qwencloud-operate
Diagnose why an application deployed by qwencloud-deploy to Alibaba Cloud International (alibabacloud.com) is unavailable or slow, and — only after explicit user confirmation — perform a safe recovery and verify the result. Reads the local .qwencloud-deploy state file to identify ECS (and optional RDS MySQL) resources, runs minimal read-only diagnostics, then proposes one recovery action at a time (start ECS, restart the app service, reload Nginx), each gated by a confirmation that states impact. Use when: the user says the app is down / returns 502 / cannot connect to the database, or asks to restart and verify the app. Do not use when: no .qwencloud-deploy state file exists, the target is Aliyun China (use qianwenai-operate), or the user only wants a status/cost overview (use qwencloud-observe).
- Installs
- 190
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/qwencloud/qwencloud-deploy --skill qwencloud-operate- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads qwencloud-operate automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Qwen Cloud Operate
Fault diagnosis and confirmed recovery for an application deployed by qwencloud-deploy on
Alibaba Cloud International. Diagnosis is read-only and needs no confirmation; any action that
changes cloud or app state requires explicit confirmation.
Interaction Flow
Identify app & resources
→ Minimal diagnosis (read-only)
→ Give cause, evidence, recommended action
→ Show impact and request confirmation
→ Execute one recovery action
→ Verify application, ECS, RDS
→ Return result + audit info
→ Offer to re-score via qwencloud-observe (before → after)
Interaction form
- Read-only information (diagnosis, cause, evidence, verification): plain text, with one evidence line after each judgment (metric, status, RequestId).
- State-changing actions (start/stop ECS, restart app, reload Nginx — any write call): first an AskUserQuestion whose prompt answers what it does · impact (downtime/irreversible) · how to verify; do nothing before confirmation, and propose one recovery action at a time.
- Proactive discipline: after recovery, close quietly when the result is healthy; speak up with a next step only when a risk remains or recovery failed, and let the user choose.
Scope
| In Scope | Out of Scope |
|---|---|
Apps deployed by qwencloud-deploy (state file present) | Apps without a .qwencloud-deploy state file |
| Single ECS, or ECS + RDS MySQL 8.0 | Other topologies / self-managed servers |
| Diagnose + confirmed recovery (start ECS, restart app, reload Nginx) | Data-destructive ops, scaling, config redesign |
| Pinpoint an app-layer error (which layer broke, what error) | Source-code review, finding bugs/vulns, judging which line is wrong, editing code |
| Alibaba Cloud International | Aliyun China → use qianwenai-operate |
Code issues are out of scope
This skill handles infrastructure and runtime faults; it does not review source code, locate defects, or edit code. Diagnosis can pinpoint an app-layer error and what was thrown to narrow things down, but it does not judge which line is wrong and does not change code.
When code is involved, tell the user plainly: editing code is outside this skill's scope, the user must decide and make the change themselves, and any consequences are the user's own. Never slip a code change into a recovery action.
Prerequisites
Aliyun CLI:
aliyun version(need 3.x). All commands use the PascalCase native form straight to OpenAPI — no plugin dependency. Credentials:aliyun configure listonly. Never read, echo, print, or ask for AK/SK/tokens. No valid profile → stop and ask the user to configure credentials outside this session. Seereferences/cli_installation_guide.md.
How to work
- Identify the app from
.qwencloud-deploy. See workflow. - Diagnose (read-only, no confirmation needed). Find where it's broken, the likely cause, the evidence, and what to do about it. See diagnose.
- Recover one thing, with confirmation. Pick the action that matches the diagnosis, show the
user its impact and get their go-ahead, then do exactly that one thing:
- Start a stopped server → recover-ecs
- Reboot a hung server → recover-reboot
- Restart the app service → recover-app
- Reload Nginx after
nginx -tpasses → recover-nginx - Re-bind the EIP after it is unbound → recover-eip
- Allow security-group 80 / 443 ingress → recover-securitygroup
- Database-related trouble → recover-rds
- Certificate expired / HTTPS handshake fails → recover-cert
- Root disk near full / still short after cleanup (resize) → recover-disk
- Verify whether the app is back, then record what you did. See workflow.
Rules that keep recovery safe
- Diagnosis is read-only; recovery uses a small fixed set of known-safe commands.
- Every action that changes anything is confirmed with the user first, and cancelling changes nothing.
- Do one action, verify, then decide the next — never batch recovery steps.
- Recovery actions are safe to repeat.
- Stop before any further change on a timeout, a permission error, or an unexpected state change.
- Never put passwords, tokens, or full connection strings into the audit record or the chat.
Before any change, the confirmation tells the user: what resource, what action, whether it briefly interrupts the app, whether the version changes, whether it costs anything new, and how you'll verify it (and what happens if it fails).
Required Permissions
See references/ram_policies.md. Read: ecs:DescribeInstances, ecs:DescribeInvocations,
ecs:DescribeSecurityGroupAttribute, ecs:DescribeDisks, vpc:DescribeEipAddresses,
RDS describe/performance/slow-log. Write (recovery): ecs:StartInstance, ecs:RebootInstance,
ecs:AuthorizeSecurityGroup, ecs:ResizeDisk, vpc:AssociateEipAddress, ecs:RunCommand
(whitelisted recovery commands only). Certificate re-issue also needs alidns record
read/write (DNS-01 challenge).
More detail
The step-by-step guides are linked from "How to work" above. Two setup references:
- CLI setup — install and credential check.
- CLI gotchas — parameter shapes, time formats, response parsing.
- RAM policies — the permissions this skill needs.
FAQ
What does the qwencloud-operate skill do?
Diagnose why an application deployed by qwencloud-deploy to Alibaba Cloud International (alibabacloud.com) is unavailable or slow, and — only after explicit user confirmation — perform a safe recovery and verify the result. Reads the local .qwencloud-deploy state file to identify ECS (and optional RDS MySQL) resources, runs minimal read-only diagnostics, then proposes one recovery action at a time (start ECS, restart the app service, reload Nginx), each gated by a confirmation that states impact. Use when: the user says the app is down / returns 502 / cannot connect to the database, or asks to restart and verify the app. Do not use when: no .qwencloud-deploy state file exists, the target is Aliyun China (use qianwenai-operate), or the user only wants a status/cost overview (use qwencloud-observe).
How do I install qwencloud-operate?
Run npx skills add https://github.com/qwencloud/qwencloud-deploy --skill qwencloud-operate in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/qwencloud-operate/ (personal) or .claude/skills/qwencloud-operate/ (project).
Which AI agents can use qwencloud-operate?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is qwencloud-operate safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains qwencloud-operate?
It is published by qwencloud in qwencloud/qwencloud-deploy. It has 190 recorded installs.
More from qwencloud/qwencloud-deploy
qwencloud-deploy
qwencloud/qwencloud-deploy
One-click deploy, publish, and update a local project or Git repository to Alibaba Cloud International (alibabacloud.com), producing an accessible online service with a public IP. Supports full-stack ROS orchestration, automatic cloud-resource provisioning, pre-deployment price confirmation, service health checks, deployment-state recording, hot updates, and optional domain + HTTPS setup. Use when: the user asks to deploy a project to the cloud, put an app online, publish a website, generate an access URL, deploy a Git repo, or update an online version and has NOT named a specific cloud platform; or the user mentions "Alibaba Cloud", "alibabacloud.com", or the international site. Do not use when: the user explicitly targets Aliyun China (aliyun.com), AWS, GCP, Azure, or another specific cloud platform.
qwencloud-observe
qwencloud/qwencloud-deploy
Open the skill to read its SKILL.md instructions.
Popular devops & cloud skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.