albs-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited albs-cli (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CLI for AlmaLinux Build System. Use albs commands via Shell when the ALBS MCP server is not enabled.
albs platforms # list platforms and architectures
albs build-info BUILD_ID # build details, tasks, statuses
albs failed-tasks BUILD_ID # failed tasks with log files
albs build-logs BUILD_ID # list all log files on server
albs download-log BUILD_ID FILENAME # download a log file
albs log-search BUILD_ID FILENAME [-e RE] # grep a log for the failure, with context
albs log-tail BUILD_ID FILENAME # a page from the end; --before-line N pages up
albs log-range BUILD_ID FILENAME START END # specific line range
albs search [--project NAME] [--page N] # search builds
albs sign-keys # list sign keys (requires JWT)
albs flavors # list platform flavors
albs create-build PLATFORM PKG [PKG...] # create build (requires JWT)
albs sign-build BUILD_ID [--key-id N] # sign build (requires JWT)
albs products # list products (release targets)
albs release-plan RELEASE_ID # view an existing release plan
albs create-release-plan BUILD_ID \ # create a release plan (requires JWT)
--platform NAME --product NAME # (never performs the actual release)
albs errata ERRATA_ID [--platform NAME] # view an advisory
albs preview-errata BUILD [BUILD...] \ # preview AlmaLinux advisories (creates nothing)
--package NAME --cve CVE [--cve CVE...] # (or --rhsa RHSA-...)
albs create-errata BUILD [BUILD...] \ # create them (requires JWT)
--package NAME --cve CVE [--cve CVE...] # (--force: despite !! DUPLICATE)Authentication: --token TOKEN flag or ALBS_JWT_TOKEN env var.
Follow this exact order:
albs build-info BUILD_ID — see all tasks and statuses.albs failed-tasks BUILD_ID — see failed tasks with log file names. Logs marked with ★ are key: mock_root, mock_stderr, mock_build.albs log-search BUILD_ID FILENAME — grep the log for the standard failure signatures (compiler errors, failed patch hunks, unresolved BuildRequires, RPM errors, %check failures, OOM/network trouble) and get each hit with its line number and context. It auto-downloads, so download-log is optional. Run it on mock_root, mock_stderr, AND mock_build.albs log-tail BUILD_ID FILENAME — see how the build terminated. Do NOT stop here: make -j keeps compiling after the first failure, so the tail of a mock_build log shows only make: *** [Makefile:NNNN: all] Error 2 — the symptom. Reporting that as the root cause is a wrong answer.albs log-range BUILD_ID FILENAME START END — widen the context around a line number log-search reported.albs log-tail, then copy the ↑ earlier: command printed at the bottom of the output, and repeat. Pages are sized to the result budget and join up exactly — guessing a log-range window is how you miss the error.IMPORTANT: mock_build logs can be 100k+ lines with single lines several KB long. NEVER read the whole file. Lines are clipped to 500 chars and each result to 40000 chars (--max-line-chars 0 / --max-chars 0 to lift); leave both on for broad reads and page instead.
ASK the user for: package name(s), platform, and build method (branch/tag/SRPM). If architectures are not specified, do NOT ask — use platform defaults.
# From branch
albs create-build AlmaLinux-9 bash --branch c9s
# From tag (format: "pkg_name tag_name" in quotes)
albs create-build AlmaLinux-9 "bash imports/c9s/bash-5.1-1.el9" --from-tag
# From SRPM URL
albs create-build AlmaLinux-10 https://example.com/pkg.src.rpm --from-srpm
# Multiple packages
albs create-build AlmaLinux-9 bash glibc openssl --branch c9s
# Skip tests
albs create-build AlmaLinux-9 bash --branch c9s --skip-tests
# Independent tasks (packages build in parallel within the platform,
# instead of the default sequential per-platform chain)
albs create-build AlmaLinux-9 bash glibc openssl --branch c9s --independent-tasksWhen building from EPEL SRPMs (dl.fedoraproject.org/pub/epel/):
--add-epel-dist, UNLESS they already mentioned it.--flavor EPEL-10 --flavor EPEL-10_altarch--flavor EPEL-10 --flavor EPEL-Kitten_altarch--arch x86_64_v2 unless the user specified different architectures.albs create-build AlmaLinux-10 https://dl.fedoraproject.org/.../pkg.src.rpm \
--from-srpm --add-epel-dist --arch x86_64_v2 \
--flavor EPEL-10 --flavor EPEL-10_altarchalbs build-info BUILD_ID — present summary to user: platform, arches, packages, flavors.albs sign-keys — show available keys.albs sign-build BUILD_ID --key-id NThis CLI can CREATE a release plan but NEVER performs the actual release (it does not commit/publish). Creating a plan is safe — ALBS records a "scheduled" release and computes which packages go where, but nothing is published.
albs build-info BUILD_ID — confirm the platform and that the build has completed tasks.albs products — list products (release targets) so the user can pick one. ASK the user for the target platform and product.albs create-release-plan BUILD_ID --platform NAME --product NAME — collects the completed build tasks automatically and creates the scheduled plan.--whole-packages-only so only packages whose every arch task completed are included.albs release-plan RELEASE_ID — view an existing plan later.albs products
albs create-release-plan 62316 --platform AlmaLinux-8 --product AlmaLinuxThe actual release (albs commit-release) is intentionally blocked — only plans are supported.
AlmaLinux-issued advisories are ALSA-YYYY:A001, A002, … — one counter per year for all platforms.
The user gives ONLY: the package or module name (kernel, nodejs:24) and its CVE(s) — or one RHSA — plus ALBS build IDs or build URLs (a build may contain other packages too). Everything else is automatic — do NOT ask for it: ID, dates (today unless the user names one), title (<package> security update), description (package text from the newest earlier advisory for the package + the CVE fix list), CVE information and references (CVE + bugzilla) from Red Hat, module, packages. With --rhsa, title, description, CVEs and severity all come from the RHSA.
albs preview-errata BUILD... --package NAME --cve CVE [--cve CVE...] (or --rhsa RHSA-...) — all CVEs and builds in one command; creates nothing. One advisory per platform and package — a build and its retry build merge into one.NOTE (a CVE Red Hat does not tie to the package, no earlier advisory to take the package text from). ALWAYS report EVERY failed or cancelled build task (!!! banner, ! FAILED / ! CANCELLED lines — also printed by create-errata and in errors), even when a retry build covers it or the package is left out; when packages are missing from an advisory, ask about a retry build.--package NAME. If it shows !! DUPLICATE (an existing advisory on the same platform already covers these CVEs for the same package — e.g. the ALSA imported from the RHSA), tell the user and STOP: create-errata refuses it; add --force only when the user explicitly wants a second advisory anyway. NOTEs about the same CVE in another package's advisory are informational.albs create-errata with the same arguments. IDs are re-assigned right before creating — never pick them yourself.albs errata ALSA-YYYY:Annn — confirm it exists (ALBS stores advisories in the background, allow a few seconds; never re-create it). Creating an advisory does not release it.albs preview-errata 54743 54740 54757 --package kernel --cve CVE-2026-31431
albs create-errata 54743 54740 54757 --package kernel --cve CVE-2026-31431
albs preview-errata 54740 54757 --rhsa RHSA-2026:13566
albs errata ALSA-2026:A011products, release-plan, errata, preview-errata are read-only.AlmaLinux-Kitten-10). Use albs platforms to verify.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.