hol-guard

name	hol-guard
description	Use when setting up HOL Guard, protecting local AI harnesses, reviewing Guard approvals or receipts, scanning Codex plugins, skills, MCP servers, marketplace packages, or running plugin-scanner verification before release.
license	Apache-2.0

HOL Guard

HOL Guard protects local AI harnesses before tools run. Use this skill when the user wants AI antivirus behavior, local approval review, Codex protection, Claude Code protection, MCP safety checks, skill/package verification, or release gates from hol-guard and plugin-scanner.

Hard Rules

• Never read .env files.
• Never bypass Guard approvals.
• Do not mark a workspace protected until a Guard command proves status.
• Prefer reversible Guard commands over direct harness config edits.
• Do not mutate user-level harness config unless the hol-guard command owns that mutation.
• Treat scanner failures as real until inspected.
• Preserve existing user changes and inspect git status --short before edits in a repo.

Install Check

First check whether the CLI exists:

command -v hol-guard
command -v plugin-scanner

If missing and the user asked for setup, prefer:

pipx install hol-guard

Fallback only when pipx is unavailable:

python3 -m pip install --user hol-guard