From vanguard-frontier-agentic
Gates RAM policy/role mutations on Alibaba Cloud with blast-radius assessment, STS token impact analysis, and authority approval. Prevents accidental AdministratorAccess or Control Policy changes.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:alibaba-live-ram-policy-change-guardThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Act as the guarded live Alibaba Cloud operator for alibaba-live-ram-policy-change-guard work. Gate every RAM policy mutation, role change, and Control Policy modification with explicit blast-radius assessment and authority approval. Treat AdministratorAccess assignment as the highest-risk category — it is account-wide and irreversible without deliberate rollback.
Act as the guarded live Alibaba Cloud operator for alibaba-live-ram-policy-change-guard work. Gate every RAM policy mutation, role change, and Control Policy modification with explicit blast-radius assessment and authority approval. Treat AdministratorAccess assignment as the highest-risk category — it is account-wide and irreversible without deliberate rollback.
Use this skill when:
Do not use this skill when:
Before executing any RAM mutation, verify all of the following:
aliyun ram GetAccountAlias or the console.aliyun ram ListPoliciesForRole or aliyun ram ListPoliciesForUser.The operator must explicitly state all of the following before any mutation is executed:
<ACCOUNT_ID>."<RAM_USER_NAME / ROLE_NAME> and the policy change is <ATTACH/DETACH/CREATE/DELETE> <POLICY_NAME>."<scope statement>."<acceptable / none known>."AliyunRAMFullAccess (assumed via STS for specific change only).aliyun ram AttachPolicyToRole --PolicyType <System/Custom> --PolicyName <NAME> --RoleName <ROLE>aliyun ram DetachPolicyFromRole --PolicyType <System/Custom> --PolicyName <NAME> --RoleName <ROLE>aliyun ram AttachPolicyToUser --PolicyType <System/Custom> --PolicyName <NAME> --UserName <USER>aliyun ram DeletePolicy --PolicyName <NAME>aliyun ram CreatePolicy --PolicyName <NAME> --PolicyDocument <DOCUMENT>DetachPolicyFromRole or DetachPolicyFromUser. Effect is immediate.AdministratorAccess from the principal immediately if granted in error.aliyun ram ListPoliciesForRole --RoleName <ROLE> or aliyun ram ListPoliciesForUser --UserName <USER> — confirm the policy list reflects the intended change.EventName containing the mutation operation.npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticAudits Alibaba Cloud RAM IAM: users, groups, roles, policies, STS tokens, Resource Directory Control Policies, and privilege escalation paths.
Hardens AWS IAM configurations to enforce least privilege access via policy scoping, permission boundaries, Access Analyzer integration, and credential rotation. Useful for audits, new accounts, and fixing permissive policies.
Corrects AI mistakes on AWS IAM pitfalls: policy evaluation edge cases, STS session limits, Organizations quirks, SAML/MFA specifics. Use when working with IAM roles, policies, STS, Organizations.