HOL Guard

Overview

HOL Guard is a local security boundary for AI coding-agent tool execution. This skill uses the published hol-guard CLI rather than implementing a second policy engine inside the marketplace. It is intended for workspaces where a user wants Guard-owned pre-execution checks, supported harness installation, approval review, receipts, or evidence that protection is active before an agent continues with trusted tool execution.

The normal path stays local. The skill does not require a Hashgraph Online account, API key, hosted service, or remote decision endpoint. It does not send workspace contents, prompts, package names, URLs, Guard findings, or approval data to a hosted HOL service. Harness configuration changes are made only by explicit hol-guard commands after the user requests protection.

Prerequisites

• A local workspace chosen by the user.
• pipx when HOL Guard needs to be installed.
• A supported harness such as Claude Code, Codex, Copilot CLI, Cursor, Gemini CLI, Hermes, OpenClaw, OpenCode, or Antigravity.
• User approval before installing software or changing harness protection.

Never read .env files, credential stores, private keys, or unrelated secrets. Never bypass a Guard approval. Preserve existing workspace changes and do not edit harness or repository configuration manually to work around Guard.

Instructions

1. Inspect current Guard state. Run hol-guard status. If the command is unavailable, do not silently alter the Python environment. Explain that HOL Guard is missing and offer the pinned local installation only when the user asked for setup or explicitly approves it:

   pipx install hol-guard==3.0.46

1. Detect the local harness. After HOL Guard is available, inspect supported harness state with:

   hol-guard detect --json

Use the detected harness when it matches the user's intended tool. Common supported names include claude-code, codex, copilot, cursor, gemini, hermes, openclaw, opencode, and antigravity.

1. Preview protection before applying it. When the user asked to protect a harness, run the Guard-owned setup and dry-run path rather than editing harness configuration manually:

   hol-guard bootstrap
   hol-guard install <harness>
   hol-guard run <harness> --dry-run

Inspect the dry-run output. Do not claim the workspace is protected merely because installation returned without an obvious error.

1. Apply the protected run only after the preview is…

Plugin Scanner

Overview

Use HOL's local plugin-scanner when a user asks to inspect an AI agent skill, plugin, MCP server, agent package, or repository before installation or use. The scanner is shipped by the open-source plugin-scanner Python distribution. It is built from the same HOL Guard source repository, but it is intentionally packaged separately from the hol-guard runtime CLI.

Scanning runs locally and does not require Guard Cloud. Treat scanner findings as evidence about the covered checks, not as a guarantee that a target is safe.

Prerequisites

• A local path or repository the user has chosen to inspect.
• pipx only when plugin-scanner is not already installed and the user approves installation.
• Do not execute the target repository, its install scripts, package lifecycle hooks, or arbitrary shell commands to prepare a scan.
• Never read .env files, credential stores, private keys, or unrelated user secrets.

Instructions

1. Check for the scanner. Run the read-only availability check:

   command -v plugin-scanner

If it is unavailable, explain that plugin-scanner is a separate open-source CLI distribution from the HOL Guard repository. Install only after the user explicitly approves setup, using the exact reviewed package version:

   pipx install plugin-scanner==3.0.123

Do not assume an existing hol-guard installation also provides the scanner command. If pipx is unavailable, point the user to the plugin-scanner installation instructions rather than silently changing their Python environment.

1. Scan the target without executing it. For a repository or directory:

   plugin-scanner scan PATH --format markdown

For machine-readable results:

   plugin-scanner scan PATH --format json

For Agent Skill or plugin structure validation:

   plugin-scanner lint PATH
   plugin-scanner verify PATH

Use the narrowest local target path that contains the material the user asked to inspect.

1. Interpret findings. Identify the highest-severity result, the concrete files or rules involved, and whether the scanner found prompt-injection, secret/exfiltration, command-execution, dependency/install, or MCP-specific risks. Recommend the smallest next action supported by the evidence.

Output

Return a concise result containing:

• the local target that was scanned;
• whether plugin-scanner was already available or installed with explicit user approval;
• t…