About the findbugs:check goal, the documentation writes:
Fail the build if there were any FindBugs violations in the source code. An XML report is put out by default in the target directory with the errors. To see more documentation about FindBugs' options, please see the FindBugs Manual.
So this is precisely the goal you're looking for. You now just have to bind the check goal to the install verify phase (the verify phase occurs just before install and is actually made to run any checks to verify the package is valid and meets quality criteria so I think it's a better choice):
<project>
...
<build>
<plugins>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>findbugs-maven-plugin</artifactId>
<version>2.0.1</version>
<configuration>
<effort>Max</effort>
<threshold>Low</threshold>
<xmlOutput>true</xmlOutput>
</configuration>
<executions>
<execution>
<phase>verify</phase>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
...
</plugins>
...
</build>
...
</project>
Of course, adapt the configuration to suit your needs.