cpv-batch-security-audit

/cpv-batch-security-audit — Security audit every plugin in a marketplace

For users who maintain a marketplace and need a fleet-wide security snapshot, this command dispatches one cpv-plugin-validator-agent per plugin in batch_security_audit mode. The agent runs only the validate_security checker (faster than full plugin validation, and covers the most important signal: external CC-Audit / Tirith / TruffleHog / Semgrep / Cisco AI Defense / in-process rule findings).

Same input grammar and dispatch shape as /cpv-batch-validate — single plugin / single plugin URL / marketplace local / marketplace URL / list / @listfile / comma-separated.

You are the orchestrator

You — the model running THIS turn — orchestrate the batch from the main session. You do NOT scan anything yourself.

Step 0 — Resolve arguments

The user supplies a target spec (required; first positional — accepts every shape listed above) plus an optional --max-parallel N (default 8, cap 16).

If no target was given, ask plain-text:

Which marketplace, plugin, or list should I security-audit? Provide a path, URL, or @listfile.

Step 1 — Build the batch plan

# Separate the positional target specs from the --max-parallel flag in a
# single pass. We must NOT collapse to "$1": the input grammar above lists
# a whitespace-separated LIST (`./a ./b ./c`) as a valid shape, and the
# orchestrator's `plan` subcommand declares its inputs as `nargs="+"`, so
# every positional must be forwarded — using only "$1" would silently
# audit the first plugin and drop the rest.
#
# Both --max-parallel N (two tokens) and --max-parallel=N (one token) are
# handled, because argparse accepts the `=` form and a user may type it.
# Default 8; the orchestrator re-caps at 16, so a larger N is safe to pass.
BATCH_SPECS=()
MAX_PARALLEL=8
while [ "$#" -gt 0 ]; do
  case "$1" in
    --max-parallel)
      MAX_PARALLEL="$2"
      shift 2
      ;;
    --max-parallel=*)
      MAX_PARALLEL="${1#--max-parallel=}"
      shift
      ;;
    *)
      BATCH_SPECS+=("$1")
      shift
      ;;
  esac
done

if [ "${#BATCH_SPECS[@]}" -eq 0 ]; then
  echo "ERROR: no target spec given to /cpv-batch-security-audit" >&2
  exit 1
fi

python3 "${CLAUDE_PLUGIN_ROOT}/scripts/cpv_batch_orchestrator.py" plan \
  "${BATCH_SPECS[@]}" \
  --agent cpv-plugin-validator-agent \
  --mode batch_security_audit \
  --max-parallel "$MAX_PARALLEL"