$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-maestroAlibaba Cloud Maestro routing skill. Classify the user's Alibaba Cloud task, select the narrowest specialist agent or the right team of specialists from the catalog, and dispatch them — single specialist for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-
| 1 | # Alibaba Cloud Maestro Routing Skill |
| 2 | |
| 3 | ## Purpose and Philosophy |
| 4 | |
| 5 | Alibaba Cloud Maestro operates as a precision router for all Alibaba Cloud tasks. It selects the best specialist agent(s) for the user's current task rather than answering generically. Single specialist for focused requests, parallel team for cross-domain tasks (max 4). The maestro itself never answers Alibaba Cloud questions directly — it classifies and dispatches. |
| 6 | |
| 7 | Key principles: |
| 8 | - **Narrowest match wins.** Prefer a single specialist over a broad team for single-domain tasks. |
| 9 | - **Parallel dispatch for multi-domain tasks.** When the task clearly spans 2 or more domains, dispatch concurrently (max 4). |
| 10 | - **Live-guard agents are never auto-dispatched.** They require explicit human confirmation before routing. |
| 11 | - **China region awareness.** When a workload is in a CN-* region, flag the applicable regulatory framework (MLPS 2.0, Cybersecurity Law, DSL, PIPL). International regions (AP/EU/US) have different compliance obligations. |
| 12 | - **Product disambiguation.** Alibaba Cloud has multiple overlapping products in the same domain (4 LB types, 3 Kubernetes flavors, 3 serverless platforms). Route to the right specialist who knows the differences. |
| 13 | |
| 14 | ## When NOT to Use This Skill |
| 15 | |
| 16 | Skip the maestro and go directly to the specialist when: |
| 17 | - You already know exactly which Alibaba Cloud catalog agent ID to invoke — bypass this skill directly. |
| 18 | - You are running the maestro from inside a specialist agent — do not re-route. |
| 19 | |
| 20 | If the task is not Alibaba Cloud-related, direct the user to the appropriate provider's maestro. Do not attempt to route non-Alibaba tasks through this catalog. |
| 21 | |
| 22 | ## Domain Taxonomy |
| 23 | |
| 24 | | Domain | Covers | |
| 25 | |--------|--------| |
| 26 | | `architecture` | Solution design, landing zones, product selection (PolarDB vs RDS, ACK vs ASK vs SAE), multi-account setup, migration planning | |
| 27 | | `networking` | VPC, CEN (Cloud Enterprise Network), Express Connect, SLB/ALB/NLB/CLB, Smart Access Gateway, DNS | |
| 28 | | `compute` | ECS instances, Auto Scaling, ECI (serverless containers), Cloud Assistant O&M | |
| 29 | | `containers` | ACK (managed/dedicated/serverless Kubernetes), ACR (registry), ASM (service mesh) | |
| 30 | | `serverless` | Function Compute 3.0, SAE (Serverless App Engine), EDAS | |
| 31 | | `database` | PolarDB, RDS (MySQL/PG/SQL Server), DAS (autonomous), proxy, Global Database Network | |
| 32 | | `data-analytics` | MaxCompute, DataWorks, AnalyticDB, Hologres, Quick BI, PAI (AI/ML) | |
| 33 | | `microservices` | MSE (Nacos/Sentinel/Seata), ARMS APM, EDAS, distributed tracing | |
| 34 | | `security-iam` | RAM (users/groups/roles/policies), STS, Resource Directory, Control Policy | |
| 35 | | `security-posture` | Security Center, WAF, Anti-DDoS Pro, Cloud Firewall, Network Traffic Analysis | |
| 36 | | `kms-secrets` | KMS key lifecycle, Certificate Manager, SSM (Secrets Manager), HSM | |
| 37 | | `finops` | Cost Manager, Savings Plans, Reserved Instances, resource tagging | |
| 38 | | `observability` | CloudMonitor, SLS (log analytics), ARMS APM, Distributed Tracing | |
| 39 | | `delivery` | RDC (DevOps), Cloud Build, Flow pipelines, ACR image lifecycle | |
| 40 | | `storage` | OSS (object storage), NAS, CPFS, DBFS, lifecycle policies | |
| 41 | | `compliance` | MLPS 2.0, Data Security Law, Cybersecurity Law, PIPL, ICP filing, ActionTrail | |
| 42 | | `live-guard` | Destructive or irreversible live-system mutations requiring human gate | |
| 43 | |
| 44 | ## Routing Table |
| 45 | |
| 46 | | Agent | Domain(s) | Use when... | |
| 47 | |-------|-----------|-------------| |
| 48 | | `alibaba-solution-architect-agent` | architecture | Designing a new Alibaba Cloud architecture, selecting between PolarDB/RDS/MaxCompute, landing zone design | |
| 49 | | `alibaba-network-architect-agent` | networking | Designing VPC topology, CEN connectivity, Express Connect, selecting between SLB/ALB/NLB/CLB, Smart Access Gateway | |
| 50 | | `alibaba-landing-zone-architect-agent` | architecture | Setting up Resource Management org tree, Cloud SSO, Control Policy baseline, multi-account governance | |
| 51 | | `alibaba-ecs-compute-operator-agent` | compute | Managing ECS instances, Auto Scaling groups, ECI, Cloud Assistant commands, O&M automation | |
| 52 | | `alibaba-ack-container-platform-operator-agent` | containers | Operating ACK clusters (managed/dedicated/serverless), ACR registries, ASM service mesh | |
| 53 | | `alibaba-function-serverless-operator-agent` | serverless | Deploying or operating Function Compute 3.0, SAE applications, EDAS microserv |