self-host releases

Current version 1.3.2. Each version below is listed with the date HOL first saw it in the registry and what the catalog reported for it: supported runtimes, what it ships, its Trust Score and scan result.

Versions

  1. 1.3.2

    First seen by HOL · registry updated

    No change to runtimes, contents, Trust Score or scan result since the previous version.

    Runtimes
    Agent Skills
    Ships
    5 skills, 0 MCP servers, 0 apps
    Trust Score
    74 / 100
    Scan result
    Findings to review, 15 findings
    Attestation
    No signed release attestation published
    Source commit
    aea01e90507b

  2. 0.0.0

    First seen by HOL

    What changed

    • 3 skills → 5 skills
    • Trust Score 35 → 74
    • New finding areas: operational-security
    • Cleared finding areas: skill-security
    Runtimes
    Agent Skills
    Ships
    5 skills, 0 MCP servers, 0 apps
    Trust Score
    74 / 100
    Scan result
    Findings to review, 15 findings
    Attestation
    No signed release attestation published
    Source commit
    7787fc4132ec

  3. 1.0.1

    First seen by HOL

    First version HOL recorded for this plugin, so there is nothing earlier to compare.

    Runtimes
    Agent Skills
    Ships
    3 skills, 0 MCP servers, 0 apps
    Trust Score
    35 / 100
    Scan result
    Findings to review, 15 findings (2 high)
    Attestation
    No signed release attestation published
    Source commit
    e67f49a7d2b9

Release integrity

What each channel served for self-host the last time HOL checked. A digest is the start of the build's SHA-256 or, for a source repository, the commit's git tree hash. Different values mean different content; they do not say which one is right.

Channels serving self-host
ChannelVersionDigestProvenanceSeen
Source repository (HOL scan)1.0.1ecc01667ca7ecommit e67f49a7d2b9

No integrity events recorded.

How HOL records release integrity

How this is recorded

HOL checks the registry once a day, so a version replaced within a day may not appear, and versions published before 24 October 2026 are not listed. The facts are what the registry reported, not a signed statement from the author. A checked release is different: the author's release workflow scanned it, checked it with the Plugin Kit and signed the result with a GitHub attestation. It does not mean the plugin is free of vulnerabilities. See how the Trust Score is computed or go back to self-host.