From 634920eec8da7326d94b6454a848d5cf47cfda22 Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Mon, 24 Aug 2026 20:01:33 -0400 Subject: [PATCH 1/2] feat(skills): add HOL Guard security skill --- skills/hol-guard/SKILL.md | 78 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 skills/hol-guard/SKILL.md diff --git a/skills/hol-guard/SKILL.md b/skills/hol-guard/SKILL.md new file mode 100644 index 0000000..c21a0c0 --- /dev/null +++ b/skills/hol-guard/SKILL.md @@ -0,0 +1,78 @@ +--- +name: hol-guard +description: Use the third-party HOL Guard CLI for supported-harness protection, approvals and evidence, and security scanning of agent plugins, skills, and MCP packages. +--- + +# HOL Guard + +Use HOL Guard when a workflow needs deterministic security controls around agent or tool execution, or when reviewing an agent plugin, skill, or MCP package. + +HOL Guard is maintained separately at https://github.com/hashgraph-online/hol-guard-plugin. + +## Install + +Prefer an isolated CLI install: + +```bash +pipx install hol-guard +``` + +If `pipx` is unavailable: + +```bash +python -m pip install --user hol-guard +``` + +Check the installed CLI before using it: + +```bash +hol-guard --help +``` + +## Protect a supported agent harness + +HOL Guard runtime protection is provided by its own harness integrations. Do not assume Gemini CLI itself is a supported interception target. + +Check the currently installed CLI for supported harness commands: + +```bash +hol-guard install --help +hol-guard run --help +``` + +For a harness HOL Guard currently supports: + +```bash +hol-guard install +hol-guard doctor +hol-guard run +``` + +Treat denied, review-required, and Guard error states as stop conditions. Do not execute the protected downstream action outside the Guard-owned flow to bypass a decision. + +## Approvals and evidence + +Use the installed CLI help for the current approval, receipt, and evidence commands before acting: + +```bash +hol-guard --help +``` + +Keep the policy decision and attempted action together in the evidence trail so a reviewer can distinguish allowed, denied, and review-required executions. + +## Scan plugins, skills, and MCP packages + +HOL Guard also provides package-scanning capabilities for suspicious agent extensions. Check the installed scanner interface first: + +```bash +plugin-scanner --help +``` + +Scan the local package or repository using the current syntax shown by `plugin-scanner --help`. Treat high-confidence findings as review blockers until resolved or explicitly accepted. + +## Boundaries + +- This skill does not claim that Gemini CLI exposes a native HOL Guard pre-tool hook. +- Runtime blocking belongs to HOL Guard's supported harness integrations. +- Package scanning is inspection; it is not a substitute for runtime enforcement. +- Never bypass deny, review, or error states by running the protected action directly. From e6e85dbdb10eeda251af0015ed286cd8b31425bd Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Sat, 29 Aug 2026 19:12:46 -0400 Subject: [PATCH 2/2] fix(skill): align HOL Guard CLI contract --- skills/hol-guard/SKILL.md | 50 +++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 20 deletions(-) diff --git a/skills/hol-guard/SKILL.md b/skills/hol-guard/SKILL.md index c21a0c0..bcf8a37 100644 --- a/skills/hol-guard/SKILL.md +++ b/skills/hol-guard/SKILL.md @@ -1,13 +1,11 @@ --- name: hol-guard -description: Use the third-party HOL Guard CLI for supported-harness protection, approvals and evidence, and security scanning of agent plugins, skills, and MCP packages. +description: Use the third-party HOL Guard CLI for supported-harness protection, approvals and evidence, and the separately installed plugin-scanner CLI for package inspection. --- # HOL Guard -Use HOL Guard when a workflow needs deterministic security controls around agent or tool execution, or when reviewing an agent plugin, skill, or MCP package. - -HOL Guard is maintained separately at https://github.com/hashgraph-online/hol-guard-plugin. +Use HOL Guard when a workflow needs deterministic security controls around agent or tool execution. HOL Guard is maintained separately at https://github.com/hashgraph-online/hol-guard. ## Install @@ -26,53 +24,65 @@ python -m pip install --user hol-guard Check the installed CLI before using it: ```bash -hol-guard --help +hol-guard --version ``` ## Protect a supported agent harness -HOL Guard runtime protection is provided by its own harness integrations. Do not assume Gemini CLI itself is a supported interception target. +HOL Guard runtime protection is provided by its own harness integrations. Do not assume this Gemini CLI Security skill itself creates a new interception hook. -Check the currently installed CLI for supported harness commands: +Discover the current installation's supported harnesses instead of relying on a static list: ```bash -hol-guard install --help -hol-guard run --help +hol-guard detect --json ``` -For a harness HOL Guard currently supports: +Use an exact supported harness identifier returned by detection. Then install, verify, dry-run, and launch through Guard: ```bash hol-guard install -hol-guard doctor +hol-guard doctor --json +hol-guard run --dry-run hol-guard run ``` -Treat denied, review-required, and Guard error states as stop conditions. Do not execute the protected downstream action outside the Guard-owned flow to bypass a decision. +If detection, install, doctor, or dry-run fails, stop instead of launching the raw harness outside Guard. Treat denied, review-required, and Guard error states as stop conditions. ## Approvals and evidence -Use the installed CLI help for the current approval, receipt, and evidence commands before acting: +Inspect queued decisions and evidence through Guard-owned commands: + +```bash +hol-guard approvals +hol-guard receipts +hol-guard status +``` + +When the user makes a terminal decision, use the exact request ID shown by `hol-guard approvals`: ```bash -hol-guard --help +hol-guard approvals approve +hol-guard approvals deny ``` -Keep the policy decision and attempted action together in the evidence trail so a reviewer can distinguish allowed, denied, and review-required executions. +Never invent an approval or reuse an unrelated request ID. ## Scan plugins, skills, and MCP packages -HOL Guard also provides package-scanning capabilities for suspicious agent extensions. Check the installed scanner interface first: +Package inspection is provided by the separate `plugin-scanner` distribution; installing `hol-guard` does not imply that CLI is present. + +If package scanning is needed, install and invoke it separately: ```bash -plugin-scanner --help +pipx install plugin-scanner +plugin-scanner verify . ``` -Scan the local package or repository using the current syntax shown by `plugin-scanner --help`. Treat high-confidence findings as review blockers until resolved or explicitly accepted. +Treat high-confidence findings as review blockers until resolved or explicitly accepted. Package scanning is inspection, not runtime enforcement. ## Boundaries -- This skill does not claim that Gemini CLI exposes a native HOL Guard pre-tool hook. +- This skill does not claim that the Gemini CLI Security extension itself adds a HOL Guard pre-tool interception hook. - Runtime blocking belongs to HOL Guard's supported harness integrations. -- Package scanning is inspection; it is not a substitute for runtime enforcement. +- `plugin-scanner` is a separate maintainer/CI package and is not a substitute for HOL Guard runtime protection. - Never bypass deny, review, or error states by running the protected action directly.