Synopsis
Description
Finds the plugin<target> names, validates it, lists what it will and will not look at, scans each component with SkillSpector, and scores the plugin from 0 to 100 by its worst component.
Higher is better.
audit measures security only.
Whether a plugin follows the specification is flox agent check-plugin’s job.
SkillSpector always runs statically, as skillspector scan <skill> --no-llm --format json.
Nothing in the plugin is executed.
The target
A target is a path or a package, decided by how it is written. A path is., .., or anything starting with ./, ../, /, or ~/.
If the path holds plugin.json, it is the plugin.
Otherwise every plugin under its share/agent-plugins/ is audited, so $FLOX_ENV and a ./result from a build both work.
Anything else is a catalog package, with @<version> allowed.
audit installs it into a temporary environment, audits it, and deletes the environment when it finishes or is interrupted.
A flake reference, which holds : or #, is refused.
There is no shorthand for an installed plugin.
flox agent audit caveman audits the catalog package caveman; audit an installed plugin by its path, such as "$FLOX_ENV/share/agent-plugins/caveman".
Options
Options can go on either side of<target>.
What is checked
The summary lists every entry under one of these headings.
The score says nothing about the entries that were not checked.
Score
Each scanned component scores100 - risk, using SkillSpector’s risk model.
The plugin scores its worst component, and several plugins score their worst plugin.
A scan SkillSpector reports as partial is still scored and marked
partial.
When a partial scan covered less than 100% of a skill, the skill is incomplete rather than safe, and the result fails any --threshold.
Exit status
Requirements
skillspectoronPATH, from theagent-stacks/skillspectorpackage.- Network access to
api.osv.dev, for live vulnerability data.
flox agent doctor shows the SkillSpector version audit will use.
Examples
Audit a catalog package before installing it:safe: