hol-guard

Name: hol-guard
Author: hashgraph-online

Verified

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

868stars

152forks

Python

Installation

# Add to your Claude Code skills
git clone https://github.com/hashgraph-online/hol-guard

Getting Started

Guides for using ai agents skills like hol-guard.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportVerified

Last scanned: 7/15/2026

{
  "issues": [
    {
      "file": "tests/fixtures/hermes-plugin-evil/skills/security/malicious/SKILL.md",
      "line": 11,
      "type": "secret-exfiltration",
      "message": "Instruction appears to send credentials/secrets to an external endpoint",
      "severity": "medium"
    },
    {
      "file": "tests/fixtures/hermes-plugin-evil/skills/security/malicious/SKILL.md",
      "line": 15,
      "type": "secret-exfiltration",
      "message": "Pipes a secret file directly to the network: \"cat ~/.ssh/id_rsa | curl\"",
      "severity": "medium"
    },
    {
      "file": "tests/fixtures/malicious-skill-plugin/skills/leaky-skill/SKILL.md",
      "line": 10,
      "type": "secret-exfiltration",
      "message": "Instruction appears to send credentials/secrets to an external endpoint",
      "severity": "medium"
    },
    {
      "file": "tests/fixtures/malicious-skill-plugin/skills/leaky-skill/SKILL.md",
      "line": 14,
      "type": "secret-exfiltration",
      "message": "Pipes a secret file directly to the network: \"cat .env | curl\"",
      "severity": "medium"
    }
  ],
  "status": "PASSED",
  "scannedAt": "2026-07-15T06:13:03.295Z",
  "npmAuditRan": true,
  "pipAuditRan": false,
  "promptInjectionRan": true
}

Compare with similar skills

See how hol-guard compares with popular alternatives.

hol-guard vs ecc

See comparison

hol-guard vs hermes agent

See comparison

README.md

Frequently Asked Questions

What is hol-guard?

hol-guard is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by hashgraph-online. Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime. It has 868 GitHub stars.

Is hol-guard safe to use?

Yes. hol-guard passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.

How do I install hol-guard?

Clone the repository with "git clone https://github.com/hashgraph-online/hol-guard" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is hol-guard written in?

hol-guard is primarily written in Python. It is open-source under hashgraph-online on GitHub, so you can review or fork the full source.

Are there alternatives to hol-guard?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh hol-guard against similar tools.

AI Courses · Agentic AI, LLM Engineering & MCP

Beginner to professional · First lesson free · Lifetime access

20% off

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

278,173

Chinese-WebNovel-Skill ima2-gen

⚠️ Third-Party Software Notice

This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.

Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.

Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.

Read the Terms of Service

HOL Guard: Open-Source Antivirus for AI Agents

	Stop risky AI actions before they compromise your machine. HOL Guard is a local-first security layer for AI agents, tools, plugins, skills, MCP servers, and package installs.Install HOL Guard Read the documentation PyPI Package (`hol-guard`)Report an Issue

HOL Guard reviews agent actions before they run: shell commands, file access, package installs, and MCP tool calls. It detects secret exposure, destructive operations, prompt injection, and supply-chain risks, then allows, blocks, or requests approval according to your policy.

Run it locally without an account. Use the CLI and local dashboard to manage protection, resolve approvals, and inspect decision history. Optional Guard Cloud adds shared history, team policy, and fleet management.

Get started · Supported agents · Plugin scanner · Documentation · Contribute an extension · Development

Install HOL Guard

Requires Python 3.10 or newer and pipx.

pipx install hol-guard
hol-guard init

The first-run wizard discovers supported agents and walks you through protection setup. It asks before each setup change, including opening the dashboard, installing agent integrations, and connecting optional cloud services.

Check your installation:

hol-guard --version
hol-guard status

To update an existing installation:

hol-guard update

For manual setup, see the installation guide. Annotated release notes with upgrade context live at hol.org/guard/releases; raw releases and prereleases are on the GitHub releases page.

What HOL Guard Protects

Surface	Protection
Shell commands and file access	Reviews destructive operations, sensitive file access, credential exposure, and suspicious outbound commands.
Package installs	Evaluates supported package-manager operations against supply-chain intelligence before installation.
Plugins, skills, and agent configuration	Inventories local artifacts and reviews new or changed tools before launch.
MCP servers and tools	Inspects server configuration and reviews tool calls through supported hooks and managed proxies.
Prompts and tool results	Screens supported events for prompt injection and sensitive content.
Approvals and evidence	Routes decisions to native prompts or the approval center, and records local receipts for review.

Guard connects through native agent hooks, managed MCP proxies, and launch integrations. Coverage depends on the events each agent exposes; the support matrix documents enforcement, approval delivery, and failure behavior per integration.

Supported AI Agents

Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Grok, Hermes, Kimi Code, Pi, oh-my-pi, OpenClaw, OpenCode, Antigravity, ZCode, and Devin. Paseo is supported through these native provider integrations, with per-provider coverage.

For example, to set up Codex explicitly:

hol-guard install codex
hol-guard run codex --dry-run
hol-guard run codex

The dry run records the current artifact state before launch. For Codex, Guard installs native pre-tool hooks and refuses a managed launch if those hooks are missing or disabled.

Agent support matrix · Troubleshooting

Everyday Use

Task	Command
Check protection status	`hol-guard status`
Diagnose an agent integration	`hol-guard doctor codex`
Inspect changes before launch	`hol-guard diff codex`
Review pending approvals	`hol-guard approvals`
Approve or deny a request	`hol-guard approvals approve <request-id>` / `hol-guard approvals deny <request-id>`
Read decision history	`hol-guard receipts`
List tracked artifacts	`hol-guard inventory`
Export an AI bill of materials	`hol-guard abom --format json`
Scan workspace dependencies	`hol-guard supply-chain scan`
Connect optional cloud sync	`hol-guard connect`

Understand a paused command

Inspect the command's classification and matching rules:

hol-guard command test 'rm -rf ./build'
hol-guard command explain 'git clean -ndx'
hol-guard command extensions command.git --json

command test and command explain inspect the command without executing it or creating an approval. Use hol-guard approvals to resolve a pending request and hol-guard receipts to review the recorded decision.

The Extension directory lists command coverage generated from the Rust-compiled catalog. External contributions require explicit opt-in; required core protections remain enabled. To add coverage, follow the Extension contribution guide.

Check a package

hol-guard supply-chain sync
hol-guard supply-chain scan
hol-guard supply-chain explain minimist@1.2.5 --ecosystem npm

The package verdict includes the available advisory evidence and ecosystem coverage. See the get-started guide for package-manager interception and the remediation guide for handling false positives.

Plugin Scanner

This repository also ships plugin-scanner, a CLI for maintainers who want security and quality checks before publishing agent plugins, skills, and MCP integrations.

pipx install plugin-scanner
plugin-scanner scan .
plugin-scanner lint .
plugin-scanner verify .

Command	Purpose
`scan`	Security findings and a quality report across detected package surfaces.
`lint`	Rule-level authoring feedback.
`verify`	Install-surface and runtime readiness checks.
`submit`	A submission artifact for one plugin package.
`doctor`	Component diagnostics and troubleshooting bundles.

The scanner detects Codex, Claude Code, DeepSeek Harness, Gemini CLI, Kimi Code, and OpenCode package formats. Use plugin-scanner --list-ecosystems to list them or --ecosystem to select one. At a Codex marketplace root, it discovers local plugin entries automatically.

Checks cover manifests, secrets, MCP transport and command configuration, approval defaults, skills, dependency lockfiles, and GitHub Actions permissions. Optional Cisco integrations add skill and MCP analysis. Reports support text, JSON, Markdown, and SARIF.

plugin-scanner scan . --format sarif --output plugin-scanner.sarif
plugin-scanner scan . --fail-on-severity high

Quality grades use the checks applicable to each package. Trust scoring has separate provenance and weights; see the skill, MCP, and plugin scoring references.

GitHub Actions

Add the scanner to a plugin repository:

name: Plugin security
on: [push, pull_request]