PolarDB Database AI Assistant

This Skill focuses on Alibaba Cloud PolarDB MySQL/PostgreSQL database intelligent O&M. It invokes the Yaochi Agent v2 backend through the get-yao-chi-agent API and the aliyun CLI DAS plugin.

Architecture: Codex Skill -> scripts/call_yaochi_agent.sh -> Aliyun CLI -> DAS Plugin (Signature V3) -> get-yao-chi-agent API -> Yaochi Agent v2 -> PolarDB Skill/MCP/DAS/RAG capabilities

Scope: PolarDB only. Do not use this Skill for non-PolarDB product O&M requests unless the user's request is explicitly about PolarDB integration or comparison.

Supported Capabilities

Backend Execution Model

The local Skill does not call PolarDB MCP tools directly. It sends a natural-language query to Yaochi Agent v2. The backend is responsible for:

1. Matching a PolarDB scenario Skill first when the request is an O&M, inspection, diagnosis, parameter, or event scenario.
2. Calling PolarDB MCP/OpenAPI tools for real cluster, metric, log, backup, security, or data-plane evidence.
3. Using DAS intelligent diagnosis for performance, slow SQL, lock, index, and auto-increment ID issues when applicable.
4. Falling back to PolarDB documentation/RAG only when structured tools cannot answer the question.

When answering users, treat the backend output as the source of truth. Do not invent cluster status, metrics, logs, risk levels, or document links that are not present in the response.

Observability

[MUST] User-Agent template — Every Alibaba Cloud CLI, SDK, or Terraform invocation made by this Skill must use: AlibabaCloud-Agent-Skills/alibabacloud-polardb-ai-assistant/{session-id}

[MUST] Session-id rule — Generate one observability session ID at the start of each Skill execution session, reuse the same value across all Alibaba Cloud CLI, SDK, and Terraform calls in that session, and do not regenerate it for retries or multi-step workflows. The session ID must be a 32-character lowercase hexadecimal string.

export ALIBABACLOUD_AGENT_SKILL_SESSION_ID="${ALIBABACLOUD_AGENT_SKILL_SESSION_ID:-$(openssl rand -hex 16)}"

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-polardb-ai-assistant/${ALIBABACLOUD_AGENT_SKILL_SESSION_ID}

Installation

Pre-check: Aliyun CLI >= 3.3.3 required Run aliyun version to verify >= 3.3.3. If not installed or version too low, download the installer, review it, then run it locally to update, or see references/cli-installation-guide.md for installation instructions. Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation. Then [MUST] run aliyun plugin update to ensure that any existing plugins on your local machine are always up-to-date.

# Install aliyun CLI after reviewing the downloaded installer
curl -fsSL https://aliyuncli.alicdn.com/setup.sh -o /tmp/aliyun-cli-setup.sh
less /tmp/aliyun-cli-setup.sh
bash /tmp/aliyun-cli-setup.sh
aliyun version  # Verify >= 3.3.3

# Enable automatic plugin installation
aliyun configure set --auto-plugin-install true

# Install DAS plugin (get-yao-chi-agent requires plugin for Signature V3 support)
aliyun plugin install --names aliyun-cli-das

# Install jq (for JSON response parsing)
# macOS:
brew install jq
# Ubuntu/Debian:
# sudo apt-get install jq

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, instance names, CIDR blocks, passwords, domain names, resource specifications, etc.) MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

Authentication

Credentials use existing aliyun CLI configuration, no additional AK/SK setup required:

# Recommended: OAuth mode
aliyun configure --mode OAuth

# Or: AK mode
aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

# Cross-account access: RamRoleArn mode
aliyun configure set \
  --mode RamRoleArn \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --ram-role-arn acs:ram::<account-id>:role/<role-name> \
  --role-session-name yaochi-agent-session \
  --region cn-hangzhou

RAM Policy

See references/ram-policies.md

Core Workflow

All intelligent O&M operations are invoked through scripts/call_yaochi_agent.sh, which wraps aliyun das get-yao-chi-agent (DAS plugin kebab-case command, supports Signature V3) with streaming response parsing.

# Cluster management
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List PolarDB clusters in Hangzhou region"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Show detailed configuration of cluster pc-xxx"

# Performance diagnostics
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Analyze cluster pc-xxx performance in the last hour"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Show slow SQL of cluster pc-xxx"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Diagnose lock blocking and index risks for PolarDB PostgreSQL cluster pc-xxx"

# Parameter tuning
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "How to tune innodb_buffer_pool_size for cluster pc-xxx"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Explain loose_polar_log_bin parameter"
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Compare parameters between pc-xxx and pc-yyy"

# Primary-standby switchover diagnostics
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Analyze recent primary-standby switchover cause for cluster pc-xxx"

# Connection and session
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "How to troubleshoot high connection count in cluster pc-xxx"

# Backup recovery
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Show backup status of cluster pc-xxx"

# Inspection
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Generate a health inspection report for cluster pc-xxx"

# Multi-turn conversation (use session ID from previous response)
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "Continue analysis" --session-id "<session-id>"

# Specify profile
bash $SKILL_DIR/scripts/call_yaochi_agent.sh "List clusters" --profile myprofile

# Read from stdin
echo "List clusters" | bash $SKILL_DIR/scripts/call_yaochi_agent.sh -

Error Handling

If call_yaochi_agent.sh fails, do not summarize it as only Error: SDKError. Surface the structured error block from stderr to the user, especially:

[YaoChi Agent Error]
ErrorCode: <aliyun error code>
ErrorMessage: <full error description>
AuthAction: <required RAM action, when returned>
RequestId: <request id, when returned>
Suggestion: <specific fix>
Reference: <local skill reference>
Troubleshooting: <Aliyun troubleshooting link>

For permission errors such as Forbidden.RAM, check AuthAction first and guide the user to grant that RAM action or the policies in references/ram-policies.md. For credential, throttling, timeout, or plugin errors, use the Suggestion and references/verification-method.md to give the next concrete fix.

Throttling.UserConcurrentLimit means the account has exceeded the Yaochi Agent concurrent request limit. Current production verification shows at most 2 concurrent sessions per account; wait for an existing request to finish before retrying.

Response Requirements

For diagnosis and inspection questions, keep the answer evidence-driven:

1. Start with the conclusion and current risk level.
2. Cite concrete evidence from the backend response, such as metric values, log counts, backup records, version numbers, or returned status fields.
3. Give at most the highest-impact next actions first. Distinguish immediate actions from follow-up observation.
4. For missing data or permission failures, explain what could not be verified and surface the structured error or missing-permission guidance.
5. Do not expose internal tool names, absolute local file paths, hidden system groups, credentials, or raw implementation details unless they are necessary for user remediation.

For high-risk or change-related requests:

• Parameter changes, restarts, failovers, whitelist changes, backup recovery, and configuration changes require explicit risk explanation and user confirmation.
• Always state whether a parameter change requires restart or has immediate effect when that evidence is available.
• Backup and recovery guidance must remind the user to verify recovery point, data consistency, and business impact before action.

Example Questions

Success Verification

See references/verification-method.md

Cleanup

This Skill focuses on query and diagnostics capabilities, does not create any resources, no cleanup required.

The following operations are NOT within the scope of this Skill:

• Directly create/delete PolarDB clusters
• Directly change instance specifications or parameters
• Directly modify whitelist, security, backup, or HA configuration

The Skill may explain these operations, assess risk, and guide the user through the required checks, but it must not claim that a change was executed unless the backend response explicitly confirms it.

API and Command Tables

See references/related-apis.md

Best Practices

1. PolarDB-only scope: Use this Skill for PolarDB MySQL/PostgreSQL. Do not route non-PolarDB product O&M requests here.
2. Cluster ID Format: PolarDB cluster IDs typically start with pc-; include the full cluster ID in queries when available.
3. Region Specification: Explicitly specify region in natural language queries (e.g., "Hangzhou region", "Beijing region") to improve query accuracy. If region is unknown, ask or let the backend infer it from the instance when supported.
4. Evidence First: For O&M, inspection, and diagnosis answers, rely on backend-returned tool evidence. Do not infer exact metrics, version risk, or backup state without data.
5. Multi-turn Conversation: Use --session-id for complex diagnostic scenarios to maintain context continuity.
6. Concurrency Limit: Maximum 2 concurrent sessions per account, avoid initiating multiple parallel calls.
7. High-risk Operations: For parameter changes, failover, recovery, or security changes, explain risk and require user confirmation before any action path.
8. Throttling Handling: If encountering Throttling.UserConcurrentLimit error, wait for previous query to complete and retry.
9. Credential Security: Use aliyun configure to manage credentials, never hardcode AK/SK in scripts.

Reference Links