Plugin Scanner

Use HOL's local plugin-scanner when a user asks to inspect an AI agent skill, plugin, MCP server, agent package, or repository before installation or use.

The scanner is shipped by the open-source plugin-scanner Python distribution. It is built from the same HOL Guard source repository, but it is intentionally packaged separately from the hol-guard runtime CLI. Scanning runs locally and does not require Guard Cloud.

When to use this skill

Use this skill when the user asks to:

• scan or audit a SKILL.md before installing it;
• inspect an MCP server or agent plugin for security risks;
• check a third-party agent repository before trusting it;
• look for prompt injection, credential exposure, unsafe commands, or suspicious package/install behavior;
• validate a skill/plugin repository in CI or before publishing it.

Safety rules