{"id":"eaf6ecab-7484-41c0-98d6-9686589f56bf","entityType":"agent","slug":"clawhub-sdk-team-alibabacloud-sas-multiaccount-manage","name":"Alibabacloud Sas Multiaccount Manage","canonicalUrl":"https://www.xpersona.co/agent/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage","canonicalPath":"/agent/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage","generatedAt":"2026-10-13T20:57:53.295Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-10-12T02:31:07.175Z","emptyReason":null},"description":"Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo... Skill: Alibabacloud Sas Multiaccount Manage Owner: sdk-team Summary: Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo... Tags: latest:0.0.1 Version history: v0.0.1 | 2026-04-22T07:44:45.067Z | auto alibabacloud-sas-multiaccount-manage v0.0.1 - Initial release with Python and aliyun CLI integration for Alibaba","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 954 downloads reported by the source. Last updated 10/12/2026.","installCommand":"clawhub skill install s173swjet2yrebzqrp6hjkvmy583mxef:alibabacloud-sas-multiaccount-manage","sourceUrl":"https://clawhub.ai/sdk-team/alibabacloud-sas-multiaccount-manage","homepage":"https://clawhub.ai/sdk-team/skills/alibabacloud-sas-multiaccount-manage","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/sdk-team/alibabacloud-sas-multiaccount-manage","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/sdk-team/skills/alibabacloud-sas-multiaccount-manage","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo..."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-12T02:31:07.175Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-12T02:31:07.175Z","emptyReason":null},"stars":null,"forks":null,"downloads":954,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"0.0.1","tractionLabel":"954 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-12T02:31:07.163Z","emptyReason":null},"lastUpdatedAt":"2026-10-12T02:31:07.175Z","lastCrawledAt":"2026-10-12T02:31:07.163Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-13T02:31:07.163Z","lastVerifiedAt":null,"highlights":[{"version":"0.0.1","createdAt":"2026-04-22T07:44:45.067Z","changelog":"alibabacloud-sas-multiaccount-manage v0.0.1 - Initial release with Python and aliyun CLI integration for Alibaba Cloud Security Center multi-account management. - Manage multiple Alibaba Cloud accounts: auto-fetch account list, enable/disable accounts, and search/filter accounts. - Batch-export and merge Security Center baseline (cloud config check, system baseline risk) and vulnerability (Linux/Windows/app/emergency) reports across all enabled accounts. - Supports concurrent export, polling, merging to Excel, and robust error handling for unsupported or permission-restricted accounts. - Output includes merged Excel reports with “Resource Directory Account” column for easy multi-account compliance review.","fileCount":10,"zipByteSize":19893}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s173swjet2yrebzqrp6hjkvmy583mxef:alibabacloud-sas-multiaccount-manage","setupComplexity":"medium","setupSteps":["Python environment detected. Create a strict virtual environment (`python -m venv .venv`) before installing dependencies to prevent system-level package conflicts.","Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-13T20:57:53.295Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-sas-multiaccount-manage/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-10-12T02:31:07.175Z","emptyReason":null},"readme":"Skill: Alibabacloud Sas Multiaccount Manage\n\nOwner: sdk-team\n\nSummary: Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo...\n\nTags: latest:0.0.1\n\nVersion history:\n\nv0.0.1 | 2026-04-22T07:44:45.067Z | auto\n\nalibabacloud-sas-multiaccount-manage v0.0.1\n\n- Initial release with Python and aliyun CLI integration for Alibaba Cloud Security Center multi-account management.\n- Manage multiple Alibaba Cloud accounts: auto-fetch account list, enable/disable accounts, and search/filter accounts.\n- Batch-export and merge Security Center baseline (cloud config check, system baseline risk) and vulnerability (Linux/Windows/app/emergency) reports across all enabled accounts.\n- Supports concurrent export, polling, merging to Excel, and robust error handling for unsupported or permission-restricted accounts.\n- Output includes merged Excel reports with “Resource Directory Account” column for easy multi-account compliance review.\n\nArchive index:\n\nArchive v0.0.1: 10 files, 19893 bytes\n\nFiles: references/ram-policies.md (3306b), scripts/accounts.py (6946b), scripts/baseline.py (12497b), scripts/merge.py (3134b), scripts/pyproject.toml (511b), scripts/requirements.txt (88b), scripts/vuln.py (12176b), skill-card.md (2893b), SKILL.md (11269b), _meta.json (155b)\n\nFile v0.0.1:SKILL.md\n\n---\nname: alibabacloud-sas-multiaccount-manage\ndescription: Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Supports account list refresh, enable/disable, concurrent batch export of cloud platform configuration check (baselineCspm), system baseline risk (exportHcWarning), Linux/Windows/application/emergency vulnerability results across all managed accounts. Use this skill when users need to manage SAS multi-account settings, export baseline or vulnerability compliance data, or merge multi-account security reports into a single file.\n---\n\n# Alibaba Cloud Security Center Multi-Account Management and Baseline Report Export\n\nUse aliyun CLI and Python scripts to manage multiple Alibaba Cloud accounts in a resource directory and batch-export Security Center baseline reports for each account.\n\n## Prerequisites and Environment Setup\n\n### 1. Install Alibaba Cloud CLI\n\n```bash\n# macOS\nbrew install aliyun-cli\n\n# Or download from GitHub: https://github.com/aliyun/aliyun-cli/releases\n```\n\nCheck credentials:\n\n```bash\naliyun sts get-caller-identity\n```\n\nIf the call fails, instruct the user to run `aliyun configure` and set up credentials (interactive step, must be completed by the user).\n\n### 1.1 Configure AI mode and plugin mode (required)\n\nThis skill requires aliyun CLI plugin mode commands (kebab-case) and a fixed User-Agent declaration.\n\n```bash\n# Keep plugins up to date\naliyun plugin update\n\n# Install required product plugins if missing\naliyun plugin install --names aliyun-cli-sts,aliyun-cli-sas\n\n# Enable AI mode and set required UA segment\naliyun configure ai-mode enable\naliyun configure ai-mode set-user-agent --user-agent AlibabaCloud-Agent-Skills\n\n# Optional checks / rollback\naliyun configure ai-mode show\naliyun configure ai-mode disable\n```\n\n### 2. Install Python ≥ 3.6\n\n```bash\n# Check version\npython3 --version  # Requires 3.6+, 3.9+ recommended\n```\n\n### 3. Create Virtual Environment and Install Dependencies\n\nCreate a virtual environment in `<skill-path>/scripts/` and install dependencies declared in `pyproject.toml`:\n\n```bash\ncd scripts/\n\n# Option A: use venv\npython3 -m venv .venv\n.venv/bin/pip install -e .\n\n# Option B: use uv (optional)\nuv sync\n\n# Option C: if current Python version is unsupported, install as system dependencies\npip install -r requirements.txt\n```\n\n### 4. Run Commands\n\nAll scripts must be executed with **Python from the virtual environment** (whether created via venv, uv, conda, etc.). This document uses `.venv/bin/python` in examples; replace it with your actual virtual environment path.\n\n---\n\n## Working Directory\n\n`accounts.json` and exported Excel files are saved in the **agent's current working directory** (the directory where the command is executed). Script files themselves are located in `<skill-path>/scripts/`. Do not switch into the `scripts` directory when running commands, or `accounts.json` location may shift unexpectedly.\n\n```bash\n# Example: run from any directory\n.venv/bin/python /path/to/scripts/accounts.py refresh\n```\n\n## Feature 1: Account Management (`accounts.py`)\n\n### Workflow\n\n1. **First use**: run `refresh` to fetch account list from the resource directory.\n2. **Filter as needed**: use `search` to find target accounts and get AccountId.\n3. **Enable/disable control**: use `enable` / `disable` to decide which accounts participate in batch export.\n\n### Quick Start\n\n#### Refresh account list\n\nFetch the latest account list from Alibaba Cloud resource directory and write to `accounts.json`. Existing `enable` states are preserved; new accounts are enabled by default.\n\n```bash\n.venv/bin/python accounts.py refresh\n```\n\n#### List all accounts\n\n```bash\n.venv/bin/python accounts.py list\n```\n\nSample output:\n```\n1225574417218097    cwx                     [enabled]\n1234567890123456    prod-account            [disabled]\n```\n\n#### Search accounts\n\nFuzzy-search by DisplayName, returning AccountId and enable status.\n\n```bash\n.venv/bin/python accounts.py search cwx\n.venv/bin/python accounts.py search prod\n```\n\n#### Enable / disable accounts\n\nControl whether an account participates in subsequent batch exports.\n\n```bash\n.venv/bin/python accounts.py enable 1225574417218097\n.venv/bin/python accounts.py disable 1234567890123456\n```\n\n### `accounts.json` Structure\n\n```json\n[\n  {\n    \"AccountId\": \"1225574417218097\",\n    \"DisplayName\": \"cwx\",\n    \"FolderId\": \"r-1Q4pqB\",\n    \"IsMaAccount\": \"NO\",\n    \"SasVersion\": \"0\",\n    \"enable\": true\n  }\n]\n```\n\n---\n\n## Feature 2: Batch Baseline Export (`baseline.py`)\n\nLaunch export tasks concurrently for all accounts with `enable=true`. After polling completion, files are downloaded, extracted, and merged into a single Excel file.\n\n### Workflow\n\n1. **Concurrent submission**: submit `export-record` requests for all enabled accounts (QPS ≤ 5).\n2. **Concurrent polling**: poll `describe-export-info` for each account until export completes.\n3. **Download and extract**: download zip and extract xlsx.\n4. **Merge output**: merge all account xlsx files into one file via `merge.py`, appending a “Resource Directory Account” column.\n5. **Cleanup temporary files**: delete per-account temporary xlsx files after merge.\n\n### Prerequisites\n\n- `accounts.py refresh` has been executed and account enable/disable configuration is complete.\n- aliyun CLI is configured with valid credentials and has SAS `export-record` and `describe-export-info` permissions.\n- Accounts must have Security Center purchased (free edition accounts are skipped automatically).\n\n### Export cloud platform configuration check results (CSPM)\n\nExport `baselineCspm` results for all enabled accounts and merge into `baseline-cspm-merged-{date}.xlsx`.\n\n```bash\n# Export for all enabled accounts\n.venv/bin/python baseline.py export-cspm\n\n# Export for one specific account\n.venv/bin/python baseline.py export-cspm --account-id 1225574417218097\n```\n\n### Export system baseline risk list\n\nExport `exportHcWarning` risk list (high/medium/low, all statuses) for all enabled accounts and merge into `system-warning-merged-{date}.xlsx`.\n\n```bash\n# Export for all enabled accounts\n.venv/bin/python baseline.py export-system-warning\n\n# Export for one specific account\n.venv/bin/python baseline.py export-system-warning --account-id 1225574417218097\n```\n\n### Output Files\n\n| File | Description |\n|------|------|\n| `baseline-cspm-merged-{date}.xlsx` | Merged cloud platform configuration check results, including “Resource Directory Account” column |\n| `system-warning-merged-{date}.xlsx` | Merged system baseline risk list, including “Resource Directory Account” column |\n\n### Error Handling\n\n| Scenario | Behavior |\n|------|------|\n| `FreeVersionNotPermit` | Silently skip this account and continue others |\n| `NoPermission` / `Forbidden` | Silently skip this account |\n| Export failed (server-side error) | Print `[failed]` message and continue with other accounts |\n| All accounts skipped | Print message and exit without output file |\n\n---\n\n## Feature 3: Batch Vulnerability Export (`vuln.py`)\n\nLaunch vulnerability export tasks concurrently for all accounts with `enable=true`. Supports four vulnerability types. After polling completion, files are downloaded, extracted, and merged automatically.\n\n### Workflow\n\n1. **Concurrent submission**: submit `export-vul --force` requests for all enabled accounts (QPS ≤ 5).\n2. **Concurrent polling**: poll `describe-vul-export-info --force` for each account until export completes.\n3. **Download and extract**: download zip and extract xlsx.\n4. **Merge output**: merge all account xlsx files into one file via `merge.py`, appending a “Resource Directory Account” column.\n5. **Cleanup temporary files**: delete per-account temporary xlsx files after merge.\n\n> When the current account is the same as the caller's primary account, `--ResourceDirectoryAccountId` is omitted automatically.\n\n### Prerequisites\n\n- `accounts.py refresh` has been executed and account enable/disable configuration is complete.\n- aliyun CLI is configured with valid credentials and has SAS `export-vul` and `describe-vul-export-info` permissions.\n- Accounts must have Security Center purchased (free edition accounts are skipped automatically).\n\n### Export Linux software vulnerabilities (CVE)\n\nExport unresolved Linux software vulnerabilities (high/medium/low priority) for all enabled accounts and merge into `vul-cve-merged-{date}.xlsx`.\n\n```bash\n# Export for all enabled accounts\n.venv/bin/python vuln.py export-cve\n\n# Export for one specific account\n.venv/bin/python vuln.py export-cve --account-id 1225574417218097\n```\n\n### Export Windows system vulnerabilities\n\nExport unresolved Windows system vulnerabilities (high/medium/low priority) for all enabled accounts and merge into `vul-sys-merged-{date}.xlsx`.\n\n```bash\n.venv/bin/python vuln.py export-sys\n.venv/bin/python vuln.py export-sys --account-id 1225574417218097\n```\n\n### Export application vulnerabilities (including SCA)\n\nExport unresolved application vulnerabilities (ECS + container, including software composition analysis) for all enabled accounts and merge into `vul-app-merged-{date}.xlsx`.\n\n```bash\n.venv/bin/python vuln.py export-app\n.venv/bin/python vuln.py export-app --account-id 1225574417218097\n```\n\n### Export emergency vulnerabilities\n\nExport emergency vulnerabilities (at-risk status) for all enabled accounts and merge into `vul-emg-merged-{date}.xlsx`.\n\n```bash\n.venv/bin/python vuln.py export-emg\n.venv/bin/python vuln.py export-emg --account-id 1225574417218097\n```\n\n### Output Files\n\n| File | Description |\n|------|------|\n| `vul-cve-merged-{date}.xlsx` | Merged Linux software vulnerability list, including “Resource Directory Account” column |\n| `vul-sys-merged-{date}.xlsx` | Merged Windows system vulnerability list, including “Resource Directory Account” column |\n| `vul-app-merged-{date}.xlsx` | Merged application vulnerability list (including SCA), including “Resource Directory Account” column |\n| `vul-emg-merged-{date}.xlsx` | Merged emergency vulnerability list, including “Resource Directory Account” column |\n\n### Export Parameter Details\n\n| Type | `export-vul` parameters |\n|------|----------------|\n| `export-cve` | `--Type cve --Necessity asap,later,nntf --Dealed n` |\n| `export-sys` | `--Type sys --Necessity asap,later,nntf --Dealed n` |\n| `export-app` | `--Type app --Necessity asap,later,nntf --AttachTypes sca --AssetType ECS,CONTAINER --Dealed n` |\n| `export-emg` | `--Type emg --RiskStatus y --Dealed n` |\n\n### Error Handling\n\n| Scenario | Behavior |\n|------|------|\n| `FreeVersionNotPermit` | Silently skip this account and continue others |\n| `NoPermission` / `Forbidden` | Silently skip this account |\n| Export failed (server-side error) | Print `[failed]` message and continue with other accounts |\n| All accounts skipped | Print message and exit without output file |\n\n---\n\n## Notes\n\n- Scripts must run in a virtual environment. Examples use `.venv/bin/python`; replace with your actual virtual environment path.\n- Manage aliyun CLI credentials with `aliyun configure`; do not hardcode AK/SK.\n- SAS API supports only two endpoints: `cn-shanghai` (China mainland) and `ap-southeast-1` (outside China mainland).\n\nFile v0.0.1:_meta.json\n\n{\n  \"ownerId\": \"kn74p5w8ywv6prh40g0s82gmqh83nw54\",\n  \"slug\": \"alibabacloud-sas-multiaccount-manage\",\n  \"version\": \"0.0.1\",\n  \"publishedAt\": 1776843885067\n}\n\nFile v0.0.1:references/ram-policies.md\n\n# RAM 权限策略说明\n\n本 Skill 通过 aliyun CLI 调用阿里云云安全中心 (SAS) 和安全令牌服务 (STS)，运行账号（RAM 用户或 RAM 角色）须被授予以下最小权限。\n\n> **注意**：云安全中心 (SAS) 的 RAM 授权粒度为 **SERVICE 级别**，不支持资源级授权，`Resource` 必须设置为 `\"*\"`。\n\n---\n\n## 所需 RAM Action\n\n### 安全令牌服务 (STS)\n\n| Action | 调用脚本 | 用途 |\n|--------|----------|------|\n| `sts:GetCallerIdentity` | `accounts.py`、`baseline.py`、`vuln.py` | 获取当前凭证的主账号 ID，用于判断是否省略 `--ResourceDirectoryAccountId` 参数 |\n\n### 云安全中心 (SAS)\n\nRAM Code：`yundun-sas`（同义别名：`threatdetection`、`yundun-aegis`）\n\n| Action | 调用脚本 | 访问级别 | 用途 |\n|--------|----------|----------|------|\n| `yundun-sas:ListAccountsInResourceDirectory` | `accounts.py` | 读取 | 从资源目录拉取所有成员账号列表 |\n| `yundun-sas:DescribeMonitorAccounts` | `accounts.py` | 读取 | 查询已纳入 SAS 监控的成员账号列表，用于过滤 |\n| `yundun-sas:ExportRecord` | `baseline.py` | 写入 | 发起基线检测结果导出任务（baselineCspm / exportHcWarning） |\n| `yundun-sas:DescribeExportInfo` | `baseline.py` | 读取 | 轮询基线导出任务状态，获取下载链接 |\n| `yundun-sas:ExportVul` | `vuln.py` | 写入 | 发起漏洞导出任务（cve / sys / app / emg） |\n| `yundun-sas:DescribeVulExportInfo` | `vuln.py` | 读取 | 轮询漏洞导出任务状态，获取下载链接 |\n\n---\n\n## 最小权限策略示例\n\n```json\n{\n  \"Version\": \"1\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"sts:GetCallerIdentity\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"yundun-sas:ListAccountsInResourceDirectory\",\n        \"yundun-sas:DescribeMonitorAccounts\",\n        \"yundun-sas:ExportRecord\",\n        \"yundun-sas:DescribeExportInfo\",\n        \"yundun-sas:ExportVul\",\n        \"yundun-sas:DescribeVulExportInfo\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n---\n\n## 多账号访问说明\n\n本工具设计用于**资源目录主账号**（Master Account）下运行，通过 `--ResourceDirectoryAccountId` 参数代入成员账号进行操作。\n\n- 运行凭证须属于资源目录的**管理账号**或已被授权的 RAM 角色\n- 成员账号侧无需额外配置，SAS 多账号管理的权限由主账号统一管控\n- 若凭证属于成员账号（非主账号），`--ResourceDirectoryAccountId` 参数会被自动省略，仅导出该账号自身的数据\n\n---\n\n## 授权说明\n\n- **读取操作**（`Describe*`、`GetCallerIdentity`）：不修改任何资源，风险低\n- **写入操作**（`ExportRecord`、`ExportVul`）：在服务端触发导出任务，不修改用户资产或配置，风险低\n- 由于 SAS 不支持资源级授权，所有 `yundun-sas` Action 的 Resource 均须设为 `\"*\"`\n\n---\n\n## 参考文档\n\n- [云安全中心 RAM 鉴权](https://www.alibabacloud.com/help/en/security-center/developer-reference/api-sas-2018-12-03-ram)\n- [STS GetCallerIdentity](https://www.alibabacloud.com/help/en/resource-access-management/latest/getcalleridentity)\n- [RAM 自定义策略](https://help.aliyun.com/zh/ram/user-guide/create-a-custom-policy)\n\nFile v0.0.1:scripts/pyproject.toml\n\n[project]\nname = \"scripts\"\nversion = \"0.1.0\"\ndescription = \"阿里云云安全中心多账号管理工具\"\nrequires-python = \">=3.6\"\ndependencies = [\n    \"openpyxl>=3.1.5\",\n]\n\n[build-system]\nrequires = [\"hatchling\"]\nbuild-backend = \"hatchling.build\"\n\n[tool.hatch.build.targets.wheel]\nonly-include = [\n    \"accounts.py\",\n    \"merge.py\",\n    \"baseline.py\",\n    \"export_baseline.py\",\n    \"vuln.py\",\n]\n\n[project.scripts]\naccounts = \"accounts:main\"\nmerge = \"merge:main\"\nbaseline = \"baseline:main\"\nvuln = \"vuln:main\"\n\nFile v0.0.1:scripts/requirements.txt\n\net_xmlfile==2.0.0\nnumpy==2.4.4\nopenpyxl==3.1.5\npython-dateutil==2.9.0.post0\nsix==1.17.0\n\nFile v0.0.1:skill-card.md\n\n## Description: <br>\nManage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[sdk-team](https://clawhub.ai/user/sdk-team) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers, cloud security engineers, and operations teams use this skill to manage Alibaba Cloud SAS multi-account participation and export baseline or vulnerability compliance reports across enabled accounts. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The skill uses Alibaba Cloud credentials to run SAS export workflows across multiple accounts. <br>\nMitigation: Use least-privilege RAM credentials and review the included RAM policy guidance before running batch exports. <br>\nRisk: Batch exports depend on the local account selection stored in accounts.json. <br>\nMitigation: Run account refresh intentionally and review accounts.json before enabling broad exports. <br>\nRisk: The aliyun CLI AI-mode and User-Agent configuration can persist after setup. <br>\nMitigation: Check the CLI configuration after use and disable AI mode if it is no longer needed. <br>\nRisk: Exported Security Center reports may contain sensitive security and account information. <br>\nMitigation: Run scripts in a dedicated working directory and handle generated JSON and Excel files according to internal data handling rules. <br>\n\n\n## Reference(s): <br>\n- [RAM Permission Policy Notes](references/ram-policies.md) <br>\n- [Alibaba Cloud Security Center RAM Authorization](https://www.alibabacloud.com/help/en/security-center/developer-reference/api-sas-2018-12-03-ram) <br>\n- [STS GetCallerIdentity](https://www.alibabacloud.com/help/en/resource-access-management/latest/getcalleridentity) <br>\n- [Alibaba Cloud RAM Custom Policies](https://help.aliyun.com/zh/ram/user-guide/create-a-custom-policy) <br>\n- [Alibaba Cloud CLI Releases](https://github.com/aliyun/aliyun-cli/releases) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [Guidance, Shell commands, Configuration instructions, Files] <br>\n**Output Format:** [Markdown with inline bash commands; scripts can produce JSON account lists and merged Excel reports] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [Requires aliyun CLI credentials and a Python environment; generated files are written to the agent's current working directory.] <br>\n\n## Skill Version(s): <br>\n0.0.1 (source: ClawHub release evidence) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>","readmeExcerpt":"Skill: Alibabacloud Sas Multiaccount Manage Owner: sdk-team Summary: Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo... Tags: latest:0.0.1 Version history: v0.0.1 | 2026-04-22T07:44:45.067Z | auto alibabacloud-sas-multiaccount-manage v0.0.1 - Initial release with Python and aliyun CLI integration for Alibaba ","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"# macOS\nbrew install aliyun-cli\n\n# Or download from GitHub: https://github.com/aliyun/aliyun-cli/releases"},{"language":"bash","snippet":"aliyun sts get-caller-identity"},{"language":"bash","snippet":"# Keep plugins up to date\naliyun plugin update\n\n# Install required product plugins if missing\naliyun plugin install --names aliyun-cli-sts,aliyun-cli-sas\n\n# Enable AI mode and set required UA segment\naliyun configure ai-mode enable\naliyun configure ai-mode set-user-agent --user-agent AlibabaCloud-Agent-Skills\n\n# Optional checks / rollback\naliyun configure ai-mode show\naliyun configure ai-mode disable"},{"language":"bash","snippet":"# Check version\npython3 --version  # Requires 3.6+, 3.9+ recommended"},{"language":"bash","snippet":"cd scripts/\n\n# Option A: use venv\npython3 -m venv .venv\n.venv/bin/pip install -e .\n\n# Option B: use uv (optional)\nuv sync\n\n# Option C: if current Python version is unsupported, install as system dependencies\npip install -r requirements.txt"},{"language":"bash","snippet":"# Example: run from any directory\n.venv/bin/python /path/to/scripts/accounts.py refresh"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: alibabacloud-sas-multiaccount-manage\ndescription: Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Supports account list refresh, enable/disable, concurrent batch export of cloud platform configuration check (baselineCspm), system baseline risk (exportHcWarning), Linux/Windows/application/emergency vulnerability results across all managed accounts. Use this skill when users need to manage SAS multi-account settings, export baseline or vulnerability compliance data, or merge multi-account security reports into a single file.\n---\n\n# Alibaba Cloud Security Center Multi-Account Management and Baseline Report Export\n\nUse aliyun CLI and Python scripts to manage multiple Alibaba Cloud accounts in a resource directory and batch-export Security Center baseline reports for each account.\n\n## Prerequisites and Environment Setup\n\n### 1. Install Alibaba Cloud CLI\n\n```bash\n# macOS\nbrew install aliyun-cli\n\n# Or download from GitHub: https://github.com/aliyun/aliyun-cli/releases\n```\n\nCheck credentials:\n\n```bash\naliyun sts get-caller-identity\n```\n\nIf the call fails, instruct the user to run `aliyun configure` and set up credentials (interactive step, must be completed by the user).\n\n### 1.1 Configure AI mode and plugin mode (required)\n\nThis skill requires aliyun CLI plugin mode commands (kebab-case) and a fixed User-Agent declaration.\n\n```bash\n# Keep plugins up to date\naliyun plugin update\n\n# Install required product plugins if missing\naliyun plugin install --names aliyun-cli-sts,aliyun-cli-sas\n\n# Enable AI mode and set required UA segment\naliyun configure ai-mode enable\naliyun configure ai-mode set-user-agent --user-agent AlibabaCloud-Agent-Skills\n\n# Optional checks / rollback\naliyun configure ai-mode show\naliyun configure ai-mode disable\n```\n\n### 2. Install Python ≥ 3.6\n\n```bash\n# Check version\npython3 --version  # Requires 3.6+, 3.9+ recommended\n```\n\n### 3. Create Virtual Environment and Install Dependencies\n\nCreate a virtual environment in `<skill-path>/scripts/` and install dependencies declared in `pyproject.toml`:\n\n```bash\ncd scripts/\n\n# Option A: use venv\npython3 -m venv .venv\n.venv/bin/pip install -e .\n\n# Option B: use uv (optional)\nuv sync\n\n# Option C: if current Python version is unsupported, install as system dependencies\npip install -r requirements.txt\n```\n\n### 4. Run Commands\n\nAll scripts must be executed with **Python from the virtual environment** (whether created via venv, uv, conda, etc.). This document uses `.venv/bin/python` in examples; replace it with your actual virtual environment path.\n\n---\n\n## Working Directory\n\n`accounts.json` and exported Excel files are saved in the **agent's current working directory** (the directory where the command is executed). Script files themselves are located in `<skill-path>/scripts/`. Do not switch into the `scripts` directory when running commands, or `accounts.json` location may shift unexpected"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn74p5w8ywv6prh40g0s82gmqh83nw54\",\n  \"slug\": \"alibabacloud-sas-multiaccount-manage\",\n  \"version\": \"0.0.1\",\n  \"publishedAt\": 1776843885067\n}"},{"path":"references/ram-policies.md","content":"# RAM 权限策略说明\n\n本 Skill 通过 aliyun CLI 调用阿里云云安全中心 (SAS) 和安全令牌服务 (STS)，运行账号（RAM 用户或 RAM 角色）须被授予以下最小权限。\n\n> **注意**：云安全中心 (SAS) 的 RAM 授权粒度为 **SERVICE 级别**，不支持资源级授权，`Resource` 必须设置为 `\"*\"`。\n\n---\n\n## 所需 RAM Action\n\n### 安全令牌服务 (STS)\n\n| Action | 调用脚本 | 用途 |\n|--------|----------|------|\n| `sts:GetCallerIdentity` | `accounts.py`、`baseline.py`、`vuln.py` | 获取当前凭证的主账号 ID，用于判断是否省略 `--ResourceDirectoryAccountId` 参数 |\n\n### 云安全中心 (SAS)\n\nRAM Code：`yundun-sas`（同义别名：`threatdetection`、`yundun-aegis`）\n\n| Action | 调用脚本 | 访问级别 | 用途 |\n|--------|----------|----------|------|\n| `yundun-sas:ListAccountsInResourceDirectory` | `accounts.py` | 读取 | 从资源目录拉取所有成员账号列表 |\n| `yundun-sas:DescribeMonitorAccounts` | `accounts.py` | 读取 | 查询已纳入 SAS 监控的成员账号列表，用于过滤 |\n| `yundun-sas:ExportRecord` | `baseline.py` | 写入 | 发起基线检测结果导出任务（baselineCspm / exportHcWarning） |\n| `yundun-sas:DescribeExportInfo` | `baseline.py` | 读取 | 轮询基线导出任务状态，获取下载链接 |\n| `yundun-sas:ExportVul` | `vuln.py` | 写入 | 发起漏洞导出任务（cve / sys / app / emg） |\n| `yundun-sas:DescribeVulExportInfo` | `vuln.py` | 读取 | 轮询漏洞导出任务状态，获取下载链接 |\n\n---\n\n## 最小权限策略示例\n\n```json\n{\n  \"Version\": \"1\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"sts:GetCallerIdentity\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"yundun-sas:ListAccountsInResourceDirectory\",\n        \"yundun-sas:DescribeMonitorAccounts\",\n        \"yundun-sas:ExportRecord\",\n        \"yundun-sas:DescribeExportInfo\",\n        \"yundun-sas:ExportVul\",\n        \"yundun-sas:DescribeVulExportInfo\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n---\n\n## 多账号访问说明\n\n本工具设计用于**资源目录主账号**（Master Account）下运行，通过 `--ResourceDirectoryAccountId` 参数代入成员账号进行操作。\n\n- 运行凭证须属于资源目录的**管理账号**或已被授权的 RAM 角色\n- 成员账号侧无需额外配置，SAS 多账号管理的权限由主账号统一管控\n- 若凭证属于成员账号（非主账号），`--ResourceDirectoryAccountId` 参数会被自动省略，仅导出该账号自身的数据\n\n---\n\n## 授权说明\n\n- **读取操作**（`Describe*`、`GetCallerIdentity`）：不修改任何资源，风险低\n- **写入操作**（`ExportRecord`、`ExportVul`）：在服务端触发导出任务，不修改用户资产或配置，风险低\n- 由于 SAS 不支持资源级授权，所有 `yundun-sas` Action 的 Resource 均须设为 `\"*\"`\n\n---\n\n## 参考文档\n\n- [云安全中心 RAM 鉴权](https://www.alibabacloud.com/help/en/security-center/developer-reference/api-sas-2018-12-03-ram)\n- [STS GetCallerIdentity](https://www.alibabacloud.com/help/en/resource-access-management/latest/getcalleridentity)\n- [RAM 自定义策略](https://help.aliyun.com/zh/ram/user-guide/create-a-custom-policy)"},{"path":"scripts/pyproject.toml","content":"[project]\nname = \"scripts\"\nversion = \"0.1.0\"\ndescription = \"阿里云云安全中心多账号管理工具\"\nrequires-python = \">=3.6\"\ndependencies = [\n    \"openpyxl>=3.1.5\",\n]\n\n[build-system]\nrequires = [\"hatchling\"]\nbuild-backend = \"hatchling.build\"\n\n[tool.hatch.build.targets.wheel]\nonly-include = [\n    \"accounts.py\",\n    \"merge.py\",\n    \"baseline.py\",\n    \"export_baseline.py\",\n    \"vuln.py\",\n]\n\n[project.scripts]\naccounts = \"accounts:main\"\nmerge = \"merge:main\"\nbaseline = \"baseline:main\"\nvuln = \"vuln:main\""},{"path":"scripts/requirements.txt","content":"et_xmlfile==2.0.0\nnumpy==2.4.4\nopenpyxl==3.1.5\npython-dateutil==2.9.0.post0\nsix==1.17.0"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo... Skill: Alibabacloud Sas Multiaccount Manage Owner: sdk-team Summary: Manage multiple Alibaba Cloud accounts and batch-export Security Center (SAS) baseline and vulnerability reports via the aliyun CLI and Python scripts. Suppo... Tags: latest:0.0.1 Version history: v0.0.1 | 2026-04-22T07:44:45.067Z | auto alibabacloud-sas-multiaccount-manage v0.0.1 - Initial release with Python and aliyun CLI integration for Alibaba","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":962,"uniquenessScore":48,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-12T02:31:07.175Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-12T02:31:07.175Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-13T20:57:53.295Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}