HOL Guard Plugin 0.1.1
Checked release: the author’s release workflow scanned commit 5e503e170346, checked it with the Plugin Kit and signed the evidence with a GitHub attestation. First seen by HOL on 2026-10-25.
No material change since 0.1.0
No new network destinations, environment variables, packages, servers or hooks, and the scan severity and Plugin Kit check did not get worse.
Scan verdict
- Scan score
- 91 / 100, grade A
- Highest severity
- high
- Scanner findings
- 11 findings
- Plugin Kit check
- Passed (0 errors, 1 warning)
- Scanned with
- HOL Guard 3.58.0a4, default profile
- Contents
- 2 skills, 2 commands, 0 agents, 1 MCP server
Permissions and network access
| Server | Transport | Connects to or starts | Environment variables read |
|---|---|---|---|
| hol-guard | stdio | hol-guard | None |
Ships no hooks.
No change to what it can reach since 0.1.0.
Runtime compatibility
- Agent SkillsPackaged by the Plugin Kit
- Claude CodePackaged by the Plugin Kit
- CodexPackaged by the Plugin Kit
- CursorPackaged by the Plugin Kit
- Antigravity CLIPackaged by the Plugin Kit
- Mcp RegistryNot packaged
- OpenCodePackaged by the Plugin Kit
- VscodePackaged by the Plugin Kit
Software bill of materials
- Format
- CycloneDX 1.6
- Components
- 61
- SBOM SHA-256
- 54fbf2a276fc0797be4e0edca6de1b08018b3dfd607fc3ceac2e5717fde5a553
- File
- The SBOM is attached to the workflow run above and covered by the same attestation.
Attestation
- Commit
- 5e503e170346
- Workflow run
- Run 40283678166
- GitHub attestation
- View attestation
- Verified by HOL
- Evidence SHA-256
- d18985739a3a9cccd4fa342bc14f3ea702a1287507e3f8492535aa1d9199eba7
- Signed by
- hashgraph-online/hol-guard/.github/workflows/plugin-release.yml
HOL checked the workflow's GitHub identity and the attestation when the release was recorded. To check it yourself, download the evidence and verify it with the GitHub CLI:
curl -fsSL -o evidence.json https://hol.org/api/guard/plugins/releases/evidence/d18985739a3a9cccd4fa342bc14f3ea702a1287507e3f8492535aa1d9199eba7
gh attestation verify evidence.json --repo hashgraph-online/hol-guard-plugin --signer-workflow hashgraph-online/hol-guard/.github/workflows/plugin-release.ymlThis commit was scanned by HOL Guard and checked by the HOL Plugin Kit under the recorded versions, and the evidence carries a GitHub-signed provenance attestation. It does not mean vulnerability-free, and packaged runtimes were not load-tested.
Attested installs
Fewer than 10 machines reported this version in week 2026-W43, so no count is shown. Attested installs come from opt-in HOL Guard install reports, counted once per machine and runtime each week, and no number is shown below 10. Setup answers from visitors, GitHub stars and download counts from other directories are claims HOL cannot check, so they are labelled separately and never added in.