ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alibaba/anolisa --skill alinux-cve-querygit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/alinux-cve-query)<a href="https://agentmods.dev/skills/alibaba/anolisa/alinux-cve-query"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/alinux-cve-query.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 57 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.00898 |
| Opus 5 | $0.00033 | $0.00449 |
| Sonnet 5 | $0.00013 | $0.00180 |
| Haiku 4.5 | $0.00007 | $0.00090 |
Grade B, and why
alinux-cve-query scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo yum update --advisory <SA-ID> -y What it actually says
Alinux CVE 漏洞查询
查询 Alibaba Cloud Linux 产品的 CVE 漏洞影响状态和修复信息。
查询流程
步骤 1：验证 CVE ID
从用户输入中提取 CVE ID，格式为 CVE-YYYY-NNNNN（年份-编号）。如果用户未提供有效 CVE ID，要求用户提供。
步骤 2：获取 CVE 详情页面内容
访问网页：https://alas.aliyuncs.com/api/portal/v1/cves/{cve-id}/，从中解析 CVE 相关信息。
步骤 3：解析页面内容
CVE 不存在的情况： Server Error。
CVE 存在时，提取以下关键信息：
| 字段 | 说明 |
|---|---|
| 评分 | Alibaba Cloud Linux 的 CVSS v3 评分 |
| 漏洞级别 | Critical / Important / Moderate / Low |
| 影响的产品 | 如 Alinux 4 |
| 软件包 | 受影响的软件包名 |
| 影响状态 | Fixed / Affected / Under Investigation / Not Affected / Won't Fix / Out Of Scope |
| 修复更新 | SA 公告编号，如 ALINUX4-SA-2026:0055 |
| 发布时间 | 修复更新发布时间 |
步骤 4：根据影响状态回复用户
匹配对应影响产品
获取当前产品信息，匹配当前产品的影响软件包信息
cat /etc/os-release
获取影响状态回复
Fixed（已修复）：
- 检查本地是否已应用修复：
rpm -q <受影响的软件包名> - 检查当前软件包版本低于修复版本，则询问用户是否升级，确认成功后执行下面命令升级
sudo yum update --advisory <SA-ID> -y
Affected（受影响）：
- 告知用户该 CVE 确认影响 Alinux 产品，修复更新正在准备中
- 建议用户关注后续更新
Under Investigation（调查中）：
- 告知用户该 CVE 正在分析评估中，尚未确认是否影响 Alinux 产品
Not Affected（不受影响）：
- 告知用户该 CVE 不影响 Alinux 产品，无需处理
Won't Fix（不予修复）：
- 告知用户虽然该 CVE 影响 Alinux 产品，但官方决定暂不修复
- 建议：升级到不受影响的产品版本，或尝试使用缓解方案
Out Of Scope（超出范围）：
- 告知用户该漏洞涉及的软件包不在 Alinux 产品服务支持范围
回复格式
## CVE-XXXX-XXXXX 查询结果
- **漏洞级别**：<级别> (评分: <分数>)
- **影响产品**：<产品名>
- **受影响软件包**：<包名>
- **影响状态**：<状态>
- **修复更新**：<SA编号>（如有）
- **概要**：<漏洞描述摘要>
### 建议操作
<根据状态给出的具体建议>
注意事项
- 一个 CVE 可能影响多个产品（如 Alinux 3 和 Alinux 4），需要匹配出当前产品的软件包信息
- 一个 CVE 可能影响多个软件包，则每个软件包以及其影响状态都单独显示
- 如果页面无法访问或解析失败，告知用户并建议直接访问 ALAS 安全中心：
https://alas.aliyuncs.com/cves
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 98 lines · 66 tokens per session scan B f5dc95b1d938
alinux-cve-query is a skill published in the GitHub repository alibaba/anolisa (619 stars, last pushed today), licensed Apache-2.0. It adds 66 tokens to every session and 898 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
beevibe-team-mesh-negotiation
Multi-round negotiation protocol — covers both initiator and peer roles. Use when about to call negotiate(), when receiving a intent block as a peer, or when receiving an 'escalated' sentinel from a blocked respondnegotiate. Covers proposal crafting, counter-strategy, deadlock detection, when to accept early…
beevibe-verify-pr
CI verification before marking a PR-bearing task done. Use BEFORE calling mcpbeevibeupdateprogress(done) on any session whose deliverable is a pull request — including the first dispatch (you opened the PR with gh pr create) and any revision dispatch (you pushed new commits to an existing PR). Watches the PR's…
beevibe-pre-task-setup
Cold-start git workspace setup for a fresh beevibe task. Use at the start of a session whose intent has a block but NO or block — i.e. the first dispatch of this task. Checks for an existing repo clone, pulls the base branch if present (clone if missing), prunes any per-task worktrees from earlier tasks whose work has…
beevibe-use-repo
You are the child agent inside a fresh Docker sandbox. Borrow the given GitHub repo, produce a real artifact for the goal, and export it. Do not review the repo. The proof is that it works.
beevibe-discover-repo
Find the best GitHub repo for a goal, then call userepo to run it in a sandbox. Use whenever the user's goal requires a capability you don't have natively and you haven't been given a specific repo.
atomicmemory
Persistent semantic memory across Claude Code sessions — user preferences, project context, prior decisions, codebase facts. Call memorysearch before answering questions that reference past work. Call memoryingest after the user shares durable facts.