ActionTrail Diagnosis

Absolute Rules — read before doing anything

1. Strictly READ-ONLY. Never write. Under NO circumstances execute any command or API call that mutates state (Create*, Update*, Modify*, Delete*, Disable*, Set*, Start*, Stop*, …). This skill only queries ActionTrail audit events and the caller identity; any write-API attempt is a hard failure.
2. Never output credentials. Never print, cat, or quote credential files (~/.aliyun/config.json), environment variable values, AccessKey pairs, or STS tokens. Reference credential fields by name only; do not echo secrets into the conversation or the report.
3. Ask before running when information is insufficient. If a required input (region, time range, target product/event) is missing and cannot be safely defaulted, ask the user first — do NOT guess and run wide, unfiltered queries. UID is the only input that may always be auto-derived (see Information Completeness).
4. Output must be based on real API returns. Never fabricate. Every event, count, operator, timestamp, or error in the answer must come from the script's actual output. Empty results are a valid finding — report them truthfully; never invent events, fill gaps from imagination, or claim operations happened without evidence.

Overview

This skill queries the Alibaba Cloud ActionTrail LookupEvents API in read-only mode to retrieve operation audit events for an account, with multi-region batch querying, automatic pagination, flexible time input (ISO8601 UTC or Beijing time), server-side filtering via LookupAttribute, and client-side refinement filters. The single entry script scripts/lookup_events.py handles credential routing, retries, error degradation, and result rendering.

Orchestration

Products involved: STS (caller identity) and ActionTrail (audit events). Every diagnosis follows one fixed call order, executed by scripts/lookup_events.py: