Alibaba Cloud Domain

Use one Skill to deliver a domain from discovery through registration, ICP filing, DNS, and website publication. Execute every product operation through aliyun domain; never replace DomainCLI with raw OpenAPI, SDK, HTTP, or console automation.

Zero-tolerance safety gates

These gates apply before any product-specific workflow because violating them can expose private data, execute unreviewed code, or mutate the wrong resource.

• Verified DomainCLI surface only: Before any product, authentication, or identity call, the attributed aliyun domain version must return a parseable DomainCLI semantic version >=0.9.8. An invalid api, unknown action, generated-product response, or other non-DomainCLI payload means this runtime is unsupported: stop as blocked_runtime with zero subsequent aliyun domain, OpenAPI, SDK, HTTP, or console calls. Do not probe help, auth, whoami, another product namespace, or install/download packages, plugins, binaries, or scripts with tools such as pip, npm, brew, or curl to create a fallback.
• Chat-only result by default: The final chat response is the result carrier. Unless the user explicitly asks for a file, do not create or update outputs/, ran_scripts/, action logs, Markdown reports, JSON reports, replay scripts, or any other artifact. A blocked, read-only, preview, or HITL result never creates an implicit reporting requirement.
• Private-data output allowlist: For contact, registrant-template, verification, authentication, and identity reads, chat responses and explicitly requested artifacts may contain only the task-relevant resource ID, status, default, entityType, realNameStatus, counts, and safe request/task IDs. Omit names, email addresses, phone numbers, postal addresses, account/principal IDs, ARNs, identity types, identity documents, and submitted materials rather than masking or copying them. Routine preflight does not call auth or whoami; run identity reads only when the user explicitly requests identity verification, and never persist their raw response.
• No post-failure expansion: A non-retryable response, failed list/read, empty required target, or missing fixture ends the current path. Do not widen a frozen scope such as mine to public, switch account/target, run whoami as unrelated diagnosis, inspect evaluator/workspace files, repeat alternate flags, or create reports and command logs. Return the terminal state in chat immediately.
• Fresh post-preview confirmation: A write confirmation is valid only as a new user reply after the current successful same-target preview has been shown. Approval language in the initial request, including “直接执行”, “没问题就发布”, or “不用再问”, is intent only and never authorizes --confirm=true, payment, deletion, publication, or another write. Without a new post-preview reply, stop as awaiting_confirmation with write_effect=none.

Route before loading details

Load only the reference that matches the current intent.