albs-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited albs-cli (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CLI for AlmaLinux Build System. Use albs commands via Shell when the ALBS MCP server is not enabled.
albs platforms # list platforms and architectures
albs build-info BUILD_ID # build details, tasks, statuses
albs failed-tasks BUILD_ID # failed tasks with log files
albs build-logs BUILD_ID # list all log files on server
albs download-log BUILD_ID FILENAME # download a log file
albs log-tail BUILD_ID FILENAME [-n LINES] # last N lines (default 3000)
albs log-range BUILD_ID FILENAME START END # specific line range
albs search [--project NAME] [--page N] # search builds
albs sign-keys # list sign keys (requires JWT)
albs flavors # list platform flavors
albs create-build PLATFORM PKG [PKG...] # create build (requires JWT)
albs sign-build BUILD_ID [--key-id N] # sign build (requires JWT)
albs products # list products (release targets)
albs release-plan RELEASE_ID # view an existing release plan
albs create-release-plan BUILD_ID \ # create a release plan (requires JWT)
--platform NAME --product NAME # (never performs the actual release)Authentication: --token TOKEN flag or ALBS_JWT_TOKEN env var.
Follow this exact order:
albs build-info BUILD_ID — see all tasks and statuses.albs failed-tasks BUILD_ID — see failed tasks with log file names. Logs marked with ★ are key: mock_root, mock_stderr, mock_build.albs download-log BUILD_ID FILENAME — download the key log. Start with mock_root (dependency issues), then mock_stderr, then mock_build.albs log-tail BUILD_ID FILENAME — read from the end. Errors are almost always at the bottom. Default is 3000 lines.albs log-range to look at earlier sections.IMPORTANT: mock_build logs can be 100k+ lines. NEVER read the whole file. Always use log-tail first.
ASK the user for: package name(s), platform, and build method (branch/tag/SRPM). If architectures are not specified, do NOT ask — use platform defaults.
# From branch
albs create-build AlmaLinux-9 bash --branch c9s
# From tag (format: "pkg_name tag_name" in quotes)
albs create-build AlmaLinux-9 "bash imports/c9s/bash-5.1-1.el9" --from-tag
# From SRPM URL
albs create-build AlmaLinux-10 https://example.com/pkg.src.rpm --from-srpm
# Multiple packages
albs create-build AlmaLinux-9 bash glibc openssl --branch c9s
# Skip tests
albs create-build AlmaLinux-9 bash --branch c9s --skip-tests
# Independent tasks (packages build in parallel within the platform,
# instead of the default sequential per-platform chain)
albs create-build AlmaLinux-9 bash glibc openssl --branch c9s --independent-tasksWhen building from EPEL SRPMs (dl.fedoraproject.org/pub/epel/):
--add-epel-dist, UNLESS they already mentioned it.--flavor EPEL-10 --flavor EPEL-10_altarch--flavor EPEL-10 --flavor EPEL-Kitten_altarch--arch x86_64_v2 unless the user specified different architectures.albs create-build AlmaLinux-10 https://dl.fedoraproject.org/.../pkg.src.rpm \
--from-srpm --add-epel-dist --arch x86_64_v2 \
--flavor EPEL-10 --flavor EPEL-10_altarchalbs build-info BUILD_ID — present summary to user: platform, arches, packages, flavors.albs sign-keys — show available keys.albs sign-build BUILD_ID --key-id NThis CLI can CREATE a release plan but NEVER performs the actual release (it does not commit/publish). Creating a plan is safe — ALBS records a "scheduled" release and computes which packages go where, but nothing is published.
albs build-info BUILD_ID — confirm the platform and that the build has completed tasks.albs products — list products (release targets) so the user can pick one. ASK the user for the target platform and product.albs create-release-plan BUILD_ID --platform NAME --product NAME — collects the completed build tasks automatically and creates the scheduled plan.--whole-packages-only so only packages whose every arch task completed are included.albs release-plan RELEASE_ID — view an existing plan later.albs products
albs create-release-plan 62316 --platform AlmaLinux-8 --product AlmaLinuxThe actual release (albs commit-release) is intentionally blocked — only plans are supported.
products, release-plan (viewing) are read-only.AlmaLinux-Kitten-10). Use albs platforms to verify.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.