albs-mcp-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited albs-mcp-dev (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Skill for developing the ALBS MCP server. After ANY code change, run tests and evals yourself — never ask the user to do it.
src/albs_mcp/
constants.py — URLs, status maps, EPEL defaults
client.py — ALBSClient: all HTTP calls to ALBS API
_commands.py — shared command functions: client management, formatting, business logic
server.py — thin @mcp.tool() wrappers delegating to _commands.py, server instructions
cli.py — CLI (argparse), delegates to _commands.py (no MCP dependency)
tests/
test_client_unit.py — client unit tests (mocked HTTP)
test_server_unit.py — server tool unit tests (mocked client via _commands)
test_cli_unit.py — CLI unit tests (mocked _commands functions)
test_integration.py — integration tests (real ALBS API, read-only)After ANY code change — no exceptions — do all of this yourself:
.venv/bin/python -m pytest tests/test_client_unit.py tests/test_server_unit.py tests/test_cli_unit.py -vevals/evals.json from this skill, verify ALL 23 cases against the current code (see "Running evals" below).venv/bin/python -m pip install -e .Never skip evals. Never ask the user to run them. Every change can break agent workflows in non-obvious ways.
Eval definitions live in evals/evals.json inside this skill directory — 23 cases across 5 categories.
After any code change:
evals/evals.jsoninstructions= in FastMCP()) and tool docstrings/signaturesFormat the report as a table with PASS/FAIL per category, then details for any failing criteria.
Every new tool MUST have eval cases. Follow this checklist in order:
client.py@mcp.tool() in server.py with docstringtest_client_unit.py and test_server_unit.pyserver.py if the tool changes agent workflowsREADME.md (tools reference table, examples)Step 5 is not optional. A tool without evals is not done.
Add directly to evals/evals.json in this skill:
{
"id": 21,
"name": "my_new_case",
"category": "tool_selection",
"prompt": "User's natural language request",
"expected_output": "Summary of correct agent behavior",
"criteria": [
"The agent calls my_new_tool with the correct arguments",
"The agent does NOT call unrelated_tool"
],
"files": []
}Criteria tips: be specific ("calls X with param=Y"), include negative checks ("does NOT do Z without asking").
The instructions= parameter in FastMCP() controls agent decision-making. After changes:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.