← All skills
hol-guard-protection
10 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By hashgraph-online/hol-guard (GitHub) · security · 1,084 stars · scanned at commit 6f3e819
Use HOL Guard to preview and protect AI-agent package installs, Cursor surfaces, CI, and automation workflows.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 11 places.
Show 8 more
- docs/guard/extensions/catalog.v2.json, line 1
{"entries":[{"actionClasses":["AgentBridge forced plugin scaffold command","AgentBridge run with tool registry command"],"authoringSource":{"byteDigest":"sha256 - docs/guard/release-3-0-containment-baseline.md, line 44
| Timeout | `subprocess.TimeoutExpired` → `os.killpg` | `subprocess.TimeoutExpired` → `os.killpg` | `containment_executor.py:298-315` | - docs/guard/security/sonar-hook-bridge-argv-review.json, line 8
"reason": "The rule reports faulty LLM-supplied CLI arguments reaching subprocess.run in main(). No element of that argv is model-supplied, and nothing derived - docs/guard/security/sonar-hook-bridge-argv-review.md, line 19
arguments" against the `subprocess.run(argv, check=False)` call in - scripts/ci/cigar_source_currentness_probe.py, line 51
with subprocess.Popen( - scripts/ci/cigar_source_currentness_probe.py, line 53
stdin=subprocess.PIPE, - scripts/ci/cigar_source_currentness_probe.py, line 54
stdout=subprocess.PIPE, - scripts/ci/verify_extension_builder_install.py, line 30
completed = subprocess.run(
Downloads and installs other software
The author does not mention this.
Found in 31 places.
Show 17 more
- docs/guard/evidence/declarative-extensions/projection-compatibility.v1.json, line 55
"command": "docker rm --help", - docs/guard/extension-builder/README.md, line 23
pipx install hol-guard - docs/guard/extensions/catalog.v1.json, line 1
{"entries":[{"actionClasses":["AgentBridge forced plugin scaffold command","AgentBridge run with tool registry command"],"category":"other","claimPolicy":"prove - docs/guard/extensions/catalog.v2.json, line 1
{"entries":[{"actionClasses":["AgentBridge forced plugin scaffold command","AgentBridge run with tool registry command"],"authoringSource":{"byteDigest":"sha256 - docs/guard/extensions/contributing.md, line 86
pipx install hol-guard - docs/guard/get-started.md, line 20
`pip install` or `hol-guard --version` does not establish that the runtime works - docs/guard/get-started.md, line 96
pipx install --python '<path-to-x64-python.exe>' hol-guard - docs/guard/k0s-k0rdent-use-case.md, line 36
pipx install hol-guard - docs/guard/local-cli-allowlist.md, line 9
For an MCP server, paste the same stdio launch command the harness uses, for example `npx -y @modelcontextprotocol/server-github` or `uvx mcp-server-git`. Guard - docs/guard/local-cli-allowlist.md, line 43
Package launchers such as `npx` and `uvx` stay in All tools as whole commands. Pasting an MCP package launch still lets Guard list that server's tools. A bare ` - docs/guard/native-hook-data-plane-ownership.md, line 588
launcher (`npx`, `uvx` and the like), a package bin run through a runner, and - docs/guard/plugin-install.md, line 33
npx skills@1.7.4 add acme/toolgate - docs/guard/plugin-release-attestation.md, line 56
- for stdio servers, the program's file name and, for `npx`, `bunx`, `pnpx` and `uvx`, the package it starts when the argument is shaped like a package name (fo - docs/guard/plugin-release-attestation.md, line 71
- the packages MCP servers start through `npx`, `bunx`, `pnpx` or `uvx`, without a version when the launch names a tag or range or no version at all. An unversi - docs/guard/release-3-0-dx-performance-baseline.md, line 9
`evaluate_command()` end-to-end (parse → risk signals → composed action) measured over a synthetic corpus spanning benign, risky, compound, and failure-state co - docs/guard/rust-runtime-hardening-todo.md, line 129
- [ ] NRH-T106 keep healthy safe operations silent and approval scope consistent across surfaces; the silence half moves one false pause at a time, and the rece - docs/guard/rust-runtime-hardening-todo.md, line 134
- [x] NRH-T109 delete dead duplicate Python implementations plus their tests, imports, dependencies, package entries, flags, and shims — the selector T112 names
and 11 more places
Sends data to these websites: github.com, example.com, ipinfo.io, exampl
The author does not mention this. Expected for a security skill.
Found in 10 places.
Show 7 more
- docs/guard/get-started.md, line 627
curl -s -X POST "http://127.0.0.1:${GUARD_PORT}/v1/daemon/repair" \ - docs/guard/mdm-networking.md, line 14
Raw `requests`, `urllib`, and `http.client` transports are confined to the managed transport itself or authenticated loopback IPC between Guard hooks, the Bridg - docs/guard/rust-runtime-hardening-todo.md, line 106
- [ ] NRH-T085 expand secret/exfiltration corpus across credentials, shells, encodings, archives, cloud/GitHub/webhook/database/language clients; the published - dashboard/src/dashboard-build.ts, line 140
observeDashboardBuild(await fetch("/healthz", { cache: "no-store" })); - dashboard/src/guard-api.ts, line 1055
let response = await fetch(input, init); - dashboard/src/guard-api.ts, line 1063
response = await fetch(input, init); - src/codex_plugin_scanner/guard/mcp/server.py, line 270
def fetch(id: str) -> str: # noqa: A002
Changes files outside its own folder
The author does not mention this.
Found in 4 places.
Show 1 more
- ci/gauntlet/README.md, line 93
`plan-note-protection-codex-hooks` is the twin of the plan-note writes: `cp src/one.ts ~/.codex/hooks.json` must stay reviewed, and the case fails if the copy r
Contains code that is hidden or hard to read
The author does not mention this.
Found in 3 places.
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 4 places.
Show 1 more
- ci/gauntlet/README.md, line 91
The model-free gate pairs each with protection counterparts: `cat docs/review-notes.md .env`, the vite build piped to an upload, `doctl auth token`, `doctl comp
Can call paid AI services billed to you
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'hol-guard-protection' ] || [ -L ~/.agents/skills/'hol-guard-protection' ]; then echo 'A skill folder named hol-guard-protection already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/hashgraph-online/hol-guard' "$d" && git -C "$d" checkout --quiet '6f3e819db45df70d6be2d1c6eca1f9c7fede694c' -- 'docs/guard' && mkdir -p ~/.agents/skills && cp -R "$d"/'docs/guard' ~/.agents/skills/'hol-guard-protection' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hol-guard-protection' ~/.claude/skills/'hol-guard-protection' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for hashgraph-online/hol-guard shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/hashgraph-online/hol-guard/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | 6f3e819 | 10 |
| 2026-11-08 | d49944c | 10 |
| 2026-11-06 | 4208f67 | 10 |