{"id":"a9a6c414-3861-41ff-96c3-e9a0bfd167ce","entityType":"agent","slug":"clawhub-sdk-team-alibabacloud-starops-chat","name":"Alibabacloud Starops Chat","canonicalUrl":"https://www.xpersona.co/agent/clawhub-sdk-team-alibabacloud-starops-chat","canonicalPath":"/agent/clawhub-sdk-team-alibabacloud-starops-chat","generatedAt":"2026-10-12T16:14:11.876Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:37:14.697Z","emptyReason":null},"description":"Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topolo...","descriptionLabel":"Source description","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 983 downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s173swjet2yrebzqrp6hjkvmy583mxef:alibabacloud-starops-chat","sourceUrl":"https://clawhub.ai/sdk-team/alibabacloud-starops-chat","homepage":"https://clawhub.ai/sdk-team/skills/alibabacloud-starops-chat","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/sdk-team/alibabacloud-starops-chat","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/sdk-team/skills/alibabacloud-starops-chat","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Alibabacloud Starops Chat technical dossier on Xpersona with agent coverage, OPENCLEW support, and live trust metadata."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:37:14.697Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:37:14.697Z","emptyReason":null},"stars":null,"forks":null,"downloads":983,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"0.0.2","tractionLabel":"983 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:37:14.685Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T22:37:14.697Z","lastCrawledAt":"2026-10-11T22:37:14.685Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T22:37:14.685Z","lastVerifiedAt":null,"highlights":[{"version":"0.0.2","createdAt":"2026-06-22T09:13:42.449Z","changelog":"alibabacloud-starops-chat 0.0.2 - Added support for reading configuration from `.starops/config.json`, `~/.starops/config.json`, or a custom path via `--config`/`STAROPS_AGENT_CONFIG` - Environment variables and config file values can now both be used for required identifiers (`employeeId`, `workspace`, `uid`) - Additional optional config keys and command-line overrides: endpoint, project, timeout, idleTimeout - Pre-flight check and documentation updated for config file usage; config key names must be exact (no aliases) - Improved flexibility in how STAROps Agent connection details are supplied—makes setup easier for users and teams - Removed outdated `skill-card.md` documentation file","fileCount":8,"zipByteSize":21540},{"version":"0.0.1","createdAt":"2026-05-18T12:54:41.187Z","changelog":"Initial release of alibabacloud-starops-chat: - Provides diagnostic capability for Alibaba Cloud STAROps: root cause analysis, service error investigation, topology queries, and APM metrics inspection. - Uses STAROps Agent OpenAPI with mandatory streaming output (`--pipe`) and strict thread management for context preservation. - Requires pre-configured environment variables for employee, workspace, and account UID; enforces credential chain best practices. - Ensures output integrity by quoting/paraphrasing only STAROps-generated data and forbids fabrication or unsupported conclusions. - Includes troubleshooting steps for common configuration and authentication errors.","fileCount":8,"zipByteSize":19351},{"version":"0.0.1-beta.1","createdAt":"2026-05-18T09:01:40.780Z","changelog":"Initial beta release of Alibaba Cloud STAROps Agent diagnostic skill. - Enables users to diagnose service errors, analyze root causes, and troubleshoot incidents using STAROps Agent via OpenAPI. - Supports querying workspace/service topology, APM metrics, traces, and triaging alerts. - Requires specific environment variables for execution (employee, workspace, UID), using Alibaba Cloud Credentials SDK for authentication. - Includes detailed setup, invocation instructions, thread management, and output integrity rules. - Emphasizes mandatory use of `--pipe` flag for structured output and reliable downstream parsing. - Provides troubleshooting guidance for common configuration and permission issues.","fileCount":7,"zipByteSize":17965}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s173swjet2yrebzqrp6hjkvmy583mxef:alibabacloud-starops-chat","setupComplexity":"low","setupSteps":["Install using `clawhub skill install s173swjet2yrebzqrp6hjkvmy583mxef:alibabacloud-starops-chat` in an isolated environment before connecting it to live workloads.","No published capability contract is available yet, so validate auth and request/response behavior manually.","Review the upstream CLAWHUB listing at https://clawhub.ai/sdk-team/alibabacloud-starops-chat before using production credentials."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-12T16:14:11.875Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sdk-team-alibabacloud-starops-chat/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:37:14.697Z","emptyReason":null},"readme":"Skill: Alibabacloud Starops Chat\n\nOwner: sdk-team\n\nSummary: Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topolo...\n\nTags: latest:0.0.2\n\nVersion history:\n\nv0.0.2 | 2026-06-22T09:13:42.449Z | auto\n\nalibabacloud-starops-chat 0.0.2\n\n- Added support for reading configuration from `.starops/config.json`, `~/.starops/config.json`, or a custom path via `--config`/`STAROPS_AGENT_CONFIG`\n- Environment variables and config file values can now both be used for required identifiers (`employeeId`, `workspace`, `uid`)\n- Additional optional config keys and command-line overrides: endpoint, project, timeout, idleTimeout\n- Pre-flight check and documentation updated for config file usage; config key names must be exact (no aliases)\n- Improved flexibility in how STAROps Agent connection details are supplied—makes setup easier for users and teams\n- Removed outdated `skill-card.md` documentation file\n\nv0.0.1 | 2026-05-18T12:54:41.187Z | auto\n\nInitial release of alibabacloud-starops-chat:\n\n- Provides diagnostic capability for Alibaba Cloud STAROps: root cause analysis, service error investigation, topology queries, and APM metrics inspection.\n- Uses STAROps Agent OpenAPI with mandatory streaming output (`--pipe`) and strict thread management for context preservation.\n- Requires pre-configured environment variables for employee, workspace, and account UID; enforces credential chain best practices.\n- Ensures output integrity by quoting/paraphrasing only STAROps-generated data and forbids fabrication or unsupported conclusions.\n- Includes troubleshooting steps for common configuration and authentication errors.\n\nv0.0.1-beta.1 | 2026-05-18T09:01:40.780Z | auto\n\nInitial beta release of Alibaba Cloud STAROps Agent diagnostic skill.\n\n- Enables users to diagnose service errors, analyze root causes, and troubleshoot incidents using STAROps Agent via OpenAPI.\n- Supports querying workspace/service topology, APM metrics, traces, and triaging alerts.\n- Requires specific environment variables for execution (employee, workspace, UID), using Alibaba Cloud Credentials SDK for authentication.\n- Includes detailed setup, invocation instructions, thread management, and output integrity rules.\n- Emphasizes mandatory use of `--pipe` flag for structured output and reliable downstream parsing.\n- Provides troubleshooting guidance for common configuration and permission issues.\n\nArchive index:\n\nArchive v0.0.2: 8 files, 21540 bytes\n\nFiles: references/acceptance-criteria.md (5119b), references/api-reference.md (2420b), references/ram-policies.md (2470b), scripts/call_starops_agent.py (39382b), scripts/requirements.txt (49b), skill-card.md (2743b), SKILL.md (12166b), _meta.json (144b)\n\nFile v0.0.2:SKILL.md\n\n---\nname: alibabacloud-starops-chat\ndescription: |\n Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topology, inspect APM metrics, and troubleshoot incidents through the STAROps Agent.\n Triggers: \"排查根因\", \"根因分析\", \"服务报错\", \"服务异常\", \"APM 服务\", \"workspace 服务\", \"STAROps\", \"AIOps 诊断\", \"链路追踪\", \"告警分析\".\n---\n\n# Alibaba Cloud STAROps Agent\n\nCall the Alibaba Cloud STAROps Agent through STAROps OpenAPI and receive a streaming diagnostic answer.\n\n## Scenario Description\n\nUse this skill when the user wants to:\n\n- Diagnose service errors or exceptions (root cause analysis)\n- Query workspace topology, service lists, or service metrics\n- Analyze APM traces, error rates, latency, or request volume\n- Triage alerts or investigate incidents\n- Ask questions about their STAROps workspace or services\n\n## Configuration\n\nThe script reads STAROps connection values from environment variables and optional JSON config files. Environment variables and command-line flags override config file values.\n\nConfig files are loaded in this order:\n\n1. User config: `~/.starops/config.json`\n2. Project config: `./.starops/config.json` (overrides user config)\n3. Explicit config: `--config ` or `STAROPS_AGENT_CONFIG` (overrides user/project config)\n\nThe three required values (`employeeId`, `workspace`, `uid`) may come from either environment variables or config files.\n\n| Variable | Required | Description |\n|----------|----------|-------------|\n| `STAROPS_AGENT_EMPLOYEE` | Yes, unless config provides `employeeId` | Digital Employee ID in STAROps (from console → Digital Employee list → ID column) |\n| `STAROPS_AGENT_WORKSPACE` | Yes, unless config provides `workspace` | Workspace identifier |\n| `STAROPS_AGENT_UID` | Yes, unless config provides `uid` | Alibaba Cloud account UID that owns the workspace |\n| `STAROPS_AGENT_ENDPOINT` | No | API endpoint (default: `starops.cn-beijing.aliyuncs.com`) |\n| `STAROPS_AGENT_PROJECT` | No | Optional STAROps project variable forwarded with each request. Overridden by `--project` |\n| `STAROPS_AGENT_TIMEOUT` | No | Default value for `--timeout` (CreateChat stream total timeout in seconds; default `1800`) |\n| `STAROPS_AGENT_IDLE_TIMEOUT` | No | Default value for `--idle-timeout` (max seconds to wait for the next SSE event; default `60`) |\n| `STAROPS_AGENT_CONFIG` | No | Path to an explicit JSON config file loaded after user/project config |\n\nMinimal config file example:\n\n```json\n{\n \"employeeId\": \"\",\n \"workspace\": \"\",\n \"uid\": \"\"\n}\n```\n\nOptional fields:\n\n```json\n{\n \"endpoint\": \"starops.cn-beijing.aliyuncs.com\",\n \"project\": \"optional-project\",\n \"timeout\": 1800,\n \"idleTimeout\": 60\n}\n```\n\nConfig files use the exact key names shown above. Do not use alternate aliases such as `employee`, `digitalEmployeeId`, `workspaceName`, or `accountUid`.\n\n**Pre-flight check — run this before invoking the script to confirm environment or config values are available:**\n\n```bash\nmissing=\"\"\n[ -z \"$STAROPS_AGENT_EMPLOYEE\" ] && missing=\"$missing STAROPS_AGENT_EMPLOYEE\"\n[ -z \"$STAROPS_AGENT_WORKSPACE\" ] && missing=\"$missing STAROPS_AGENT_WORKSPACE\"\n[ -z \"$STAROPS_AGENT_UID\" ] && missing=\"$missing STAROPS_AGENT_UID\"\nconfig_file_found=\"\"\n[ -f \".starops/config.json\" ] && config_file_found=1\n[ -f \"$HOME/.starops/config.json\" ] && config_file_found=1\n[ -n \"$STAROPS_AGENT_CONFIG\" ] && [ -f \"$STAROPS_AGENT_CONFIG\" ] && config_file_found=1\nif [ -n \"$missing\" ] && [ -z \"$config_file_found\" ]; then\n echo \"ERROR: Missing required environment variables:$missing and no STAROps config file was found\" >&2\n exit 1\nfi\necho \"OK: STAROps configuration is available from environment variables or config file\"\n```\n\nIf any required value is still unavailable, ask the user to provide it. Never substitute placeholder strings like `example-employee`.\n\nThe STAROps console link uses the same digital employee ID as `assistantId`.\n\nCredentials use the Alibaba Cloud Credentials default chain. Do not define skill-specific AccessKey variables; use standard Alibaba Cloud credential sources such as environment credentials (`ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET`), profiles, STS, RAM role, or instance metadata.\n\n## Invocation\n\n**IMPORTANT: The `--pipe` flag is MANDATORY for all invocations.** It ensures structured output with THREAD ID, STAROPS_URL, and delimited answer blocks that downstream agents can reliably parse. Never omit `--pipe`.\n\nInstall dependencies and run from this skill's root directory:\n\n```bash\npip3 install -r scripts/requirements.txt\n\n# First call - creates a new thread automatically\npython3 scripts/call_starops_agent.py --question \"\" --pipe\n\n# First call with an explicit config file\npython3 scripts/call_starops_agent.py --config \".starops/config.json\" --question \"\" --pipe\n\n# Follow-up calls - MUST reuse the thread ID from previous response\npython3 scripts/call_starops_agent.py --thread \"\" --question \"\" --pipe\n```\n\n**Thread Management:**\n- Extract thread ID from output\n- Use the printed `STAROPS_URL` when the user needs to inspect the same thread in the STAROps console\n- Always pass `--thread \"\"` for related follow-up questions to preserve context\n\nExample workflow:\n```bash\n# Query 1: Creates new thread\n$ python3 scripts/call_starops_agent.py --question \"Query TOP 5 error applications\" --pipe\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n...\n\n# Query 2: MUST reuse thread for context\n$ python3 scripts/call_starops_agent.py --thread \"thread-abc123-xyz\" --question \"Deep dive into notification app errors\" --pipe\n```\n\n## Command-Line Options\n\n| Flag | Description |\n|------|-------------|\n| `--question ` | **Required.** Natural-language question to send to STAROps Agent. |\n| `--thread ` | Existing STAROps thread ID. **Required for follow-up questions** to preserve investigation context. |\n| `--pipe` | **Mandatory for agent invocations.** Emit structured output with `THREAD`, `STAROPS_URL`, and `=== STAROPS ANSWER BEGIN/END ===` delimiters for reliable parsing. |\n| `--json` | Emit machine-readable JSONL events. Mutually exclusive with `--pipe`. **Do not use for agent invocations** — `--pipe` is the supported agent format. |\n| `--config ` | Optional JSON config file. Loaded after `~/.starops/config.json` and `./.starops/config.json`. |\n| `--project ` | Optional STAROps project variable. Overrides `STAROPS_AGENT_PROJECT`. |\n| `--timeout ` | Total CreateChat stream timeout in seconds. Overrides `STAROPS_AGENT_TIMEOUT` (default `1800`). |\n| `--idle-timeout ` | Maximum seconds to wait for the next SSE event before failing. Overrides `STAROPS_AGENT_IDLE_TIMEOUT` (default `60`). |\n\n## Behavioral Notes\n\n1. STAROps Agent calls are long-running by design. A single `CreateChat` stream may start multiple internal diagnostic steps and take minutes; the default timeout is 30 minutes.\n2. Provide complete context in one question: cloud account or workspace context, time range, service or application names, alert text, SLS project/logstore, UModel object, region, and what decision the user needs.\n3. **CRITICAL: Always reuse `--thread` for follow-ups in the same investigation. Starting a new thread discards all prior context and findings.**\n4. Use this skill for Agent reasoning and diagnosis, not direct resource management. For direct ECS, OSS, RDS, SLS, or RAM mutations, use the corresponding official CLI, SDK, or specialized skill.\n5. **MANDATORY: Always pass `--pipe`.** Tool-call status and streaming diagnosis-report chunks are written to stderr, while stdout keeps the reusable thread ID and final answer easy to parse. Omitting `--pipe` will produce unstructured output that cannot be reliably evaluated.\n6. If no SSE event arrives for a while, the script fails with a clear idle-timeout error instead of silently waiting for the full task timeout. Increase `--idle-timeout` only when the investigation is expected to be quiet for long periods.\n7. **Output integrity rule**: Your final report MUST be based on the actual content returned between `=== STAROPS ANSWER BEGIN ===` and `=== STAROPS ANSWER END ===`. Specifically:\n - Quote or paraphrase concrete data points from the STAROps response (HTTP status codes, service names, error paths, metrics).\n - Do NOT infer or fabricate diagnostic conclusions that are not supported by the STAROps output.\n - If the STAROps answer is empty (`(No assistant answer was returned.)`), incomplete, or only contains generic text, retry once using the same `--thread`. If the retry still yields no actionable data, report honestly: \"STAROps did not return actionable diagnostic data. Confirm that the workspace contains relevant services and data for the requested time range.\"\n - Never substitute your own prior knowledge for missing STAROps evidence. For example, do not claim \"database connection pool exhaustion\" if STAROps did not mention it.\n\n## Observability\n\nAll STAROps OpenAPI HTTP requests must use this User-Agent template declaration:\n\n```text\n--user-agent AlibabaCloud-Agent-Skills/{SKILL_NAME}/{session-id}\n```\n\nFor this skill, the concrete template is:\n\n```text\n--user-agent AlibabaCloud-Agent-Skills/alibabacloud-starops-chat/{session-id}\n```\n\nGenerate exactly one `session-id` per skill invocation as a 32-char hex value. If `SKILL_SESSION_ID` is already set, reuse that value after validating it is 32 hex characters; otherwise generate `uuid4().hex`, set `SKILL_SESSION_ID`, and reuse it for all outbound calls. The same `session-id` must be consistent across CLI/SDK/Terraform and direct HTTP requests made during the invocation, including both `CreateThread` and `CreateChat`; do not generate a new `session-id` per request. The Python script sets the HTTP `User-Agent` header to `AlibabaCloud-Agent-Skills/alibabacloud-starops-chat/{session-id}`.\n\n## Troubleshooting\n\nWhen the script exits with an error, check the following in order:\n\n1. **HTTP 401 Unauthorized** — The credential chain did not resolve to a valid identity with STAROps permissions. Verify that `ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET` (or STS / RAM role) are set and that the identity has `starops:CreateThread` and `starops:CreateChat` permissions. See [references/ram-policies.md](references/ram-policies.md).\n2. **HTTP 404 Not Found** — The Digital Employee ID (`STAROPS_AGENT_EMPLOYEE`) or workspace (`STAROPS_AGENT_WORKSPACE`) does not exist, or the UID (`STAROPS_AGENT_UID`) does not match the owning account. Double-check all three environment variables.\n3. **ConfigError: Missing required STAROps configuration values** — One or more of `employeeId`, `workspace`, or `uid` is missing from both environment variables and config files.\n4. **CredentialError** — The Alibaba Cloud Credentials SDK could not find any valid credential source. Ensure at least one credential provider is configured (environment variables, `~/.aliyun/config.json`, STS, RAM role, or instance metadata).\n5. **Idle timeout** — No SSE event was received within `--idle-timeout` seconds (default 60). The STAROps Agent may be stalled. Retry with the same `--thread` if a THREAD line was printed, or increase `--idle-timeout` for investigations expected to be quiet.\n6. **Stream interruption / network error** — The HTTPS connection was reset or timed out. Retry the same request with `--thread` to resume context.\n7. **ModuleNotFoundError** — Python dependency not installed. Run `pip3 install -r scripts/requirements.txt` before invoking the script.\n\n## API Surface\n\nThis skill directly calls STAROps OpenAPI:\n\n- `CreateThread`: `POST /digitalEmployee/{employeeId}/thread`\n- `CreateChat`: `POST /chat`\n\nSee [references/api-reference.md](references/api-reference.md) and [references/ram-policies.md](references/ram-policies.md).\n\nFile v0.0.2:_meta.json\n\n{\n \"ownerId\": \"kn74p5w8ywv6prh40g0s82gmqh83nw54\",\n \"slug\": \"alibabacloud-starops-chat\",\n \"version\": \"0.0.2\",\n \"publishedAt\": 1782119622449\n}\n\nFile v0.0.2:references/acceptance-criteria.md\n\n# Acceptance Criteria: alibabacloud-starops-chat\n\n**Scenario**: STAROps Agent AIOps Diagnostic Skill\n**Purpose**: Skill testing acceptance criteria\n\n---\n\n## Correct Script Invocation Patterns\n\n### 1. Command Format — mandatory flags\n\n#### CORRECT\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"Help me investigate the root cause of inventory service errors\" \\\n --pipe\n```\n\n#### INCORRECT — Missing `--pipe`\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"Help me investigate the root cause of inventory service errors\"\n```\n\n**Why**: `--pipe` is mandatory. Without it, the script outputs in CLI mode, which lacks `=== STAROPS ANSWER BEGIN ===` delimiters and produces unstructured output that cannot be reliably parsed.\n\n#### INCORRECT — Missing `--question`\n\n```bash\npython3 scripts/call_starops_agent.py --pipe\n```\n\n**Why**: `--question` is a required parameter. The script will exit with an argument error.\n\n### 2. Thread Reuse — follow-up questions\n\n#### CORRECT — Reusing thread ID for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"How many APM services are in the current workspace?\" --pipe\n# Output: THREAD: thread-abc123-xyz\n\n# Follow-up call with --thread\npython3 scripts/call_starops_agent.py \\\n --thread \"thread-abc123-xyz\" \\\n --question \"Which service has the highest error rate?\" --pipe\n```\n\n#### INCORRECT — New thread for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"How many APM services are in the current workspace?\" --pipe\n\n# Follow-up WITHOUT --thread — loses all prior context\npython3 scripts/call_starops_agent.py \\\n --question \"Which service has the highest error rate?\" --pipe\n```\n\n**Why**: Omitting `--thread` creates a new conversation. The STAROps Agent loses all prior investigation context and findings.\n\n### 3. Dependency Installation\n\n#### CORRECT — Install from scripts/requirements.txt\n\n```bash\npip3 install -r scripts/requirements.txt\n```\n\n#### INCORRECT — Using `uv` or wrong path\n\n```bash\nuv run scripts/call_starops_agent.py --question \"...\" --pipe\npip3 install -r requirements.txt\n```\n\n**Why**: `uv` is not available in all environments. `requirements.txt` is located under `scripts/`, not the project root.\n\n### 4. Environment Variables or Config File — required before invocation\n\n#### CORRECT — All required variables set\n\n```bash\nexport STAROPS_AGENT_EMPLOYEE=\"\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\nexport STAROPS_AGENT_UID=\"\"\n```\n\n#### CORRECT — Project config file supplies required values\n\n```bash\nmkdir -p .starops\ncat > .starops/config.json <<'JSON'\n{\n \"employeeId\": \"\",\n \"workspace\": \"rca-benchmark\",\n \"uid\": \"\"\n}\nJSON\n\npython3 scripts/call_starops_agent.py \\\n --question \"How many APM services are in the current workspace?\" \\\n --pipe\n```\n\n**Why**: The script loads `~/.starops/config.json` first, then `./.starops/config.json`, so project-level values override user-level defaults. Environment variables still override config file values.\n\n#### INCORRECT — Missing required variables\n\n```bash\n# Missing STAROPS_AGENT_UID\nexport STAROPS_AGENT_EMPLOYEE=\"\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\n# No ~/.starops/config.json, ./.starops/config.json, or STAROPS_AGENT_CONFIG fallback\n```\n\n**Why**: The script requires all three values (`employeeId`, `workspace`, `uid`) from environment variables or config files. Missing any of them produces a `ConfigError`.\n\n### 5. Authentication — credential security\n\n#### CORRECT — Use Alibaba Cloud Credentials default chain\n\nCredentials are read automatically from environment variables (`ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET`), STS, CLI profile, or instance metadata.\n\n#### INCORRECT — Printing or exposing credentials\n\n```bash\necho $ALIBABA_CLOUD_ACCESS_KEY_ID\nenv | grep -i access_key\ncat ~/.aliyun/config.json\n```\n\n**Why**: Credential values must never appear in script output, logs, or conversation. The `forbidden` checks in eval scenarios reject any output containing `accessKeyId=` or `accessKeySecret=`.\n\n### 6. Output Parsing — structured pipe output\n\n#### CORRECT — Extracting from pipe mode output\n\n```text\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n(diagnostic answer content)\n=== STAROPS ANSWER END ===\n```\n\nThe agent should extract:\n- `THREAD` line for thread ID reuse\n- `STAROPS_URL` line for console link\n- Content between `=== STAROPS ANSWER BEGIN ===` and `=== STAROPS ANSWER END ===` as the final answer\n\n#### INCORRECT — Forwarding raw stderr or fabricating results\n\nDirectly copying stderr tool-status lines (e.g., `[tool:started] query_metrics`) into the output, or fabricating diagnostic data when the API call fails.\n\n**Why**: stderr contains progress indicators for human visibility. Only stdout pipe-mode output is authoritative. If the API fails, report the error; do not invent results.\n\nFile v0.0.2:references/api-reference.md\n\n# STAROps Agent API Reference\n\nThis skill uses STAROps OpenAPI version `2026-04-28` with ACS3-HMAC-SHA256 signing.\n\n## Authentication\n\nRequests are signed with Alibaba Cloud Credentials default-chain credentials. The Python script builds the ACS3 canonical request, signs it with `ACS3-HMAC-SHA256`, and sends HTTPS requests directly.\n\nThe default endpoint is:\n\n```text\nstarops.cn-beijing.aliyuncs.com\n```\n\nOverride with `STAROPS_AGENT_ENDPOINT` when a different endpoint is required.\n\n## CreateThread\n\n```http\nPOST /digitalEmployee/{employeeId}/thread\n```\n\nBody:\n\n```json\n{\n \"title\": \"short question title\",\n \"idempotencyKey\": \"uuid\",\n \"variables\": {\n \"workspace\": \"workspace-name\",\n \"project\": \"optional-project\"\n },\n \"attributes\": {\n \"source\": \"alibabacloud-starops-chat\"\n }\n}\n```\n\nExpected response field:\n\n```json\n{\n \"threadId\": \"thread-id\"\n}\n```\n\n## CreateChat\n\n```http\nPOST /chat\n```\n\nBody:\n\n```json\n{\n \"action\": \"create\",\n \"digitalEmployeeName\": \"employee-id\",\n \"threadId\": \"thread-id\",\n \"messages\": [\n {\n \"messageId\": \"uuid\",\n \"role\": \"user\",\n \"contents\": [\n {\n \"type\": \"text\",\n \"value\": \"user question\"\n }\n ]\n }\n ],\n \"variables\": {\n \"workspace\": \"workspace-name\"\n }\n}\n```\n\nThe response is an SSE stream whose `data:` payloads contain STAROps `messages`. The script stops when the stream emits a `done` message or a `task_finished` event, and it always closes the streaming HTTP response before exiting.\n\n## Output Modes\n\nJSONL mode emits structured records:\n\n```jsonl\n{\"type\":\"thread\",\"thread_id\":\"thread-id\",\"starops_url\":\"https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\"}\n{\"type\":\"message\",\"role\":\"assistant\",\"content\":\"answer\"}\n{\"type\":\"done\",\"thread_id\":\"thread-id\",\"status\":\"completed\"}\n```\n\nPipe mode emits:\n\n```text\nTHREAD: thread-id\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\nanswer\n=== STAROPS ANSWER END ===\n```\n\nThe console URL uses the same digital employee ID as `assistantId`.\n\nPipe mode writes progress to stderr, including tool status lines such as:\n\n```text\n[tool:started] query_metrics\n[tool:running] generate_diagnosis_report\n[tool:done] query_metrics\n```\n\n`generate_diagnosis_report` text chunks are also mirrored to stderr for live visibility and included in the final stdout answer block.\n\nFile v0.0.2:references/ram-policies.md\n\n# STAROps RAM Policy Notes\n\nThis skill does not use STAROps-specific AccessKey environment variables. It relies on Alibaba Cloud Credentials default-chain behavior, so credentials should be configured through standard Alibaba Cloud mechanisms.\n\n## Required Access\n\nGrant the caller the following STAROps actions:\n\n| Action | Description |\n|--------|-------------|\n| `starops:CreateThread` | Create an investigation thread |\n| `starops:CreateChat` | Send a message and stream the agent response |\n\nResource ARN format:\n\n```\nacs:starops::{uid}:digitalemployee/{employeeId}\n```\n\n### Example Custom Policy\n\n```json\n{\n \"Version\": \"1\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"starops:CreateThread\",\n \"starops:CreateChat\"\n ],\n \"Resource\": \"acs:starops::*:digitalemployee/*\"\n }\n ]\n}\n```\n\nTo restrict access to a specific account and digital employee, replace `*` with concrete values, e.g. `acs:starops:::digitalemployee/`.\n\n## Recommended Credential Sources\n\nUse one of the Alibaba Cloud Credentials default-chain sources:\n\n- Standard Alibaba Cloud AccessKey environment credentials.\n- Alibaba Cloud CLI profile or shared credentials profile.\n- STS credentials.\n- RAM role credentials.\n- ECS instance metadata credentials, when available.\n\nFor local development environments where metadata lookup causes delays, set:\n\n```bash\nexport ALIBABA_CLOUD_ECS_METADATA_DISABLED=true\n```\n\n## Security Boundaries\n\nThis skill creates STAROps investigation threads and streams STAROps Agent answers. It does not directly mutate ECS, OSS, RDS, SLS, or other cloud resources. Any operational action proposed by STAROps should still be reviewed according to the user's normal change-management process.\n\n## Permission Failure Handling\n\nWhen the script returns an HTTP 401 or 403 error indicating an authorization failure:\n\n1. Stop immediately. Do **not** retry with different credentials or fabricate diagnostic results.\n2. Report the exact error message to the user, including the `Action` and `Resource` from the error response.\n3. Direct the user to check that their identity has the required STAROps permissions listed in the **Required Access** section above.\n4. If using STS credentials, verify that the STS token has not expired and that the assumed role's policy includes `starops:CreateThread` and `starops:CreateChat`.\n5. Wait for the user to confirm that permissions have been granted before retrying.\n\nFile v0.0.2:scripts/requirements.txt\n\nalibabacloud-credentials==1.0.8\nrequests==2.32.4\n\nFile v0.0.2:skill-card.md\n\n## Description:
\nAlibaba Cloud STAROps Agent AIOps diagnostic skill for diagnosing service errors, root causes, workspace topology, service metrics, APM signals, and incidents through STAROps Agent.
\n\nThis skill is ready for commercial/non-commercial use.
\n\n## Publisher:
\n[sdk-team](https://clawhub.ai/user/sdk-team)
\n\n### License/Terms of Use:
\nMIT-0
\n\n\n## Use Case:
\nDevelopers, SREs, and operations teams use this skill to ask STAROps diagnostic questions, create or continue investigation threads, and receive structured answers for incident triage. The skill is for diagnosis and evidence gathering, not direct cloud resource management.
\n\n### Deployment Geography for Use:
\nGlobal
\n\n## Known Risks and Mitigations:
\nRisk: The skill lets an agent query STAROps using the caller's Alibaba Cloud credential chain.
\nMitigation: Use least-privilege RAM permissions limited to starops:CreateThread and starops:CreateChat, and confirm the configured endpoint, workspace, employee ID, and UID before running.
\nRisk: STAROps diagnostic output may contain sensitive operational data.
\nMitigation: Treat returned findings, metrics, topology, traces, and incident details as sensitive and share or store them only according to the user's operational security policy.
\nRisk: Diagnostic conclusions can be misleading if they are not grounded in the returned STAROps answer.
\nMitigation: Base final reports only on content between the STAROPS ANSWER delimiters, retry once on empty or generic results with the same thread, and report honestly when STAROps returns no actionable data.
\n\n\n## Reference(s):
\n- [ClawHub package page](https://clawhub.ai/sdk-team/alibabacloud-starops-chat)
\n- [STAROps Agent API Reference](references/api-reference.md)
\n- [STAROps RAM Policy Notes](references/ram-policies.md)
\n- [Acceptance Criteria](references/acceptance-criteria.md)
\n\n\n## Skill Output:
\n**Output Type(s):** [text, shell commands, guidance]
\n**Output Format:** [Structured pipe output with THREAD, STAROPS_URL, and delimited diagnostic answer text; JSONL is available only when explicitly requested.]
\n**Output Parameters:** [1D]
\n**Other Properties Related to Output:** [Requires STAROps configuration, Alibaba Cloud credential-chain credentials, and the --pipe flag for agent invocations.]
\n\n## Skill Version(s):
\n0.0.2 (source: server release metadata)
\n\n## Ethical Considerations:
\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.
\n\nArchive v0.0.1: 8 files, 19351 bytes\n\nFiles: references/acceptance-criteria.md (4377b), references/api-reference.md (2494b), references/ram-policies.md (2508b), scripts/call_starops_agent.py (33959b), scripts/requirements.txt (49b), skill-card.md (2743b), SKILL.md (9315b), _meta.json (144b)\n\nFile v0.0.1:SKILL.md\n\n---\nname: alibabacloud-starops-chat\ndescription: |\n Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topology, inspect APM metrics, and troubleshoot incidents through the STAROps Agent.\n Triggers: \"排查根因\", \"根因分析\", \"服务报错\", \"服务异常\", \"APM 服务\", \"workspace 服务\", \"STAROps\", \"AIOps 诊断\", \"链路追踪\", \"告警分析\".\n---\n\n# Alibaba Cloud STAROps Agent\n\nCall the Alibaba Cloud STAROps Agent through STAROps OpenAPI and receive a streaming diagnostic answer.\n\n## Scenario Description\n\nUse this skill when the user wants to:\n\n- Diagnose service errors or exceptions (root cause analysis)\n- Query workspace topology, service lists, or service metrics\n- Analyze APM traces, error rates, latency, or request volume\n- Triage alerts or investigate incidents\n- Ask questions about their STAROps workspace or services\n\n## Environment Variables\n\nThe script reads the following environment variables. They are typically **pre-configured by the execution platform** — verify they are set before running; do **not** overwrite them with placeholder values.\n\n| Variable | Required | Description | How to obtain |\n|----------|----------|-------------|---------------|\n| `STAROPS_AGENT_EMPLOYEE` | Yes | Digital employee name in STAROps | STAROps console → Digital Employee list → name column |\n| `STAROPS_AGENT_WORKSPACE` | Yes | Workspace identifier | STAROps console → Workspace settings → workspace name |\n| `STAROPS_AGENT_UID` | Yes | Alibaba Cloud account UID that owns the workspace | Alibaba Cloud console → Account Management → Account ID |\n| `STAROPS_AGENT_ENDPOINT` | No | API endpoint (default: `starops..aliyuncs.com`) | Use default unless a private or custom endpoint is required |\n| `STAROPS_AGENT_REGION` | No | Region (default: `cn-beijing`) | STAROps is centrally deployed; use `cn-beijing` for all regions |\n\n### Environment Setup\n\nIf the variables are not pre-configured by the platform, set them manually before running the script:\n\n```bash\nexport STAROPS_AGENT_EMPLOYEE=\"\"\nexport STAROPS_AGENT_WORKSPACE=\"\"\nexport STAROPS_AGENT_UID=\"\"\n```\n\n**Credentials** — The script uses the Alibaba Cloud Credentials SDK default chain. Configure one of the following (in priority order):\n\n1. **STS token** — Recommended for CI/sandbox. The platform injects STS credentials via `~/.aliyun/config.json` or environment.\n2. **RAM role** — For ECS/container workloads with instance metadata.\n3. **CLI profile** — Run `aliyun configure` to create a profile in `~/.aliyun/config.json`.\n4. **Environment variables** — Set `ALIBABA_CLOUD_ACCESS_KEY_ID` and `ALIBABA_CLOUD_ACCESS_KEY_SECRET` (least preferred; avoid in production).\n\nDo not define skill-specific AccessKey variables; the credential SDK handles resolution automatically.\n\n**Pre-flight check — run this before invoking the script to confirm the variables are set:**\n\n```bash\nmissing=\"\"\n[ -z \"$STAROPS_AGENT_EMPLOYEE\" ] && missing=\"$missing STAROPS_AGENT_EMPLOYEE\"\n[ -z \"$STAROPS_AGENT_WORKSPACE\" ] && missing=\"$missing STAROPS_AGENT_WORKSPACE\"\n[ -z \"$STAROPS_AGENT_UID\" ] && missing=\"$missing STAROPS_AGENT_UID\"\nif [ -n \"$missing\" ]; then echo \"ERROR: Missing required environment variables:$missing\" >&2; exit 1; fi\necho \"OK: EMPLOYEE=$STAROPS_AGENT_EMPLOYEE WORKSPACE=$STAROPS_AGENT_WORKSPACE UID=$STAROPS_AGENT_UID\"\n```\n\nIf any required variable is empty, **stop and ask the user** to provide the value. Never substitute placeholder strings like `example-employee`.\n\nThe STAROps console link uses the same digital employee ID as `assistantId`.\n\n## Invocation\n\n**IMPORTANT: The `--pipe` flag is MANDATORY for all invocations.** It ensures structured output with THREAD ID, STAROPS_URL, and delimited answer blocks that downstream agents can reliably parse. Never omit `--pipe`.\n\nInstall dependencies and run from this skill's root directory:\n\n```bash\npip3 install -r scripts/requirements.txt\n\n# First call - creates a new thread automatically\npython3 scripts/call_starops_agent.py --question \"\" --pipe\n\n# Follow-up calls - MUST reuse the thread ID from previous response\npython3 scripts/call_starops_agent.py --thread \"\" --question \"\" --pipe\n```\n\n**Thread Management:**\n- Extract thread ID from output\n- Use the printed `STAROPS_URL` when the user needs to inspect the same thread in the STAROps console\n- Always pass `--thread \"\"` for related follow-up questions to preserve context\n\nExample workflow:\n```bash\n# Query 1: Creates new thread\n$ python3 scripts/call_starops_agent.py --question \"Query TOP 5 error applications\" --pipe\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n...\n\n# Query 2: MUST reuse thread for context\n$ python3 scripts/call_starops_agent.py --thread \"thread-abc123-xyz\" --question \"Deep dive into notification app errors\" --pipe\n```\n\n## Behavioral Notes\n\n1. STAROps Agent calls are long-running by design. A single `CreateChat` stream may start multiple internal diagnostic steps and take minutes; the default timeout is 30 minutes.\n2. Provide complete context in one question: cloud account or workspace context, time range, service or application names, alert text, SLS project/logstore, UModel object, region, and what decision the user needs.\n3. **CRITICAL: Always reuse `--thread` for follow-ups in the same investigation. Starting a new thread discards all prior context and findings.**\n4. Use this skill for Agent reasoning and diagnosis, not direct resource management. For direct ECS, OSS, RDS, SLS, or RAM mutations, use the corresponding official CLI, SDK, or specialized skill.\n5. **MANDATORY: Always pass `--pipe`.** Tool-call status and streaming diagnosis-report chunks are written to stderr, while stdout keeps the reusable thread ID and final answer easy to parse. Omitting `--pipe` will produce unstructured output that cannot be reliably evaluated.\n6. If no SSE event arrives for a while, the script fails with a clear idle-timeout error instead of silently waiting for the full task timeout. Increase `--idle-timeout` only when the investigation is expected to be quiet for long periods.\n7. **Output integrity rule**: Your final report MUST be based on the actual content returned between `=== STAROPS ANSWER BEGIN ===` and `=== STAROPS ANSWER END ===`. Specifically:\n - Quote or paraphrase concrete data points from the STAROps response (HTTP status codes, service names, error paths, metrics).\n - Do NOT infer or fabricate diagnostic conclusions that are not supported by the STAROps output.\n - If the STAROps answer is empty (`(No assistant answer was returned.)`), incomplete, or only contains generic text, retry once using the same `--thread`. If the retry still yields no actionable data, report honestly: \"STAROps 未返回有效诊断数据，请确认 workspace 中是否存在相关服务和时间范围内的数据。\"\n - Never substitute your own prior knowledge for missing STAROps evidence. For example, do not claim \"database connection pool exhaustion\" if STAROps did not mention it.\n\n## Troubleshooting\n\nWhen the script exits with an error, check the following in order:\n\n1. **HTTP 401 Unauthorized** — The credential chain did not resolve to a valid identity with STAROps permissions. Verify that the Alibaba Cloud Credentials default chain can resolve a valid credential (STS token, RAM role, CLI profile, or instance metadata) and that the identity has `cms:CreateThread` and `cms:CreateChat` permissions. See [references/ram-policies.md](references/ram-policies.md).\n2. **HTTP 404 Not Found** — The digital employee name (`STAROPS_AGENT_EMPLOYEE`) or workspace (`STAROPS_AGENT_WORKSPACE`) does not exist, or the UID (`STAROPS_AGENT_UID`) does not match the owning account. Double-check all three environment variables.\n3. **ConfigError: Missing required STAROps environment variables** — One or more of `STAROPS_AGENT_EMPLOYEE`, `STAROPS_AGENT_WORKSPACE`, `STAROPS_AGENT_UID` is empty or unset.\n4. **CredentialError** — The Alibaba Cloud Credentials SDK could not find any valid credential source. Ensure at least one credential provider is configured (environment variables, `~/.aliyun/config.json`, STS, RAM role, or instance metadata).\n5. **Idle timeout** — No SSE event was received within `--idle-timeout` seconds (default 60). The STAROps Agent may be stalled. Retry with the same `--thread` if a THREAD line was printed, or increase `--idle-timeout` for investigations expected to be quiet.\n6. **Stream interruption / network error** — The HTTPS connection was reset or timed out. Retry the same request with `--thread` to resume context.\n7. **ModuleNotFoundError** — Python dependency not installed. Run `pip3 install -r scripts/requirements.txt` before invoking the script.\n\n## API Surface\n\nThis skill directly calls STAROps OpenAPI:\n\n- `CreateThread`: `POST /digitalEmployee/{name}/thread`\n- `CreateChat`: `POST /chat`\n\nSee [references/api-reference.md](references/api-reference.md) and [references/ram-policies.md](references/ram-policies.md).\n\nFile v0.0.1:_meta.json\n\n{\n \"ownerId\": \"kn74p5w8ywv6prh40g0s82gmqh83nw54\",\n \"slug\": \"alibabacloud-starops-chat\",\n \"version\": \"0.0.1\",\n \"publishedAt\": 1779108881187\n}\n\nFile v0.0.1:references/acceptance-criteria.md\n\n# Acceptance Criteria: alibabacloud-starops-chat\n\n**Scenario**: STAROps Agent AIOps Diagnostic Skill\n**Purpose**: Skill testing acceptance criteria\n\n---\n\n## Correct Script Invocation Patterns\n\n### 1. Command Format — mandatory flags\n\n#### CORRECT\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"帮我排查 inventory 服务报错的根因是什么\" \\\n --pipe\n```\n\n#### INCORRECT — Missing `--pipe`\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"帮我排查 inventory 服务报错的根因是什么\"\n```\n\n**Why**: `--pipe` is mandatory. Without it, the script outputs in CLI mode, which lacks `=== STAROPS ANSWER BEGIN ===` delimiters and produces unstructured output that cannot be reliably parsed.\n\n#### INCORRECT — Missing `--question`\n\n```bash\npython3 scripts/call_starops_agent.py --pipe\n```\n\n**Why**: `--question` is a required parameter. The script will exit with an argument error.\n\n### 2. Thread Reuse — follow-up questions\n\n#### CORRECT — Reusing thread ID for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"当前 workspace 中有多少个 APM 服务\" --pipe\n# Output: THREAD: thread-abc123-xyz\n\n# Follow-up call with --thread\npython3 scripts/call_starops_agent.py \\\n --thread \"thread-abc123-xyz\" \\\n --question \"其中哪个服务错误率最高\" --pipe\n```\n\n#### INCORRECT — New thread for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"当前 workspace 中有多少个 APM 服务\" --pipe\n\n# Follow-up WITHOUT --thread — loses all prior context\npython3 scripts/call_starops_agent.py \\\n --question \"其中哪个服务错误率最高\" --pipe\n```\n\n**Why**: Omitting `--thread` creates a new conversation. The STAROps Agent loses all prior investigation context and findings.\n\n### 3. Dependency Installation\n\n#### CORRECT — Install from scripts/requirements.txt\n\n```bash\npip3 install -r scripts/requirements.txt\n```\n\n#### INCORRECT — Using `uv` or wrong path\n\n```bash\nuv run scripts/call_starops_agent.py --question \"...\" --pipe\npip3 install -r requirements.txt\n```\n\n**Why**: `uv` is not available in all environments. `requirements.txt` is located under `scripts/`, not the project root.\n\n### 4. Environment Variables — required before invocation\n\n#### CORRECT — All required variables set\n\n```bash\nexport STAROPS_AGENT_EMPLOYEE=\"apsara-ops\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\nexport STAROPS_AGENT_UID=\"\"\n```\n\n#### INCORRECT — Missing required variables\n\n```bash\n# Missing STAROPS_AGENT_UID\nexport STAROPS_AGENT_EMPLOYEE=\"apsara-ops\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\n```\n\n**Why**: The script requires all three variables (`STAROPS_AGENT_EMPLOYEE`, `STAROPS_AGENT_WORKSPACE`, `STAROPS_AGENT_UID`). Missing any of them produces a `ConfigError`.\n\n### 5. Authentication — credential security\n\n#### CORRECT — Use Alibaba Cloud Credentials default chain\n\nCredentials are read automatically from environment variables (`ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET`), STS, CLI profile, or instance metadata.\n\n#### INCORRECT — Printing or exposing credentials\n\n```bash\necho $ALIBABA_CLOUD_ACCESS_KEY_ID\nenv | grep -i access_key\ncat ~/.aliyun/config.json\n```\n\n**Why**: Credential values must never appear in script output, logs, or conversation. The `forbidden` checks in eval scenarios reject any output containing `accessKeyId=` or `accessKeySecret=`.\n\n### 6. Output Parsing — structured pipe output\n\n#### CORRECT — Extracting from pipe mode output\n\n```text\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n(diagnostic answer content)\n=== STAROPS ANSWER END ===\n```\n\nThe agent should extract:\n- `THREAD` line for thread ID reuse\n- `STAROPS_URL` line for console link\n- Content between `=== STAROPS ANSWER BEGIN ===` and `=== STAROPS ANSWER END ===` as the final answer\n\n#### INCORRECT — Forwarding raw stderr or fabricating results\n\nDirectly copying stderr tool-status lines (e.g., `[tool:started] query_metrics`) into the output, or fabricating diagnostic data when the API call fails.\n\n**Why**: stderr contains progress indicators for human visibility. Only stdout pipe-mode output is authoritative. If the API fails, report the error; do not invent results.\n\nFile v0.0.1:references/api-reference.md\n\n# STAROps Agent API Reference\n\nThis skill uses STAROps OpenAPI version `2026-04-28` with ACS3-HMAC-SHA256 signing.\n\n## Authentication\n\nRequests are signed with Alibaba Cloud Credentials default-chain credentials. The Python script builds the ACS3 canonical request, signs it with `ACS3-HMAC-SHA256`, and sends HTTPS requests directly.\n\nThe default endpoint is derived from the region:\n\n```text\nstarops..aliyuncs.com\n```\n\nOverride with `STAROPS_AGENT_ENDPOINT` when a different endpoint is required.\n\n## CreateThread\n\n```http\nPOST /digitalEmployee/{name}/thread\n```\n\nBody:\n\n```json\n{\n \"title\": \"short question title\",\n \"idempotencyKey\": \"uuid\",\n \"variables\": {\n \"workspace\": \"workspace-name\",\n \"region\": \"cn-beijing\",\n \"project\": \"optional-project\"\n },\n \"attributes\": {\n \"source\": \"alibabacloud-starops-chat\"\n }\n}\n```\n\nExpected response field:\n\n```json\n{\n \"threadId\": \"thread-id\"\n}\n```\n\n## CreateChat\n\n```http\nPOST /chat\n```\n\nBody:\n\n```json\n{\n \"action\": \"create\",\n \"digitalEmployeeName\": \"employee-name\",\n \"threadId\": \"thread-id\",\n \"messages\": [\n {\n \"messageId\": \"uuid\",\n \"role\": \"user\",\n \"contents\": [\n {\n \"type\": \"text\",\n \"value\": \"user question\"\n }\n ]\n }\n ],\n \"variables\": {\n \"workspace\": \"workspace-name\",\n \"region\": \"cn-beijing\"\n }\n}\n```\n\nThe response is an SSE stream whose `data:` payloads contain STAROps `messages`. The script stops when the stream emits a `done` message or a `task_finished` event, and it always closes the streaming HTTP response before exiting.\n\n## Output Modes\n\nJSONL mode emits structured records:\n\n```jsonl\n{\"type\":\"thread\",\"thread_id\":\"thread-id\",\"starops_url\":\"https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\"}\n{\"type\":\"message\",\"role\":\"assistant\",\"content\":\"answer\"}\n{\"type\":\"done\",\"thread_id\":\"thread-id\",\"status\":\"completed\"}\n```\n\nPipe mode emits:\n\n```text\nTHREAD: thread-id\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\nanswer\n=== STAROPS ANSWER END ===\n```\n\nThe console URL uses the same digital employee ID as `assistantId`.\n\nPipe mode writes progress to stderr, including tool status lines such as:\n\n```text\n[tool:started] query_metrics\n[tool:running] generate_diagnosis_report\n[tool:done] query_metrics\n```\n\n`generate_diagnosis_report` text chunks are also mirrored to stderr for live visibility and included in the final stdout answer block.\n\nFile v0.0.1:references/ram-policies.md\n\n# STAROps RAM Policy Notes\n\nThis skill does not use STAROps-specific AccessKey environment variables. It relies on Alibaba Cloud Credentials default-chain behavior, so credentials should be configured through standard Alibaba Cloud mechanisms.\n\n## Required Access\n\nThe STAROps OpenAPI actions are registered under the **`cms`** service code. Grant the caller the following actions:\n\n| Action | Description |\n|--------|-------------|\n| `cms:CreateThread` | Create an investigation thread |\n| `cms:CreateChat` | Send a message and stream the agent response |\n\nResource ARN format:\n\n```\nacs:cms::{uid}:digitalemployee/{employee_name}\n```\n\n### Example Custom Policy\n\n```json\n{\n \"Version\": \"1\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"cms:CreateThread\",\n \"cms:CreateChat\"\n ],\n \"Resource\": \"acs:cms::*:digitalemployee/*\"\n }\n ]\n}\n```\n\nTo restrict access to a specific account and digital employee, replace `*` with concrete values, e.g. `acs:cms:::digitalemployee/`.\n\n## Recommended Credential Sources\n\nUse one of the Alibaba Cloud Credentials default-chain sources:\n\n- Standard Alibaba Cloud AccessKey environment credentials.\n- Alibaba Cloud CLI profile or shared credentials profile.\n- STS credentials.\n- RAM role credentials.\n- ECS instance metadata credentials, when available.\n\nFor local development environments where metadata lookup causes delays, set:\n\n```bash\nexport ALIBABA_CLOUD_ECS_METADATA_DISABLED=true\n```\n\n## Security Boundaries\n\nThis skill creates STAROps investigation threads and streams STAROps Agent answers. It does not directly mutate ECS, OSS, RDS, SLS, or other cloud resources. Any operational action proposed by STAROps should still be reviewed according to the user's normal change-management process.\n\n## Permission Failure Handling\n\nWhen the script returns an HTTP 401 or 403 error indicating an authorization failure:\n\n1. Stop immediately. Do **not** retry with different credentials or fabricate diagnostic results.\n2. Report the exact error message to the user, including the `Action` and `Resource` from the error response.\n3. Direct the user to check that their identity has the required STAROps permissions listed in the **Required Access** section above.\n4. If using STS credentials, verify that the STS token has not expired and that the assumed role's policy includes `cms:CreateThread` and `cms:CreateChat`.\n5. Wait for the user to confirm that permissions have been granted before retrying.\n\nFile v0.0.1:scripts/requirements.txt\n\nalibabacloud-credentials==1.0.8\nrequests==2.32.4\n\nFile v0.0.1:skill-card.md\n\n## Description:
\nAlibaba Cloud STAROps Agent AIOps diagnostic skill for diagnosing service errors, analyzing root causes, querying workspace or service topology, inspecting APM metrics, and troubleshooting incidents through the STAROps Agent.
\n\nThis skill is ready for commercial/non-commercial use.
\n\n## Publisher:
\n[sdk-team](https://clawhub.ai/user/sdk-team)
\n\n### License/Terms of Use:
\nMIT-0
\n\n\n## Use Case:
\nDevelopers, SREs, and incident responders use this skill to ask Alibaba Cloud STAROps diagnostic questions about service errors, topology, APM metrics, traces, and alerts using their configured Alibaba Cloud identity.
\n\n### Deployment Geography for Use:
\nGlobal
\n\n## Known Risks and Mitigations:
\nRisk: Diagnostic questions, workspace identifiers, project context, and incident details are sent to Alibaba Cloud STAROps under the user's Alibaba Cloud credentials.
\nMitigation: Send only the diagnostic context needed for the investigation, avoid secrets in prompts, and verify which Alibaba Cloud identity is active before use.
\nRisk: The skill uses local Alibaba Cloud credential resolution and can create STAROps investigation threads and chats.
\nMitigation: Use least-privilege RAM or STS credentials limited to the required STAROps actions, and protect thread IDs, STAROPS_URL values, credentials, and logs as sensitive.
\nRisk: Incident conclusions may be unreliable if the STAROps response is empty, incomplete, or outside the delimited answer block.
\nMitigation: Base reports only on content returned between the STAROPS ANSWER delimiters, retry once with the same thread when needed, and report honestly when STAROps returns no actionable data.
\n\n\n## Reference(s):
\n- [STAROps Agent API Reference](artifact/references/api-reference.md)
\n- [STAROps RAM Policy Notes](artifact/references/ram-policies.md)
\n- [Acceptance Criteria](artifact/references/acceptance-criteria.md)
\n\n\n## Skill Output:
\n**Output Type(s):** [Text, Markdown, Shell commands, Configuration, Guidance]
\n**Output Format:** [Markdown guidance with shell commands and STAROps pipe-output excerpts]
\n**Output Parameters:** [1D]
\n**Other Properties Related to Output:** [Pipe mode returns THREAD, STAROPS_URL, and delimited STAROps answer blocks; progress status may be written separately to stderr.]
\n\n## Skill Version(s):
\n0.0.1 (source: server release metadata)
\n\n## Ethical Considerations:
\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.
\n\nArchive v0.0.1-beta.1: 7 files, 17965 bytes\n\nFiles: references/acceptance-criteria.md (4377b), references/api-reference.md (2494b), references/ram-policies.md (2508b), scripts/call_starops_agent.py (33959b), scripts/requirements.txt (49b), SKILL.md (9315b), _meta.json (151b)\n\nFile v0.0.1-beta.1:SKILL.md\n\n---\nname: alibabacloud-starops-chat\ndescription: |\n Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topology, inspect APM metrics, and troubleshoot incidents through the STAROps Agent.\n Triggers: \"排查根因\", \"根因分析\", \"服务报错\", \"服务异常\", \"APM 服务\", \"workspace 服务\", \"STAROps\", \"AIOps 诊断\", \"链路追踪\", \"告警分析\".\n---\n\n# Alibaba Cloud STAROps Agent\n\nCall the Alibaba Cloud STAROps Agent through STAROps OpenAPI and receive a streaming diagnostic answer.\n\n## Scenario Description\n\nUse this skill when the user wants to:\n\n- Diagnose service errors or exceptions (root cause analysis)\n- Query workspace topology, service lists, or service metrics\n- Analyze APM traces, error rates, latency, or request volume\n- Triage alerts or investigate incidents\n- Ask questions about their STAROps workspace or services\n\n## Environment Variables\n\nThe script reads the following environment variables. They are typically **pre-configured by the execution platform** — verify they are set before running; do **not** overwrite them with placeholder values.\n\n| Variable | Required | Description | How to obtain |\n|----------|----------|-------------|---------------|\n| `STAROPS_AGENT_EMPLOYEE` | Yes | Digital employee name in STAROps | STAROps console → Digital Employee list → name column |\n| `STAROPS_AGENT_WORKSPACE` | Yes | Workspace identifier | STAROps console → Workspace settings → workspace name |\n| `STAROPS_AGENT_UID` | Yes | Alibaba Cloud account UID that owns the workspace | Alibaba Cloud console → Account Management → Account ID |\n| `STAROPS_AGENT_ENDPOINT` | No | API endpoint (default: `starops..aliyuncs.com`) | Use default unless a private or custom endpoint is required |\n| `STAROPS_AGENT_REGION` | No | Region (default: `cn-beijing`) | STAROps is centrally deployed; use `cn-beijing` for all regions |\n\n### Environment Setup\n\nIf the variables are not pre-configured by the platform, set them manually before running the script:\n\n```bash\nexport STAROPS_AGENT_EMPLOYEE=\"\"\nexport STAROPS_AGENT_WORKSPACE=\"\"\nexport STAROPS_AGENT_UID=\"\"\n```\n\n**Credentials** — The script uses the Alibaba Cloud Credentials SDK default chain. Configure one of the following (in priority order):\n\n1. **STS token** — Recommended for CI/sandbox. The platform injects STS credentials via `~/.aliyun/config.json` or environment.\n2. **RAM role** — For ECS/container workloads with instance metadata.\n3. **CLI profile** — Run `aliyun configure` to create a profile in `~/.aliyun/config.json`.\n4. **Environment variables** — Set `ALIBABA_CLOUD_ACCESS_KEY_ID` and `ALIBABA_CLOUD_ACCESS_KEY_SECRET` (least preferred; avoid in production).\n\nDo not define skill-specific AccessKey variables; the credential SDK handles resolution automatically.\n\n**Pre-flight check — run this before invoking the script to confirm the variables are set:**\n\n```bash\nmissing=\"\"\n[ -z \"$STAROPS_AGENT_EMPLOYEE\" ] && missing=\"$missing STAROPS_AGENT_EMPLOYEE\"\n[ -z \"$STAROPS_AGENT_WORKSPACE\" ] && missing=\"$missing STAROPS_AGENT_WORKSPACE\"\n[ -z \"$STAROPS_AGENT_UID\" ] && missing=\"$missing STAROPS_AGENT_UID\"\nif [ -n \"$missing\" ]; then echo \"ERROR: Missing required environment variables:$missing\" >&2; exit 1; fi\necho \"OK: EMPLOYEE=$STAROPS_AGENT_EMPLOYEE WORKSPACE=$STAROPS_AGENT_WORKSPACE UID=$STAROPS_AGENT_UID\"\n```\n\nIf any required variable is empty, **stop and ask the user** to provide the value. Never substitute placeholder strings like `example-employee`.\n\nThe STAROps console link uses the same digital employee ID as `assistantId`.\n\n## Invocation\n\n**IMPORTANT: The `--pipe` flag is MANDATORY for all invocations.** It ensures structured output with THREAD ID, STAROPS_URL, and delimited answer blocks that downstream agents can reliably parse. Never omit `--pipe`.\n\nInstall dependencies and run from this skill's root directory:\n\n```bash\npip3 install -r scripts/requirements.txt\n\n# First call - creates a new thread automatically\npython3 scripts/call_starops_agent.py --question \"\" --pipe\n\n# Follow-up calls - MUST reuse the thread ID from previous response\npython3 scripts/call_starops_agent.py --thread \"\" --question \"\" --pipe\n```\n\n**Thread Management:**\n- Extract thread ID from output\n- Use the printed `STAROPS_URL` when the user needs to inspect the same thread in the STAROps console\n- Always pass `--thread \"\"` for related follow-up questions to preserve context\n\nExample workflow:\n```bash\n# Query 1: Creates new thread\n$ python3 scripts/call_starops_agent.py --question \"Query TOP 5 error applications\" --pipe\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n...\n\n# Query 2: MUST reuse thread for context\n$ python3 scripts/call_starops_agent.py --thread \"thread-abc123-xyz\" --question \"Deep dive into notification app errors\" --pipe\n```\n\n## Behavioral Notes\n\n1. STAROps Agent calls are long-running by design. A single `CreateChat` stream may start multiple internal diagnostic steps and take minutes; the default timeout is 30 minutes.\n2. Provide complete context in one question: cloud account or workspace context, time range, service or application names, alert text, SLS project/logstore, UModel object, region, and what decision the user needs.\n3. **CRITICAL: Always reuse `--thread` for follow-ups in the same investigation. Starting a new thread discards all prior context and findings.**\n4. Use this skill for Agent reasoning and diagnosis, not direct resource management. For direct ECS, OSS, RDS, SLS, or RAM mutations, use the corresponding official CLI, SDK, or specialized skill.\n5. **MANDATORY: Always pass `--pipe`.** Tool-call status and streaming diagnosis-report chunks are written to stderr, while stdout keeps the reusable thread ID and final answer easy to parse. Omitting `--pipe` will produce unstructured output that cannot be reliably evaluated.\n6. If no SSE event arrives for a while, the script fails with a clear idle-timeout error instead of silently waiting for the full task timeout. Increase `--idle-timeout` only when the investigation is expected to be quiet for long periods.\n7. **Output integrity rule**: Your final report MUST be based on the actual content returned between `=== STAROPS ANSWER BEGIN ===` and `=== STAROPS ANSWER END ===`. Specifically:\n - Quote or paraphrase concrete data points from the STAROps response (HTTP status codes, service names, error paths, metrics).\n - Do NOT infer or fabricate diagnostic conclusions that are not supported by the STAROps output.\n - If the STAROps answer is empty (`(No assistant answer was returned.)`), incomplete, or only contains generic text, retry once using the same `--thread`. If the retry still yields no actionable data, report honestly: \"STAROps 未返回有效诊断数据，请确认 workspace 中是否存在相关服务和时间范围内的数据。\"\n - Never substitute your own prior knowledge for missing STAROps evidence. For example, do not claim \"database connection pool exhaustion\" if STAROps did not mention it.\n\n## Troubleshooting\n\nWhen the script exits with an error, check the following in order:\n\n1. **HTTP 401 Unauthorized** — The credential chain did not resolve to a valid identity with STAROps permissions. Verify that the Alibaba Cloud Credentials default chain can resolve a valid credential (STS token, RAM role, CLI profile, or instance metadata) and that the identity has `cms:CreateThread` and `cms:CreateChat` permissions. See [references/ram-policies.md](references/ram-policies.md).\n2. **HTTP 404 Not Found** — The digital employee name (`STAROPS_AGENT_EMPLOYEE`) or workspace (`STAROPS_AGENT_WORKSPACE`) does not exist, or the UID (`STAROPS_AGENT_UID`) does not match the owning account. Double-check all three environment variables.\n3. **ConfigError: Missing required STAROps environment variables** — One or more of `STAROPS_AGENT_EMPLOYEE`, `STAROPS_AGENT_WORKSPACE`, `STAROPS_AGENT_UID` is empty or unset.\n4. **CredentialError** — The Alibaba Cloud Credentials SDK could not find any valid credential source. Ensure at least one credential provider is configured (environment variables, `~/.aliyun/config.json`, STS, RAM role, or instance metadata).\n5. **Idle timeout** — No SSE event was received within `--idle-timeout` seconds (default 60). The STAROps Agent may be stalled. Retry with the same `--thread` if a THREAD line was printed, or increase `--idle-timeout` for investigations expected to be quiet.\n6. **Stream interruption / network error** — The HTTPS connection was reset or timed out. Retry the same request with `--thread` to resume context.\n7. **ModuleNotFoundError** — Python dependency not installed. Run `pip3 install -r scripts/requirements.txt` before invoking the script.\n\n## API Surface\n\nThis skill directly calls STAROps OpenAPI:\n\n- `CreateThread`: `POST /digitalEmployee/{name}/thread`\n- `CreateChat`: `POST /chat`\n\nSee [references/api-reference.md](references/api-reference.md) and [references/ram-policies.md](references/ram-policies.md).\n\nFile v0.0.1-beta.1:_meta.json\n\n{\n \"ownerId\": \"kn74p5w8ywv6prh40g0s82gmqh83nw54\",\n \"slug\": \"alibabacloud-starops-chat\",\n \"version\": \"0.0.1-beta.1\",\n \"publishedAt\": 1779094900780\n}\n\nFile v0.0.1-beta.1:references/acceptance-criteria.md\n\n# Acceptance Criteria: alibabacloud-starops-chat\n\n**Scenario**: STAROps Agent AIOps Diagnostic Skill\n**Purpose**: Skill testing acceptance criteria\n\n---\n\n## Correct Script Invocation Patterns\n\n### 1. Command Format — mandatory flags\n\n#### CORRECT\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"帮我排查 inventory 服务报错的根因是什么\" \\\n --pipe\n```\n\n#### INCORRECT — Missing `--pipe`\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"帮我排查 inventory 服务报错的根因是什么\"\n```\n\n**Why**: `--pipe` is mandatory. Without it, the script outputs in CLI mode, which lacks `=== STAROPS ANSWER BEGIN ===` delimiters and produces unstructured output that cannot be reliably parsed.\n\n#### INCORRECT — Missing `--question`\n\n```bash\npython3 scripts/call_starops_agent.py --pipe\n```\n\n**Why**: `--question` is a required parameter. The script will exit with an argument error.\n\n### 2. Thread Reuse — follow-up questions\n\n#### CORRECT — Reusing thread ID for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"当前 workspace 中有多少个 APM 服务\" --pipe\n# Output: THREAD: thread-abc123-xyz\n\n# Follow-up call with --thread\npython3 scripts/call_starops_agent.py \\\n --thread \"thread-abc123-xyz\" \\\n --question \"其中哪个服务错误率最高\" --pipe\n```\n\n#### INCORRECT — New thread for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"当前 workspace 中有多少个 APM 服务\" --pipe\n\n# Follow-up WITHOUT --thread — loses all prior context\npython3 scripts/call_starops_agent.py \\\n --question \"其中哪个服务错误率最高\" --pipe\n```\n\n**Why**: Omitting `--thread` creates a new conversation. The STAROps Agent loses all prior investigation context and findings.\n\n### 3. Dependency Installation\n\n#### CORRECT — Install from scripts/requirements.txt\n\n```bash\npip3 install -r scripts/requirements.txt\n```\n\n#### INCORRECT — Using `uv` or wrong path\n\n```bash\nuv run scripts/call_starops_agent.py --question \"...\" --pipe\npip3 install -r requirements.txt\n```\n\n**Why**: `uv` is not available in all environments. `requirements.txt` is located under `scripts/`, not the project root.\n\n### 4. Environment Variables — required before invocation\n\n#### CORRECT — All required variables set\n\n```bash\nexport STAROPS_AGENT_EMPLOYEE=\"apsara-ops\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\nexport STAROPS_AGENT_UID=\"\"\n```\n\n#### INCORRECT — Missing required variables\n\n```bash\n# Missing STAROPS_AGENT_UID\nexport STAROPS_AGENT_EMPLOYEE=\"apsara-ops\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\n```\n\n**Why**: The script requires all three variables (`STAROPS_AGENT_EMPLOYEE`, `STAROPS_AGENT_WORKSPACE`, `STAROPS_AGENT_UID`). Missing any of them produces a `ConfigError`.\n\n### 5. Authentication — credential security\n\n#### CORRECT — Use Alibaba Cloud Credentials default chain\n\nCredentials are read automatically from environment variables (`ALIBABA_CLOUD_ACCESS_KEY_ID` / `ALIBABA_CLOUD_ACCESS_KEY_SECRET`), STS, CLI profile, or instance metadata.\n\n#### INCORRECT — Printing or exposing credentials\n\n```bash\necho $ALIBABA_CLOUD_ACCESS_KEY_ID\nenv | grep -i access_key\ncat ~/.aliyun/config.json\n```\n\n**Why**: Credential values must never appear in script output, logs, or conversation. The `forbidden` checks in eval scenarios reject any output containing `accessKeyId=` or `accessKeySecret=`.\n\n### 6. Output Parsing — structured pipe output\n\n#### CORRECT — Extracting from pipe mode output\n\n```text\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n(diagnostic answer content)\n=== STAROPS ANSWER END ===\n```\n\nThe agent should extract:\n- `THREAD` line for thread ID reuse\n- `STAROPS_URL` line for console link\n- Content between `=== STAROPS ANSWER BEGIN ===` and `=== STAROPS ANSWER END ===` as the final answer\n\n#### INCORRECT — Forwarding raw stderr or fabricating results\n\nDirectly copying stderr tool-status lines (e.g., `[tool:started] query_metrics`) into the output, or fabricating diagnostic data when the API call fails.\n\n**Why**: stderr contains progress indicators for human visibility. Only stdout pipe-mode output is authoritative. If the API fails, report the error; do not invent results.\n\nFile v0.0.1-beta.1:references/api-reference.md\n\n# STAROps Agent API Reference\n\nThis skill uses STAROps OpenAPI version `2026-04-28` with ACS3-HMAC-SHA256 signing.\n\n## Authentication\n\nRequests are signed with Alibaba Cloud Credentials default-chain credentials. The Python script builds the ACS3 canonical request, signs it with `ACS3-HMAC-SHA256`, and sends HTTPS requests directly.\n\nThe default endpoint is derived from the region:\n\n```text\nstarops..aliyuncs.com\n```\n\nOverride with `STAROPS_AGENT_ENDPOINT` when a different endpoint is required.\n\n## CreateThread\n\n```http\nPOST /digitalEmployee/{name}/thread\n```\n\nBody:\n\n```json\n{\n \"title\": \"short question title\",\n \"idempotencyKey\": \"uuid\",\n \"variables\": {\n \"workspace\": \"workspace-name\",\n \"region\": \"cn-beijing\",\n \"project\": \"optional-project\"\n },\n \"attributes\": {\n \"source\": \"alibabacloud-starops-chat\"\n }\n}\n```\n\nExpected response field:\n\n```json\n{\n \"threadId\": \"thread-id\"\n}\n```\n\n## CreateChat\n\n```http\nPOST /chat\n```\n\nBody:\n\n```json\n{\n \"action\": \"create\",\n \"digitalEmployeeName\": \"employee-name\",\n \"threadId\": \"thread-id\",\n \"messages\": [\n {\n \"messageId\": \"uuid\",\n \"role\": \"user\",\n \"contents\": [\n {\n \"type\": \"text\",\n \"value\": \"user question\"\n }\n ]\n }\n ],\n \"variables\": {\n \"workspace\": \"workspace-name\",\n \"region\": \"cn-beijing\"\n }\n}\n```\n\nThe response is an SSE stream whose `data:` payloads contain STAROps `messages`. The script stops when the stream emits a `done` message or a `task_finished` event, and it always closes the streaming HTTP response before exiting.\n\n## Output Modes\n\nJSONL mode emits structured records:\n\n```jsonl\n{\"type\":\"thread\",\"thread_id\":\"thread-id\",\"starops_url\":\"https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\"}\n{\"type\":\"message\",\"role\":\"assistant\",\"content\":\"answer\"}\n{\"type\":\"done\",\"thread_id\":\"thread-id\",\"status\":\"completed\"}\n```\n\nPipe mode emits:\n\n```text\nTHREAD: thread-id\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\nanswer\n=== STAROPS ANSWER END ===\n```\n\nThe console URL uses the same digital employee ID as `assistantId`.\n\nPipe mode writes progress to stderr, including tool status lines such as:\n\n```text\n[tool:started] query_metrics\n[tool:running] generate_diagnosis_report\n[tool:done] query_metrics\n```\n\n`generate_diagnosis_report` text chunks are also mirrored to stderr for live visibility and included in the final stdout answer block.\n\nFile v0.0.1-beta.1:references/ram-policies.md\n\n# STAROps RAM Policy Notes\n\nThis skill does not use STAROps-specific AccessKey environment variables. It relies on Alibaba Cloud Credentials default-chain behavior, so credentials should be configured through standard Alibaba Cloud mechanisms.\n\n## Required Access\n\nThe STAROps OpenAPI actions are registered under the **`cms`** service code. Grant the caller the following actions:\n\n| Action | Description |\n|--------|-------------|\n| `cms:CreateThread` | Create an investigation thread |\n| `cms:CreateChat` | Send a message and stream the agent response |\n\nResource ARN format:\n\n```\nacs:cms::{uid}:digitalemployee/{employee_name}\n```\n\n### Example Custom Policy\n\n```json\n{\n \"Version\": \"1\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"cms:CreateThread\",\n \"cms:CreateChat\"\n ],\n \"Resource\": \"acs:cms::*:digitalemployee/*\"\n }\n ]\n}\n```\n\nTo restrict access to a specific account and digital employee, replace `*` with concrete values, e.g. `acs:cms:::digitalemployee/`.\n\n## Recommended Credential Sources\n\nUse one of the Alibaba Cloud Credentials default-chain sources:\n\n- Standard Alibaba Cloud AccessKey environment credentials.\n- Alibaba Cloud CLI profile or shared credentials profile.\n- STS credentials.\n- RAM role credentials.\n- ECS instance metadata credentials, when available.\n\nFor local development environments where metadata lookup causes delays, set:\n\n```bash\nexport ALIBABA_CLOUD_ECS_METADATA_DISABLED=true\n```\n\n## Security Boundaries\n\nThis skill creates STAROps investigation threads and streams STAROps Agent answers. It does not directly mutate ECS, OSS, RDS, SLS, or other cloud resources. Any operational action proposed by STAROps should still be reviewed according to the user's normal change-management process.\n\n## Permission Failure Handling\n\nWhen the script returns an HTTP 401 or 403 error indicating an authorization failure:\n\n1. Stop immediately. Do **not** retry with different credentials or fabricate diagnostic results.\n2. Report the exact error message to the user, including the `Action` and `Resource` from the error response.\n3. Direct the user to check that their identity has the required STAROps permissions listed in the **Required Access** section above.\n4. If using STS credentials, verify that the STS token has not expired and that the assumed role's policy includes `cms:CreateThread` and `cms:CreateChat`.\n5. Wait for the user to confirm that permissions have been granted before retrying.\n\nFile v0.0.1-beta.1:scripts/requirements.txt\n\nalibabacloud-credentials==1.0.8\nrequests==2.32.4","readmeExcerpt":"Skill: Alibabacloud Starops Chat Owner: sdk-team Summary: Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topolo... Tags: latest:0.0.2 Version history: v0.0.2 | 2026-06-22T09:13:42.449Z | auto alibabacloud-starops-chat 0.0.2 - Added support for reading configuration from .starops/config.json, ~/.starops/config.json,","codeSnippets":[],"executableExamples":[{"language":"json","snippet":"{\n \"employeeId\": \"\",\n \"workspace\": \"\",\n \"uid\": \"\"\n}"},{"language":"json","snippet":"{\n \"endpoint\": \"starops.cn-beijing.aliyuncs.com\",\n \"project\": \"optional-project\",\n \"timeout\": 1800,\n \"idleTimeout\": 60\n}"},{"language":"bash","snippet":"missing=\"\"\n[ -z \"$STAROPS_AGENT_EMPLOYEE\" ] && missing=\"$missing STAROPS_AGENT_EMPLOYEE\"\n[ -z \"$STAROPS_AGENT_WORKSPACE\" ] && missing=\"$missing STAROPS_AGENT_WORKSPACE\"\n[ -z \"$STAROPS_AGENT_UID\" ] && missing=\"$missing STAROPS_AGENT_UID\"\nconfig_file_found=\"\"\n[ -f \".starops/config.json\" ] && config_file_found=1\n[ -f \"$HOME/.starops/config.json\" ] && config_file_found=1\n[ -n \"$STAROPS_AGENT_CONFIG\" ] && [ -f \"$STAROPS_AGENT_CONFIG\" ] && config_file_found=1\nif [ -n \"$missing\" ] && [ -z \"$config_file_found\" ]; then\n echo \"ERROR: Missing required environment variables:$missing and no STAROps config file was found\" >&2\n exit 1\nfi\necho \"OK: STAROps configuration is available from environment variables or config file\""},{"language":"bash","snippet":"pip3 install -r scripts/requirements.txt\n\n# First call - creates a new thread automatically\npython3 scripts/call_starops_agent.py --question \"\" --pipe\n\n# First call with an explicit config file\npython3 scripts/call_starops_agent.py --config \".starops/config.json\" --question \"\" --pipe\n\n# Follow-up calls - MUST reuse the thread ID from previous response\npython3 scripts/call_starops_agent.py --thread \"\" --question \"\" --pipe"},{"language":"bash","snippet":"# Query 1: Creates new thread\n$ python3 scripts/call_starops_agent.py --question \"Query TOP 5 error applications\" --pipe\nTHREAD: thread-abc123-xyz\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-abc123-xyz&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\n...\n\n# Query 2: MUST reuse thread for context\n$ python3 scripts/call_starops_agent.py --thread \"thread-abc123-xyz\" --question \"Deep dive into notification app errors\" --pipe"},{"language":"text","snippet":"--user-agent AlibabaCloud-Agent-Skills/{SKILL_NAME}/{session-id}"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: alibabacloud-starops-chat\ndescription: |\n Alibaba Cloud STAROps Agent AIOps diagnostic skill. Use this skill to help users diagnose service errors, analyze root causes, query workspace/service topology, inspect APM metrics, and troubleshoot incidents through the STAROps Agent.\n Triggers: \"排查根因\", \"根因分析\", \"服务报错\", \"服务异常\", \"APM 服务\", \"workspace 服务\", \"STAROps\", \"AIOps 诊断\", \"链路追踪\", \"告警分析\".\n---\n\n# Alibaba Cloud STAROps Agent\n\nCall the Alibaba Cloud STAROps Agent through STAROps OpenAPI and receive a streaming diagnostic answer.\n\n## Scenario Description\n\nUse this skill when the user wants to:\n\n- Diagnose service errors or exceptions (root cause analysis)\n- Query workspace topology, service lists, or service metrics\n- Analyze APM traces, error rates, latency, or request volume\n- Triage alerts or investigate incidents\n- Ask questions about their STAROps workspace or services\n\n## Configuration\n\nThe script reads STAROps connection values from environment variables and optional JSON config files. Environment variables and command-line flags override config file values.\n\nConfig files are loaded in this order:\n\n1. User config: `~/.starops/config.json`\n2. Project config: `./.starops/config.json` (overrides user config)\n3. Explicit config: `--config ` or `STAROPS_AGENT_CONFIG` (overrides user/project config)\n\nThe three required values (`employeeId`, `workspace`, `uid`) may come from either environment variables or config files.\n\n| Variable | Required | Description |\n|----------|----------|-------------|\n| `STAROPS_AGENT_EMPLOYEE` | Yes, unless config provides `employeeId` | Digital Employee ID in STAROps (from console → Digital Employee list → ID column) |\n| `STAROPS_AGENT_WORKSPACE` | Yes, unless config provides `workspace` | Workspace identifier |\n| `STAROPS_AGENT_UID` | Yes, unless config provides `uid` | Alibaba Cloud account UID that owns the workspace |\n| `STAROPS_AGENT_ENDPOINT` | No | API endpoint (default: `starops.cn-beijing.aliyuncs.com`) |\n| `STAROPS_AGENT_PROJECT` | No | Optional STAROps project variable forwarded with each request. Overridden by `--project` |\n| `STAROPS_AGENT_TIMEOUT` | No | Default value for `--timeout` (CreateChat stream total timeout in seconds; default `1800`) |\n| `STAROPS_AGENT_IDLE_TIMEOUT` | No | Default value for `--idle-timeout` (max seconds to wait for the next SSE event; default `60`) |\n| `STAROPS_AGENT_CONFIG` | No | Path to an explicit JSON config file loaded after user/project config |\n\nMinimal config file example:\n\n```json\n{\n \"employeeId\": \"\",\n \"workspace\": \"\",\n \"uid\": \"\"\n}\n```\n\nOptional fields:\n\n```json\n{\n \"endpoint\": \"starops.cn-beijing.aliyuncs.com\",\n \"project\": \"optional-project\",\n \"timeout\": 1800,\n \"idleTimeout\": 60\n}\n```\n\nConfig files use the exact key names shown above. Do not use alternate aliases such as `employee`, `digitalEmployeeId`, `workspaceName`, or `accountUid`.\n\n**Pre-flight check — run this before "},{"path":"_meta.json","content":"{\n \"ownerId\": \"kn74p5w8ywv6prh40g0s82gmqh83nw54\",\n \"slug\": \"alibabacloud-starops-chat\",\n \"version\": \"0.0.2\",\n \"publishedAt\": 1782119622449\n}"},{"path":"references/acceptance-criteria.md","content":"# Acceptance Criteria: alibabacloud-starops-chat\n\n**Scenario**: STAROps Agent AIOps Diagnostic Skill\n**Purpose**: Skill testing acceptance criteria\n\n---\n\n## Correct Script Invocation Patterns\n\n### 1. Command Format — mandatory flags\n\n#### CORRECT\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"Help me investigate the root cause of inventory service errors\" \\\n --pipe\n```\n\n#### INCORRECT — Missing `--pipe`\n\n```bash\npython3 scripts/call_starops_agent.py \\\n --question \"Help me investigate the root cause of inventory service errors\"\n```\n\n**Why**: `--pipe` is mandatory. Without it, the script outputs in CLI mode, which lacks `=== STAROPS ANSWER BEGIN ===` delimiters and produces unstructured output that cannot be reliably parsed.\n\n#### INCORRECT — Missing `--question`\n\n```bash\npython3 scripts/call_starops_agent.py --pipe\n```\n\n**Why**: `--question` is a required parameter. The script will exit with an argument error.\n\n### 2. Thread Reuse — follow-up questions\n\n#### CORRECT — Reusing thread ID for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"How many APM services are in the current workspace?\" --pipe\n# Output: THREAD: thread-abc123-xyz\n\n# Follow-up call with --thread\npython3 scripts/call_starops_agent.py \\\n --thread \"thread-abc123-xyz\" \\\n --question \"Which service has the highest error rate?\" --pipe\n```\n\n#### INCORRECT — New thread for follow-up\n\n```bash\n# First call\npython3 scripts/call_starops_agent.py \\\n --question \"How many APM services are in the current workspace?\" --pipe\n\n# Follow-up WITHOUT --thread — loses all prior context\npython3 scripts/call_starops_agent.py \\\n --question \"Which service has the highest error rate?\" --pipe\n```\n\n**Why**: Omitting `--thread` creates a new conversation. The STAROps Agent loses all prior investigation context and findings.\n\n### 3. Dependency Installation\n\n#### CORRECT — Install from scripts/requirements.txt\n\n```bash\npip3 install -r scripts/requirements.txt\n```\n\n#### INCORRECT — Using `uv` or wrong path\n\n```bash\nuv run scripts/call_starops_agent.py --question \"...\" --pipe\npip3 install -r requirements.txt\n```\n\n**Why**: `uv` is not available in all environments. `requirements.txt` is located under `scripts/`, not the project root.\n\n### 4. Environment Variables or Config File — required before invocation\n\n#### CORRECT — All required variables set\n\n```bash\nexport STAROPS_AGENT_EMPLOYEE=\"\"\nexport STAROPS_AGENT_WORKSPACE=\"rca-benchmark\"\nexport STAROPS_AGENT_UID=\"\"\n```\n\n#### CORRECT — Project config file supplies required values\n\n```bash\nmkdir -p .starops\ncat > .starops/config.json <<'JSON'\n{\n \"employeeId\": \"\",\n \"workspace\": \"rca-benchmark\",\n \"uid\": \"\"\n}\nJSON\n\npython3 scripts/call_starops_agent.py \\\n --question \"How many APM services are in the current workspace?\" \\\n --pipe\n```\n\n**Why**: The script loads `~/.starops/config.json` first, then `./.starops/config.json`, so project-level va"},{"path":"references/api-reference.md","content":"# STAROps Agent API Reference\n\nThis skill uses STAROps OpenAPI version `2026-04-28` with ACS3-HMAC-SHA256 signing.\n\n## Authentication\n\nRequests are signed with Alibaba Cloud Credentials default-chain credentials. The Python script builds the ACS3 canonical request, signs it with `ACS3-HMAC-SHA256`, and sends HTTPS requests directly.\n\nThe default endpoint is:\n\n```text\nstarops.cn-beijing.aliyuncs.com\n```\n\nOverride with `STAROPS_AGENT_ENDPOINT` when a different endpoint is required.\n\n## CreateThread\n\n```http\nPOST /digitalEmployee/{employeeId}/thread\n```\n\nBody:\n\n```json\n{\n \"title\": \"short question title\",\n \"idempotencyKey\": \"uuid\",\n \"variables\": {\n \"workspace\": \"workspace-name\",\n \"project\": \"optional-project\"\n },\n \"attributes\": {\n \"source\": \"alibabacloud-starops-chat\"\n }\n}\n```\n\nExpected response field:\n\n```json\n{\n \"threadId\": \"thread-id\"\n}\n```\n\n## CreateChat\n\n```http\nPOST /chat\n```\n\nBody:\n\n```json\n{\n \"action\": \"create\",\n \"digitalEmployeeName\": \"employee-id\",\n \"threadId\": \"thread-id\",\n \"messages\": [\n {\n \"messageId\": \"uuid\",\n \"role\": \"user\",\n \"contents\": [\n {\n \"type\": \"text\",\n \"value\": \"user question\"\n }\n ]\n }\n ],\n \"variables\": {\n \"workspace\": \"workspace-name\"\n }\n}\n```\n\nThe response is an SSE stream whose `data:` payloads contain STAROps `messages`. The script stops when the stream emits a `done` message or a `task_finished` event, and it always closes the streaming HTTP response before exiting.\n\n## Output Modes\n\nJSONL mode emits structured records:\n\n```jsonl\n{\"type\":\"thread\",\"thread_id\":\"thread-id\",\"starops_url\":\"https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\"}\n{\"type\":\"message\",\"role\":\"assistant\",\"content\":\"answer\"}\n{\"type\":\"done\",\"thread_id\":\"thread-id\",\"status\":\"completed\"}\n```\n\nPipe mode emits:\n\n```text\nTHREAD: thread-id\nSTAROPS_URL: https://starops.console.aliyun.com/chat?threadId=thread-id&assistantId=apsara-ops\n=== STAROPS ANSWER BEGIN ===\nanswer\n=== STAROPS ANSWER END ===\n```\n\nThe console URL uses the same digital employee ID as `assistantId`.\n\nPipe mode writes progress to stderr, including tool status lines such as:\n\n```text\n[tool:started] query_metrics\n[tool:running] generate_diagnosis_report\n[tool:done] query_metrics\n```\n\n`generate_diagnosis_report` text chunks are also mirrored to stderr for live visibility and included in the final stdout answer block."},{"path":"references/ram-policies.md","content":"# STAROps RAM Policy Notes\n\nThis skill does not use STAROps-specific AccessKey environment variables. It relies on Alibaba Cloud Credentials default-chain behavior, so credentials should be configured through standard Alibaba Cloud mechanisms.\n\n## Required Access\n\nGrant the caller the following STAROps actions:\n\n| Action | Description |\n|--------|-------------|\n| `starops:CreateThread` | Create an investigation thread |\n| `starops:CreateChat` | Send a message and stream the agent response |\n\nResource ARN format:\n\n```\nacs:starops::{uid}:digitalemployee/{employeeId}\n```\n\n### Example Custom Policy\n\n```json\n{\n \"Version\": \"1\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"starops:CreateThread\",\n \"starops:CreateChat\"\n ],\n \"Resource\": \"acs:starops::*:digitalemployee/*\"\n }\n ]\n}\n```\n\nTo restrict access to a specific account and digital employee, replace `*` with concrete values, e.g. `acs:starops:::digitalemployee/`.\n\n## Recommended Credential Sources\n\nUse one of the Alibaba Cloud Credentials default-chain sources:\n\n- Standard Alibaba Cloud AccessKey environment credentials.\n- Alibaba Cloud CLI profile or shared credentials profile.\n- STS credentials.\n- RAM role credentials.\n- ECS instance metadata credentials, when available.\n\nFor local development environments where metadata lookup causes delays, set:\n\n```bash\nexport ALIBABA_CLOUD_ECS_METADATA_DISABLED=true\n```\n\n## Security Boundaries\n\nThis skill creates STAROps investigation threads and streams STAROps Agent answers. It does not directly mutate ECS, OSS, RDS, SLS, or other cloud resources. Any operational action proposed by STAROps should still be reviewed according to the user's normal change-management process.\n\n## Permission Failure Handling\n\nWhen the script returns an HTTP 401 or 403 error indicating an authorization failure:\n\n1. Stop immediately. Do **not** retry with different credentials or fabricate diagnostic results.\n2. Report the exact error message to the user, including the `Action` and `Resource` from the error response.\n3. Direct the user to check that their identity has the required STAROps permissions listed in the **Required Access** section above.\n4. If using STS credentials, verify that the STS token has not expired and that the assumed role's policy includes `starops:CreateThread` and `starops:CreateChat`.\n5. Wait for the user to confirm that permissions have been granted before retrying."}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":null,"editorialQuality":{"score":100,"threshold":65,"status":"thin","wordCount":1624,"uniquenessScore":44,"reasons":["uniqueness-below-45"]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T22:37:14.697Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T22:37:14.697Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-12T16:14:11.876Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}