Satori 6.5.5

Checked release: the author’s release workflow scanned commit e644dd9b2cd6, checked it with the Plugin Kit and signed the evidence with a GitHub attestation.

Scan verdict

Scan score
72 / 100, grade C
Highest severity
medium
Scanner findings
38 findings
Plugin Kit check
Passed (0 errors, 0 warnings)
Scanned with
HOL Guard 3.58.0a5, default profile
Contents
1 skill, 0 commands, 0 agents, 0 MCP servers

Permissions and network access

This release ships no MCP servers.

Ships hooks.

This is the first checked version, so there is nothing to compare.

Runtime compatibility

  • Agent PluginsPackaged by the Plugin Kit
  • Agent SkillsPackaged by the Plugin Kit
  • Claude CodePackaged by the Plugin Kit
  • CodexPackaged by the Plugin Kit
  • CursorNot packaged
  • Antigravity CLIPackaged by the Plugin Kit
  • Mcp RegistryNot packaged
  • OpenCodeNot packaged
  • VscodeNot packaged

Software bill of materials

This release’s evidence does not include an SBOM.

Attestation

Workflow run
Run 41190546677
GitHub attestation
View attestation
Verified by HOL
Signed by
hashgraph-online/hol-guard/.github/workflows/plugin-release.yml

HOL checked the workflow's GitHub identity and the attestation when the release was recorded. To check it yourself, download the evidence and verify it with the GitHub CLI:

curl -fsSL -o evidence.json https://hol.org/api/guard/plugins/releases/evidence/2816906c3ac137a4351ca8ff8ebb3e49abb0fc5ce152b881ee8b876b9eb4d265
gh attestation verify evidence.json --repo MetcalfSolutions/Satori --signer-workflow hashgraph-online/hol-guard/.github/workflows/plugin-release.yml

This commit was scanned by HOL Guard and checked by the HOL Plugin Kit under the recorded versions, and the evidence carries a GitHub-signed provenance attestation. It does not mean vulnerability-free, and packaged runtimes were not load-tested.

Attested installs

Fewer than 10 machines reported this version in week 2026-W44, so no count is shown. Attested installs come from opt-in HOL Guard install reports, counted once per machine and runtime each week, and no number is shown below 10. Setup answers from visitors, GitHub stars and download counts from other directories are claims HOL cannot check, so they are labelled separately and never added in.