Satori 6.5.5

Checked release: the author’s release workflow scanned commit 8ba703fea210, checked it with the Plugin Kit and signed the evidence with a GitHub attestation.

Scan verdict

Scan score
72 / 100, grade C
Highest severity
medium
Scanner findings
38 findings
Plugin Kit check
Passed (0 errors, 0 warnings)
Scanned with
HOL Guard 3.58.0a5, default profile
Contents
1 skill, 0 commands, 0 agents, 0 MCP servers

Permissions and network access

This release ships no MCP servers.

Ships hooks.

This is the first checked version, so there is nothing to compare.

Runtime compatibility

  • Agent PluginsPackaged by the Plugin Kit
  • Agent SkillsPackaged by the Plugin Kit
  • Claude CodePackaged by the Plugin Kit
  • CodexPackaged by the Plugin Kit
  • CursorNot packaged
  • Antigravity CLIPackaged by the Plugin Kit
  • Mcp RegistryNot packaged
  • OpenCodeNot packaged
  • VscodeNot packaged

Software bill of materials

This release’s evidence does not include an SBOM.

Attestation

Workflow run
Run 41138614890
GitHub attestation
View attestation
Verified by HOL
Signed by
hashgraph-online/hol-guard/.github/workflows/plugin-release.yml

HOL checked the workflow's GitHub identity and the attestation when the release was recorded. To check it yourself, download the evidence and verify it with the GitHub CLI:

curl -fsSL -o evidence.json https://hol.org/api/guard/plugins/releases/evidence/69854c9f146e2bb9152105cd75f1be8fc474d0636a31f729855c59f67c2a8173
gh attestation verify evidence.json --repo MetcalfSolutions/Satori --signer-workflow hashgraph-online/hol-guard/.github/workflows/plugin-release.yml

This commit was scanned by HOL Guard and checked by the HOL Plugin Kit under the recorded versions, and the evidence carries a GitHub-signed provenance attestation. It does not mean vulnerability-free, and packaged runtimes were not load-tested.

Attested installs

Fewer than 10 machines reported this version in week 2026-W43, so no count is shown. Attested installs come from opt-in HOL Guard install reports, counted once per machine and runtime each week, and no number is shown below 10. Setup answers from visitors, GitHub stars and download counts from other directories are claims HOL cannot check, so they are labelled separately and never added in.