Threat explainer
How malicious skills, plugins, and agent packages hide risky behavior.
Agent skills are tiny helpers. Some helpers ask for too much.
Skills and plugins create supply-chain risk through install scripts, hidden prompts, and tool permission drift.
HOL Guard turns these moments into private receipts first, then public lessons only after redaction and moderation.
Protect the coding tools your team already uses without forcing everyone to become a security expert.
Real protection moments, scrubbed for safety before becoming public learning pages.
A redacted example of a local secret read attempt.
Why it was risky
Env files often hold API keys or service credentials.
What Guard did
HOL Guard paused the read before file contents left the machine.
A redacted example of an MCP tool with a misleading description.
Why it was risky
The tool description asked the agent to read credentials and pass them as arguments.
What Guard did
HOL Guard paused the tool call and flagged the description for review.
A redacted example of a prompt injection via a file comment.
Why it was risky
The instruction was embedded in an HTML comment invisible to the developer.
What Guard did
HOL Guard paused the command and showed the source of the instruction.
A redacted example of a supply-chain attack via npm install.
Why it was risky
Postinstall scripts run with full permissions before anyone reviews the code.
What Guard did
HOL Guard paused the install and showed the script contents.
Practice attack patterns with static simulations. Nothing dangerous executes.
See how hidden text tries to override your instructions.
Safe trace$ Agent reads issue text$ Hidden instruction appears$ Guard asks for reviewOpen the labsupply-chainStatic simulationWalk through a simulated install that tries to change agent trust.
Safe trace$ Package install starts$ Postinstall wants shell access$ Guard pauses actionOpen the labIn HOL Registry, a plugin is the indexed package. Skills, MCP servers, and apps are plugin kinds that different runtimes load. An AI coding-agent skill is one of those kinds: instruction and capability files a harness can follow. This page is about skill trust and verification, not a second MCP hub.
No. A scan is not a safety guarantee. The current public catalog scanner is registry-broker-fallback static scoring, not a live exploit test. About 205 catalog plugins are not Registry Broker agent counts.
Partially. HOL Guard can require approval when a plugin or skill is installed at the local runtime boundary. Cursor native approvals remain Cursor-owned. Cursor/artifact trust is not full pre-exec of every tool description. Guard is not a complete prompt-injection preventer and does not stop the model from following skill instructions already in context.
No. This hub explains skill trust and verification boundaries. It is not a complete skill-trust program, not a certification that a skill is safe, and it does not claim complete coverage of every skill surface.