hol-guard-protection

# HOL Guard Skill Guidance Use this guidance when an AI agent is about to add or update dependencies. ## Before package installs 1. Preview the install decision: - `hol-guard protect --dry-run -- npm install <package>` 2. Check current workspace risk posture: - `hol-guard supply-chain scan --json` 3. Explain a specific package verdict: - `hol-guard supply-chain explain <package>@<version> --ecosystem <ecosystem>` 4. Confirm package manager interception is installed: - `hol-guard package-shims status --json` 5. Repair a missing or tampered package manager shim: - `hol-guard package-shims repair --manager npm --json` ## Cursor editor and Cursor CLI Cursor has two protection surfaces. **Cursor editor** covers MCP servers in `.cursor/mcp.json`. **Cursor CLI** covers the `cursor-agent` command path. Keep them distinct when activating, checking, repairing, or removing Guard. 1. Connect Cursor editor protection: - `hol-guard apps connect cursor --surface editor` 2. Connect Cursor CLI protection: - `hol-guard apps connect cursor --surface cli` 3. Test a Cursor surface without changing config: - `hol-guard apps test cursor --surface editor` - `hol-guard apps test cursor --surface cli` 4. Repair only the stale surface named by Guard Cloud: - `hol-guard apps repair cursor --surface editor` - `hol-guard apps repair cursor --surface cli` 5. Remove protection only after confirmation: - `hol-guard apps disconnect cursor --surface editor --confirm disconnect-cursor` - `hol-guard apps disconnect cursor --surface cli --confirm disconnect-cursor` Guard owns trust checks, drift repair, redacted receipts, and Cloud sync. Cursor owns its native editor and CLI behavior. If a surface is missing, unsupported, or unavailable, report that state instead of inventing an install URL or fallback command. ## During CI and automation - Route dependency installs through Guard: - `hol-guard protect -- npm ci` - Use workspace audits before release: - `hol-guard supply-chain audit --json` ## If Guard blocks a package - Review the blocking reason and suggested fix version. - Prefer upgrading to a safe version. - If it is a verified false positive, use a scoped and expiring exception with recorded reason.