Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/aliyun/alibabacloud-agent-toolkitnpx agentmods add skills/aliyun/alibabacloud-agent-toolkit/alibabacloud-validateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliyun/alibabacloud-agent-toolkit/alibabacloud-validate)<a href="https://agentmods.dev/skills/aliyun/alibabacloud-agent-toolkit/alibabacloud-validate"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-agent-toolkit/alibabacloud-validate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliyun/alibabacloud-agent-toolkit/alibabacloud-validate"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-agent-toolkit/alibabacloud-validate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.02096 |
| Opus 5 | $0.00040 | $0.01048 |
| Sonnet 5 | $0.00016 | $0.00419 |
| Haiku 4.5 | $0.00008 | $0.00210 |
Grade A, and why
alibabacloud-validate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 220 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Alibaba Cloud Validate
AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE
This skill performs dual review: requirement compliance AND code quality. Both reviews MUST be dispatched as independent subagents running in parallel.
Remote Terraform syntax validation (
aliyun iacservice validate-module) is owned byalibabacloud-terraform-codegenStep 6 — by the time control reaches this skill, syntax has already passed remotely. Do NOT re-invokeiacservice validate-modulehere.
PREREQUISITE CHECK (internal — do not expose these checks to user)
Before proceeding, verify:
tasks/status.jsonexists withstatus: "plans-written"designs/terraform/contains generated .tf filesIf missing, STOP and inform the user that code generation needs to complete first.
Triggers
Activate when:
- Writing-plans phase is complete
- User explicitly asks to validate Terraform code
- User asks for code review of infrastructure code
Rules
- Mode-aware validation — Check
tasks/status.jsonfor"mode"field to determine validation depth - Independent subagents — In Full Mode, Stage 1 and Stage 2 MUST use the
Agenttool in parallel - Fix before passing — Do not set status to "validated" with unresolved issues
- Record proof — Write validation results to tasks/validation-report.md
- No execution — This skill validates only, never runs terraform apply
Mode Detection
Read tasks/status.json and check the "mode" field:
| Mode | Validation Depth | Stages |
|---|---|---|
"fast-track" |
None — trust codegen | Skip both reviews; transition straight to validated |
"full" or absent |
Spec compliance + code quality | Stage 1 + Stage 2 (parallel subagents) |
Fast Track Validation
If mode is "fast-track", skip both Stage 1 and Stage 2. Syntax has
already been validated remotely by terraform-codegen Step 6, and the
simplified design opts out of deeper review. The action sequence is:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 220 lines · 80 tokens per session scan A d185357a2f6b
alibabacloud-validate is a skill published in the GitHub repository aliyun/alibabacloud-agent-toolkit (21 stars, last pushed 10d ago), licensed Apache-2.0. It adds 80 tokens to every session and 2,096 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
alibabacloud-ecs-windows-os-troubleshooting
Troubleshoot and repair Alibaba Cloud ECS Windows instances from inside the GuestOS or remotely via Cloud Assistant. Use whenever the user reports any Windows symptom or asks for a health check on an ECS Windows instance, even vague ones like "check this machine": boot failures (BSOD, black screen, boot loop, stuck at…
alibabacloud-ecs-linux-os-troubleshooting
Troubleshoot an Alibaba Cloud ECS Linux OS. Use when a user needs to diagnose a specified ECS Linux instance, such as instance stuck in Starting, boot stuck, SSH/VNC/Workbench login failure, network issues, disk/FS issues, performance anomalies, suspected mining or hidden processes, crash/hang, clock drift, or…
atmos-aws-compliance
AWS compliance commands in Atmos: atmos aws compliance report, Security Hub standards, CIS AWS, PCI DSS, SOC2, HIPAA, NIST, report formats, AI summaries.
c2pa-metadata
Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2…
compliance-checker
Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check affiliate disclosure", "am I FTC compliant", "audit my content", "compliance review", "legal check", "platform rules check", "check…
self-improver
Review affiliate campaign results and improve strategy. Triggers on: "review my results", "what went wrong", "how to improve conversions", "analyze my campaign", "affiliate retrospective", "why am I not converting", "improve my strategy", "what should I change", "campaign review", "optimize my approach", "learn from…