Plugins should publish a SECURITY.md file for responsible disclosure and support guidance.
Add a SECURITY.md file with reporting guidance and supported versions.
skills.sh/addyosmani/agent-skills/api-and-interface-design · veb07f19f52c2 · Agent skill
Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.
From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.
Listed in 0 of 5 directory lists
Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.
Plugins Anthropic maintains or selected for the marketplace Claude Code ships with.
Plugins submitted through claude.ai that passed Anthropic’s review; the list is a nightly mirror.
Plugins OpenAI lists in the marketplace Codex ships with.
Plugins Cursor publishes itself. Cursor does not publish its list of third-party Marketplace plugins.
The community Codex plugin list HOL maintains on GitHub.
HOL imported this listing from the registry.
Lists last read . HOL re-reads them every day.
Submitting it? Check it against each directory's rules
HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.