Alibabacloud Ecs Sec Userspace

What it does

When your agent uses it

• Tasks that involve Container orchestration
• Tasks that involve Vulnerability scanning
• Tasks that involve Containers

Example prompts

• “/alibabacloud-ecs-sec-userspace”

Requirements

• Python 3
• Node.js
• Docker
• Pre-approved tools (allowed-tools): terminal (sudo required for full scan), file-read, file-write

Workflow steps

6 steps, taken from the step headings in SKILL.md.

1. 1环境初始化（首次）
2. 2执行扫描
3. 3查看报告
4. 4Post-Scan Reflection（MANDATORY）
5. 5Alert Verification | 告警验证
6. 6Functional Consistency | 功能一致性

What it can do on your machine

Read from SKILL.md and the folder at commit 809887f. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • terminal (sudo required for full scan)
  • file-read
  • file-write

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python, from the files we listed), which the agent can run.

  Shell commands in SKILL.md call:

  • python3
  • bash

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Alibabacloud Ecs Sec Userspace loads about 2.6k tokens when it runs, and up to ~26k if it reads all its reference files. Until then it costs about 98 tokens; SKILL.md has 756 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~98

When it runs · the whole SKILL.md, loaded when a task matches

~2.6k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~26k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:15

  - terminal (sudo required for full scan)

• NoteRuns commands with sudoSKILL.md:31

  cd /data/sec-userspace && sudo python3 scripts/setup_permissions.py --auto

• NoteRuns commands with sudoSKILL.md:55

  cd /data/sec-userspace && sudo bash scripts/setup.sh

• NoteRuns commands with sudoSKILL.md:64

  cd /data/sec-userspace && sudo python3 -m scripts.main --output-dir /data/sec-userspace/workspace

• NoteRuns commands with sudoSKILL.md:67

  cd /data/sec-userspace && sudo python3 scripts/main.pyz --output-dir /data/sec-userspace/workspace

• NoteRuns commands with sudoSKILL.md:166

  cd /data/sec-userspace && sudo python3 -m scripts.main --output-dir /data/sec-userspace/workspace

• NoteRuns commands with sudoSKILL.md:169

  cd /data/sec-userspace && sudo python3 -m scripts.main --format both

• NoteRuns commands with sudoSKILL.md:172

  cd /data/sec-userspace && sudo python3 -m scripts.main --full-report

• NoteRuns commands with sudoSKILL.md:175

  cd /data/sec-userspace && sudo python3 -m scripts.main --force

• NoteRuns commands with sudoSKILL.md:277

  | 隐藏进程 | `sudo ls /proc/{pid}/exe -la` |

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from aliyun/alibabacloud-ecs-troubleshoot-skills at commit 809887f, republished under its Apache-2.0 licence (© aliyun). 756 words, ~2,560 tokens.

name

alibabacloud-ecs-sec-userspace

description

Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。 与 sec-kernel（内核态 CVE 漏洞检测）互补，共同构成完整的 ECS 安全评估方案。 当用户询问服务器安全、入侵检测、系统审计、恶意软件检测、安全事件响应时使用。 每当需要判断服务器是否被入侵、检查后门木马、分析安全事件时，优先使用此技能。 务必在发现安全异常时主动调用此技能，即使用户没有明确要求安全检查。

allowed-tools

terminal (sudo required for full scan), file-read, file-write

version

1.4.1

date

2026-05-09

cd /data/sec-userspace && sudo python3 scripts/setup_permissions.py --auto

cd /data/sec-userspace && python3 scripts/setup_permissions.py --verify

cd /data/sec-userspace && sudo bash scripts/setup.sh

# 推荐（源码模式）
cd /data/sec-userspace && sudo python3 -m scripts.main --output-dir /data/sec-userspace/workspace

# 编译版（需 Python 3.11 精确匹配）
cd /data/sec-userspace && sudo python3 scripts/main.pyz --output-dir /data/sec-userspace/workspace

{
  "permissions": {
    "allow": [
      "Bash(sudo:*)",
      "Bash(python3:*)",
      "Read(**)",
      "Write(/data/sec-userspace/workspace/**)",
      "Write(workspace/**)"
    ]
  }
}

# 基本扫描
cd /data/sec-userspace && sudo python3 -m scripts.main --output-dir /data/sec-userspace/workspace

# 指定输出格式
cd /data/sec-userspace && sudo python3 -m scripts.main --format both

# 完整报告（含时间线、攻击链、交叉关联）
cd /data/sec-userspace && sudo python3 -m scripts.main --full-report

# 高负载时强制执行
cd /data/sec-userspace && sudo python3 -m scripts.main --force

# 列出所有分析器
cd /data/sec-userspace && python3 -m scripts.main --list-analyzers

# 查看资产数据
cd /data/sec-userspace && python3 -m scripts.main --show-assets all

# K8s 部署
cd /data/sec-userspace && python3 -m scripts.main k8s-deploy

© aliyun, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 402 other files (scripts, references, assets) in skills/alibabacloud-ecs-sec-userspace of aliyun/alibabacloud-ecs-troubleshoot-skills.

• SKILL.md
• CONTRIBUTOR.md
• VERSION
• __init__.py
• assets-origin/ioc/domain.b64
• assets-origin/ioc/hash.b64
• assets-origin/ioc/ip_port.b64
• assets-origin/ioc/manifest.json
• assets-origin/ioc/url.b64
• assets-origin/whitelist/analyzer_rules.b64
• assets-origin/whitelist/domain.b64
• assets-origin/whitelist/hash.b64
• assets-origin/whitelist/ip_port.b64
• assets-origin/whitelist/manifest.json
• assets-origin/whitelist/url.b64
• assets/ioc/.gitkeep
• … and 387 more

Open the folder on GitHubat commit 809887f