HOL Guard Plugin 0.1.0
Checked release: the author’s release workflow scanned commit ed529d6bf2d2, checked it with the Plugin Kit and signed the evidence with a GitHub attestation. First seen by HOL on 2026-10-25.
Scan verdict
- Scan score
- 91 / 100, grade A
- Highest severity
- high
- Scanner findings
- 11 findings
- Plugin Kit check
- Failed (5 errors, 1 warning)
- Scanned with
- HOL Guard 3.57.0a4, default profile
- Contents
- 7 skills, 2 commands, 0 agents, 1 MCP server
Permissions and network access
| Server | Transport | Connects to or starts | Environment variables read |
|---|---|---|---|
| hol-guard | stdio | hol-guard | None |
Ships no hooks.
This is the first checked version, so there is nothing to compare.
Runtime compatibility
- Agent SkillsPackaged by the Plugin Kit
- Claude CodePackaged by the Plugin Kit
- CodexPackaged by the Plugin Kit
- CursorPackaged by the Plugin Kit
- Antigravity CLIPackaged by the Plugin Kit
- Mcp RegistryNot packaged
- OpenCodePackaged by the Plugin Kit
- VscodePackaged by the Plugin Kit
Software bill of materials
This release’s evidence does not include an SBOM.
Attestation
- Commit
- ed529d6bf2d2
- Workflow run
- Run 40210716539
- GitHub attestation
- View attestation
- Verified by HOL
- Evidence SHA-256
- 812b980f727ce136462b6ac065eb88ceb6a9b0615cf05aba762aa9ef28214bf7
- Signed by
- hashgraph-online/hol-guard/.github/workflows/plugin-release.yml
HOL checked the workflow's GitHub identity and the attestation when the release was recorded. To check it yourself, download the evidence and verify it with the GitHub CLI:
curl -fsSL -o evidence.json https://hol.org/api/guard/plugins/releases/evidence/812b980f727ce136462b6ac065eb88ceb6a9b0615cf05aba762aa9ef28214bf7
gh attestation verify evidence.json --repo hashgraph-online/hol-guard-plugin --signer-workflow hashgraph-online/hol-guard/.github/workflows/plugin-release.ymlThis commit was scanned by HOL Guard and checked by the HOL Plugin Kit under the recorded versions, and the evidence carries a GitHub-signed provenance attestation. It does not mean vulnerability-free, and packaged runtimes were not load-tested.
Attested installs
Fewer than 10 machines reported this version in week 2026-W43, so no count is shown. Attested installs come from opt-in HOL Guard install reports, counted once per machine and runtime each week, and no number is shown below 10. Setup answers from visitors, GitHub stars and download counts from other directories are claims HOL cannot check, so they are labelled separately and never added in.