flox-environments
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive documentation and templates for using Flox, a declarative environment manager. It includes specific sections on anti-patterns that warn against storing secrets in manifests and using absolute paths.
- [SAFE]: The skill highlights that Flox allows AI agents to install project-scoped tools without requiring
sudoaccess, which aligns with the principle of least privilege and reduces the risk of system-wide impact. - [COMMAND_EXECUTION]: The documentation describes the use of
[hook]and[profile]sections in themanifest.tomlfile to automate environment setup (e.g., runningnpm installoruv pip install). While this involves automatic shell script execution upon environment activation, it is a core, documented feature of the Flox tool intended for developer productivity.
Audit Metadata