Ponytail icon

Ponytail

dietrich-gebert/ponytail · v5.3.3 · Development & Workflow

by Dietrich GebertScan grade: AcceptableAwesome AI Plugins

Guides coding agents toward minimal working solutions through YAGNI, existing code, standard libraries, and native platform features

InstallSourceClaim this plugin
Follow0
Trust Score70Security scan79Components12
Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is Ponytail a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

  • Codex
  • Claude Code
  • Antigravity CLI
  • Kimi Code
  • Agent Plugin
  • 12 skills
  • Runs hooks on agent events

Before you install

Sign-in
Not declared
Declared access
Not declared
License
MIT

Check before relying on it

  • Some security checks did not finish: Cisco skill scan. See the evidence
  • 6 medium findings from the scan. See the evidence
  • The publisher has not verified ownership on HOL.

What is Ponytail?

Ponytail is a published development & workflow plugin for AI coding agents that works with Codex, Claude Code, Antigravity CLI, Kimi Code and Agent Plugin, developed by Dietrich Gebert and distributed through the HOL AI plugin registry. Guides coding agents toward minimal working solutions through YAGNI, existing code, standard libraries, and native platform features.

Canonical slug
dietrich-gebert/ponytail
Version
v5.3.3 · updated Nov 8, 2026

Registry snapshot

Support the project
GitHub Sponsors
Owner verification
Not verified
Marketplace source
.claude-plugin/marketplace.json
Scanner
HOL plugin scanner
Security result
Needs review
Digest verified
Yes
12 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

70

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability
76/100
Maintenance
65/100
MCP server setup
100/100
Plugin Security
79/100
Provenance
70/100
Publisher Quality
75/100

Provenance

Plugin root
.
Source repo
https://github.com/DietrichGebert/ponytail
Source commit
96608e078b2d…
Publisher verified
No
Owner verified
Not owner verified
Agent Plugins 1.0
Not detected

Continuous scanner CI not detected

This plugin remains listed. Its overall trust score is reduced by 10% because security checks are not maintained in the source repository's CI.

Optional: maintain the scanner in the source repository's CI to receive the full trust score. Listing does not require that change.

README badge not detected

Plugin owners can add the HOL badge to the repository README from Guard Plugins. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Security posture

See how the Trust Score is computed
Needs review
Security result
79
Security score
0
High findings
Provider
codex-plugin-scanner
Grade
C · Acceptable
Version
3.24.2
codex:hol-plugin-scanner-YmruhW / cisco-skill-scanner: failedcodex:hol-plugin-scanner-YmruhW / cisco-mcp-scanner: skipped

[claude:.] Claude Plugin

18/18

5 checks

[claude:.] Security

13/16

6 checks

[claude:.] Operational Security

0/6

5 checks

[claude:.] Code Quality

10/10

2 checks

[codex:.] Manifest Validation

28/31

9 checks

[codex:.] Security

13/16

9 checks

[codex:.] Operational Security

0/6

5 checks

[codex:.] Best Practices

9/12

5 checks

[codex:.] Marketplace

5/15

3 checks

[codex:.] Skill Security

5/5

4 checks

[codex:.] Code Quality

10/10

2 checks

[gemini:.] Gemini Extension

15/15

3 checks

[gemini:.] Security

13/16

6 checks

[gemini:.] Operational Security

0/6

5 checks

[gemini:.] Code Quality

10/10

2 checks

[kimi:.] Kimi Plugin

37/40

10 checks

[opencode:.] OpenCode Plugin

2/2

4 checks

[opencode:.] Security

13/16

6 checks

[opencode:.] Operational Security

0/6

5 checks

[opencode:.] Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked . This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

mediumoperational-securityDEPENDENCY_LOCKFILE_MISSINGReported 4 times

package.json is present without a corresponding lockfile or pinned dependency snapshot.

Commit a lockfile or use fully pinned requirements for reproducible dependency resolution.

mediummarketplaceMARKETPLACE_SOURCE_INVALID

plugin[0] in marketplace.json must declare "source": {"source": "local", "path": "./plugins/..."}

Use the official repo marketplace shape with a local source object.

mediummarketplaceMARKETPLACE_UNSAFE_SOURCE

The marketplace source "plugin[0]=missing "source.path"" is absolute or resolves outside the plugin directory.

Use relative in-repo paths that stay within the plugin directory.

lowsecuritySECURITY_MD_MISSINGReported 5 times

Plugins should publish a SECURITY.md file for responsible disclosure and support guidance.

Add a SECURITY.md file with reporting guidance and supported versions.

lowoperational-securityDEPENDABOT_MISSINGReported 4 times

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL

The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.

Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL

The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.

Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Claude Code

Install through the Claude Code plugin marketplace.

Claude Code plugin docs

Optional: install HOL Guard for Claude Code first, so it can check this plugin's tools on your machine before Claude Code uses them.

  1. 1

    Add the marketplace

    Run this inside a Claude Code session. It registers the marketplace manifest shipped at the repository root. If the repository ships none, add the generated entry from the Advanced section below first.

    claude code
  2. 2

    Install the plugin

    Installs the ponytail entry from the ponytail marketplace.

    claude code
  3. 3

    Scripted alternative

    Non-interactive equivalent for scripts and CI pipelines. Add --scope project to pin the install to one repository.

    shell
  4. 4

    Check it is installed

    Lists installed plugins. The entry should appear as enabled.

    shell

To remove it later, run claude plugin uninstall ponytail@ponytail.

Did setup work in Claude Code?

No setup reports for Claude Code yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W45, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "name": "ponytail",
  "version": "5.3.3",
  "description": "Lazy senior dev mode. Forces the simplest, shortest solution that actually works: YAGNI, stdlib first, no unrequested abstractions.",
  "author": {
    "name": "Dietrich Gebert",
    "url": "https://github.com/DietrichGebert"
  },
  "homepage": "https://github.com/DietrichGebert/ponytail",
  "repository": "https://github.com/DietrichGebert/ponytail",
  "license": "MIT",
  "keywords": [
    "yagni",
    "minimalism",
    "code-review",
    "productivity"
  ],
  "skills": "./",
  "hooks": "./hooks/claude-codex-hooks.json",
  "interface": {
    "displayName": "Ponytail",
    "developerName": "Dietrich Gebert",
    "shortDescription": "Lazy senior developer mode",
    "longDescription": "Prefer YAGNI, the standard library, native platform features, and the smallest correct implementation.",
    "category": "Productivity",
    "capabilities": [
      "Instructions",
      "Lifecycle hooks"
    ],
    "websiteURL": "https://github.com/DietrichGebert/ponytail",
    "defaultPrompt": [
      "Use Ponytail mode for this task.",
      "Review this diff for over-engineering.",
      "Find the smallest correct implementation."
    ],
    "brandColor": "#111111",
    "composerIcon": "./assets/codex-icon.png",
    "logo": "./assets/logo.png"
  },
  "holManifestOrigin": "repository",
  "registryIndexVersion": 9
}

Marketplace source

Repo URL
https://github.com/DietrichGebert/ponytail
Marketplace path
.claude-plugin/marketplace.json
Source path
.
Install policy
Unspecified

Skills

12 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

Share
skills-cli

  • ponytail-audit

    .openclaw/skills/ponytail-audit/SKILL.md

    Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-debt

    .openclaw/skills/ponytail-debt/SKILL.md

    Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-gain

    .openclaw/skills/ponytail-gain/SKILL.md

    Show ponytail measured impact as a scoreboard: less code, less cost, more speed, from the agentic benchmark averages. One-shot display.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-help

    .openclaw/skills/ponytail-help/SKILL.md

    Quick reference for ponytail's modes, skills, and commands. One-shot display.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-review

    .openclaw/skills/ponytail-review/SKILL.md

    Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail

    .openclaw/skills/ponytail/SKILL.md

    Lazy senior dev mode for any coding task: the smallest change that fully solves it, and a reply a busy human understands in one read.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-audit

    skills/ponytail-audit/SKILL.md

    >

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-debt

    skills/ponytail-debt/SKILL.md

    >

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-gain

    skills/ponytail-gain/SKILL.md

    >

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-help

    skills/ponytail-help/SKILL.md

    >

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail-review

    skills/ponytail-review/SKILL.md

    >

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • ponytail

    skills/ponytail/SKILL.md

    >

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

File inventory

.agents/plugins/marketplace.json

file

410 bytes

429fd8844db68d98…

.claude-plugin/marketplace.json

file

513 bytes

5c17acc0d3073273…

.claude-plugin/plugin.json

file

1,508 bytes

82f8b30ea6d2cfe1…

.clinerules

file

164,844 bytes

ee46b70b33fce13b…

.clinerules/ponytail.md

file

2,623 bytes

ca99e59583830630…

.codex-plugin/plugin.json

plugin-manifest

1,177 bytes

dcd7efc917e72ea7…

.cursor/rules/ponytail.mdc

file

2,748 bytes

851a13366056d08e…

.kimi-plugin/plugin.json

file

565 bytes

5414064690624959…

.openclaw/skills/ponytail-audit/SKILL.md

skill

5,250 bytes

3dc1c18ec325632d…

.openclaw/skills/ponytail-debt/SKILL.md

skill

1,745 bytes

d55354743bf34461…

.openclaw/skills/ponytail-gain/SKILL.md

skill

2,199 bytes

40efb084e29bfaaa…

.openclaw/skills/ponytail-help/SKILL.md

skill

3,186 bytes

3a267f1c71058854…

.openclaw/skills/ponytail-review/SKILL.md

skill

4,976 bytes

1f010d87a90d9e80…

.openclaw/skills/ponytail/SKILL.md

skill

3,267 bytes

3868c7aa7cc721b7…

.opencode/plugins/index.js

file

274 bytes

9ed0323f55125768…

.opencode/plugins/ponytail-frontmatter.cjs

file

2,848 bytes

9a4710a151fda97e…

.opencode/plugins/ponytail.mjs

file

7,653 bytes

a7f9d48eddff1c90…

.windsurf/rules/ponytail.md

file

2,623 bytes

ca99e59583830630…

AGENTS.md

file

2,721 bytes

b98b15e1d683ee20…

assets/codex-icon.png

asset

11,856 bytes

8fa26519396f8ff8…

assets/logo.png

asset

756,876 bytes

10203f5ba959a5be…

commands/ponytail-audit.toml

file

1,685 bytes

eec7971e361d2f07…

commands/ponytail-debt.toml

file

908 bytes

a537eaafad70f105…

commands/ponytail-gain.toml

file

1,257 bytes

faffa8be16687e51…

commands/ponytail-help.toml

file

1,152 bytes

7d47b79ff6f5afcb…

commands/ponytail-review.toml

file

2,069 bytes

a7f57fd8b951991d…

commands/ponytail.toml

file

611 bytes

ecb6a232d49aa3de…

gemini-extension.json

file

233 bytes

d1f2e13fa0f34e51…

hooks/band/board.ts

file

45,260 bytes

c697da70dabdf981…

hooks/band/logo.ts

file

49,871 bytes

187c17a751140e0a…

hooks/band/metrics.ts

file

14,738 bytes

e3646320e409ec2a…

hooks/band/register.tsx

file

21,980 bytes

9e4e2915495ef460…

hooks/band/types.d.ts

file

640 bytes

970ccf48e1b970b6…

hooks/claude-band.json

file

64 bytes

8316581f357f5481…

hooks/claude-codex-hooks.json

file

1,230 bytes

3320ac7fae9bdded…

hooks/copilot-hooks.json

file

1,017 bytes

692b5148c3605d2e…

hooks/cursor-hooks.json

file

322 bytes

0b9f026058ad3209…

hooks/ponytail-activate.js

file

9,347 bytes

6e492e997aa3e015…

hooks/ponytail-band-import.js

file

14,078 bytes

2d9dda3a6b77b46d…

hooks/ponytail-config.js

file

5,911 bytes

ae81c3552064c9a9…

hooks/ponytail-instructions.js

file

5,565 bytes

36521752b3444ef8…

hooks/ponytail-map.js

file

5,439 bytes

c876b087accb6655…

hooks/ponytail-mode-tracker.js

file

9,912 bytes

ab2a7d89a71fdbec…

hooks/ponytail-runtime.js

file

7,751 bytes

52d8e66d542d4921…

hooks/ponytail-statusline.sh

file

696 bytes

f1dbfa5997a5d4b5…

hooks/ponytail-subagent.js

file

3,462 bytes

8da045eb96b5b919…

hooks/qoder-hooks.json

file

718 bytes

3831c8e496b2c6f8…

LICENSE

file

1,428 bytes

16f9d66ac489b6e2…

opencode.json

file

51 bytes

3a1689520689222b…

package.json

file

1,260 bytes

797154b6e029a9a7…

plugin.json

file

25 bytes

6efc6b6c8e6e3362…

README.md

file

14,837 bytes

9608191c42ef9421…

skills/plugin.json

skill

167 bytes

b1db7be1404a84eb…

skills/ponytail-audit/SKILL.md

skill

5,417 bytes

2b3223a02c386d12…

skills/ponytail-debt/SKILL.md

skill

1,769 bytes

b5ec2762f6ba8c4a…

skills/ponytail-gain/SKILL.md

skill

2,164 bytes

231034a896d6762e…

skills/ponytail-help/SKILL.md

skill

3,188 bytes

86ab0ce0af70cbee…

skills/ponytail-review/SKILL.md

skill

5,143 bytes

33fe4ebe22a46092…

skills/ponytail/SKILL.md

skill

3,496 bytes

9badd22a32e19cb8…

Ponytail — Frequently asked questions

What is Ponytail?
Ponytail is an AI plugin in the HOL registry. Guides coding agents toward minimal working solutions through YAGNI, existing code, standard libraries, and native platform features.
How do I install Ponytail?
Install Ponytail in your harness: Codex — codex plugin marketplace add DietrichGebert/ponytail; Claude Code — /plugin marketplace add DietrichGebert/ponytail; Antigravity CLI — npx [email protected] add DietrichGebert/ponytail. Full step-by-step guidance is on the HOL plugin page.
How do I install Ponytail in HOL Guard?
To install Ponytail in HOL Guard, start with hol-guard plugin install dietrich-gebert/ponytail --apply. The complete step-by-step install guide for HOL Guard is on the HOL plugin page.
How do I install Ponytail in Codex?
To install Ponytail in Codex, start with codex plugin marketplace add DietrichGebert/ponytail. The complete step-by-step install guide for Codex is on the HOL plugin page.
How do I install Ponytail in Claude Code?
To install Ponytail in Claude Code, start with /plugin marketplace add DietrichGebert/ponytail. The complete step-by-step install guide for Claude Code is on the HOL plugin page.
How is the Trust Score for Ponytail computed?
Ponytail has a HOL Trust Score of 70 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/dietrich-gebert%2Fponytail/trust
Who publishes Ponytail?
Ponytail is published by Dietrich Gebert and listed on HOL.

Directory acceptance

Listed in 1 of 5 directory lists

Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.

Lists last read . HOL re-reads them every day.

Submitting it? Check it against each directory's rules

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here
<5
HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports
<10
Machines that reported installing it through HOL Guard in week 2026-W45. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces
<5
Workspaces that approved it or include it in an approved-plugin feed, as of today.

Related plugins

Ordered by Trust Score. Listings cannot pay for these positions. Check each one fits your task before switching from Ponytail.

Alternatives in Development & Workflow

See all Development & Workflow plugins

Reviews and similar plugins