selected product, region, and instance ID. All cloud queries use this single entry point. - Resolve the instance through the appropriate product API:
mse:GetGateway,apig:GetGateway,sae:DescribeApplicationConfig, orfc:GetFunction. - Extract the bound VPC and vSwitch information. For Function Compute, apply the four-quadrant decision logic; only quadrant D, where
internetAccess=falseand vSwitch IDs are configured, requires NAT/SNAT verification. - Check NAT gateway SNAT egress for every applicable bound vSwitch and record successful, missing, unauthorized, or degraded results.
- Emit dual-layer output: structured JSON on stdout and progress traces plus a formatted human report on stderr.
- Render the final diagnosis with the conclusion, plain-language summary, recommended actions, information sources, warnings, and any mandatory auto-fill declaration.
Alibaba Cloud-Native Internet Diagnostics Setup
Requirements
- Python 3.8 or newer. The scripts use only the Python standard library.
- Alibaba Cloud CLI version 3.3.3 or newer installed on PATH. Older versions are a hard blocker because this skill relies on plugin-mode metadata and the
--user-agentoption. - Credentials configured through the aliyun CLI default credential chain, such as environment configuration or
~/.aliyun/config.json. - Read-only RAM permissions required by the diagnostic APIs. Consult the skill's
references/ram-policies.mdfor the minimum action list.
Verify the CLI
aliyun version
Upgrade an older installation before diagnosing:
# macOS or Linux with Homebrew
brew upgrade aliyun-cli
# Verify the active version
aliyun version
Alternatively, replace the binary with a current release from the Alibaba Cloud CLI GitHub releases page. Never fall back to hand-assembled HTTP calls or ad hoc CLI chains.
Run the skill
SKILL_DIR=~/.qoderwork/skills/alibabacloud-cloud-native-internet-diagnostics
cd "$SKILL_DIR" && python3 scripts/sts_token.py --json
After confirming the product, region, and instance ID, run the diagnostic:
cd "$SKILL_DIR" && python3 scripts/cloud_native_internet_diag.py \
--product <product> \
--region <region> \
--instance-id <instance_id>
Supported product values are mse_gateway, apig_gateway, ai_gateway, sae, and fc. Do not provide access keys, secret keys, or STS tokens as command-line parameters. If a script exits with a non-zero status, stop and report the preserved error.
Alibaba Cloud-Native Internet Diagnostics Data Schema & Taxonomy
Required inputs
| Field | Required | Description |
|---|---|---|
product |
Yes | mse_gateway, apig_gateway, ai_gateway, sae, or fc |
region |
Yes | Alibaba Cloud region ID such as cn-hangzhou |
instance-id |
Yes | Gateway ID, SAE AppId, or FC function name |
uid |
No | Account UID; derived automatically with sts:GetCallerIdentity when omitted |
Product resolution
| Product | Instance format | Lookup API |
|---|---|---|
| MSE cloud-native gateway | gw- prefixed ID |
mse:GetGateway |
| Cloud-native API Gateway | gw- prefixed ID |
apig:GetGateway |
| AI Gateway | gw- prefixed ID |
apig:GetGateway |
| Serverless App Engine | Application UUID | sae:DescribeApplicationConfig |
| Function Compute | Function name | fc:GetFunction |
Diagnostic output
The command writes one structured JSON report to stdout and a user-facing report to stderr. The JSON can contain:
- Instance facts such as product type, region, gateway type,
vpc_id, andvswitch_id. - Function Compute
fc_quadrantclassification when the product is FC. - NAT gateway and SNAT egress findings for each applicable vSwitch.
summary: a plain-English verdict suitable for non-technical users.plain_language_conclusion: a one-sentence final conclusion.recommended_actions: an array of follow-up actions, empty when no action is required.- Warnings and actionable degraded-path information for authorization failures, missing resources, or invalid parameters.
The human-readable report is organized around Product, Instance, Region, Conclusion, Details, How it works, Next steps, and Information Sources. Auto-derived values, especially the UID, must be explicitly declared in the final response.
Alibaba Cloud-Native Internet Diagnostics Advanced Features
- Strict read-only execution: no resource creation, modification, deletion, scanning, enumeration, or probing of unrelated resources.
- Single-resource scope ensures the diagnostic is limited to the instance or application explicitly supplied by the user.
- Product-aware API routing prevents the critical MSE versus API/AI gateway
gw-ID ambiguity. - Function Compute four-quadrant logic avoids unnecessary NAT checks when
GetFunctionalready determines the network outcome. - Dual-layer reporting supports both downstream automation through JSON and direct communication through a formatted human report.
- Actionable degraded-path handling preserves authorization warnings and returns user-oriented summaries instead of exposing only raw error codes.
- Session observability adds a single 32-character lowercase hexadecimal session ID to the skill User-Agent for correlated Alibaba Cloud API traces.
- The same session ID is reused across calls in one diagnosis, including identity verification and cloud resource queries.
- On-demand reference modules provide instance lookup details, vSwitch egress rules, report templates, and minimum RAM policies without requiring every reference file to be loaded.
- Fail-fast sequencing preserves deterministic behavior: parameter confirmation, identity verification, diagnostics, and report rendering run in order.
SKILL.md
Loading
Related Openclaw Skills
PostKing Reddit Growth
PostKing Reddit Growth finds relevant communities, creates tailored posting angles, and rewrites content into review-ready Reddit drafts.
agent-ready
agent-ready audits websites for AI agent discoverability and safely fixes structured data, trust pages, llms.txt, crawlability, and Ghost Pro deployment gaps.
Namecheap DNS Tool
A safety-focused automation skill for managing Namecheap DNS records without accidentally replacing hidden or unmanaged entries.
Agent Telegram
Agent Telegram standardizes how eight specialized AI agents send routed, recognizable progress updates to a Telegram user.
MedXpert-REG-001 · Global Medical Device Registration Hub
A source-grounded regulatory research hub that guides medical device teams from product classification and technical documentation to registration, approval, and post-market compliance worldwide.
Medical Device Technical File STED Expert
A regulatory documentation skill that uses the IMDRF STED structure to create reusable, market-specific medical device technical files.
Featured*
