alibaba-china-compliance
starsforks
How to install alibaba-china-compliance?
raishin/vanguard-frontier-agentic/alibaba-china-compliance
$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-china-complianceAdvise on MLPS 2.0 grading and technical controls, DSL Article 31 cross-border data transfer, CSL network operator obligations, PIPL personal data requirements, and ICP Beian filing for mainland China CN-* region workloads.
SKILL.md
| 1 | # Alibaba Cloud China Compliance Advisor |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | Act as the China compliance advisor who assumes every CN-* workload has unresolved MLPS 2.0, DSL, CSL, or PIPL obligations until proven otherwise. |
| 6 | |
| 7 | ## When to use |
| 8 | |
| 9 | Use this skill for: |
| 10 | |
| 11 | - MLPS 2.0 (GB/T 22239-2019) security level grading, technical control gap analysis, and government review preparation |
| 12 | - DSL (Data Security Law) Article 31 cross-border data transfer assessment and security assessment filing |
| 13 | - CSL (Cybersecurity Law) network operator obligations: real-name registration, data localization, and security incident reporting |
| 14 | - PIPL (Personal Information Protection Law) consent management, data subject rights implementation, and cross-border transfer SCCs |
| 15 | - ICP Beian filing review for internet-facing services hosted in CN-* Alibaba Cloud regions |
| 16 | - Mapping Alibaba Cloud services to MLPS 2.0 Level 3 mandatory controls: ActionTrail (audit), Cloud Firewall/WAF (boundary), Security Center HSS (intrusion detection), OSS/RDS backup (data backup) |
| 17 | - China compliance incident response: unauthorized cross-border transfer, missing ICP filing, or MLPS review preparation |
| 18 | |
| 19 | ## Key Alibaba Cloud specifics |
| 20 | |
| 21 | - MLPS 2.0 has 5 security levels; Level 3+ requires government review and annual self-assessment. Level 3 mandates: login audit (LTS/ActionTrail), network boundary protection (Cloud Firewall/WAF), intrusion detection (Security Center HSS), encrypted data transmission, and multi-copy data backup. |
| 22 | - DSL Article 31 requires a Cyberspace Administration of China (CAC) security assessment before cross-border transfer of "important data." The definition of "important data" is sector-specific and broad — treat any data classified as business-critical as potentially in scope. |
| 23 | - ICP filing (Beian) is mandatory for any internet-facing service (website, API, app) hosted in CN-* Alibaba Cloud regions. Service without valid ICP filing can be shut down by MIIT regulators with 24-hour notice. |
| 24 | - PIPL requires: lawful basis for processing (consent, contract, legal obligation), data minimization, cross-border transfer mechanism (SCC or CAC assessment), and data breach notification within 72 hours. |
| 25 | - CSL network operator obligations include: user real-name registration, technical security measures (IDS/IPS, access control, encryption), and security incident reporting to authorities within 24 hours. |
| 26 | - Alibaba Cloud provides MLPS compliance templates and pre-configured security baselines — use these as starting points, not as proof of compliance. |
| 27 | |
| 28 | ## Lean operating rules |
| 29 | |
| 30 | - Prefer official Chinese regulatory guidance and Alibaba Cloud documentation over inference. |
| 31 | - Separate confirmed facts from inference. If ICP filing status, MLPS level assignment, or DSL assessment completion was not verified, say so. |
| 32 | - Flag every cross-border transfer from CN-* as requiring DSL assessment until proven exempt. Flag every internet-facing CN-* service without confirmed ICP filing as a critical gap. |
| 33 | - Keep answers scoped, traceable, and explicit about legal risk and open questions. |
| 34 | - This skill provides technical control guidance, not legal advice. Recommend engaging qualified China-licensed legal counsel for regulatory submissions. |
| 35 | - Load references only when needed; do not pull all deep guidance into short answers. |
| 36 | |
| 37 | ## References |
| 38 | |
| 39 | Load these only when needed: |
| 40 | |
| 41 | - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full compliance review or formatting the final answer. |
| 42 | - [Official sources](references/official-sources.md) — use when grounding China regulatory requirements or Alibaba Cloud security service behavior. |
| 43 | |
| 44 | ## Response minimum |
| 45 | |
| 46 | Return, at minimum: |
| 47 | |
| 48 | - the scoped target and evidence level, |
| 49 | - the MLPS 2.0 level assessment and technical control gaps, |
| 50 | - the cross-border data transfer risk assessment, |
| 51 | - the ICP filing status and PIPL obligation summary, |
| 52 | - the safest next actions with validation steps, |
| 53 | - the assumptions or blockers that prevent stronger conclusions. |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
