The Agent Skills Directory

[SAFE]: The skill focuses on providing security controls, approval reviews, and monitoring for AI agent harnesses. It includes explicit safety rules such as avoiding .env files and requiring command-verified protection states.
[EXTERNAL_DOWNLOADS]: The skill recommends installing the hol-guard and plugin-scanner packages using pipx. These are the core tools described in the skill and are installed via a standard, isolated Python package manager.
[COMMAND_EXECUTION]: Various subcommands of hol-guard and plugin-scanner are used for environment detection, status monitoring, and security auditing. All commands are legitimate and aligned with the tool's stated security-focused purpose.
[INDIRECT_PROMPT_INJECTION]: The plugin-scanner utility is designed to process external paths and repository files for linting and verification.
Ingestion points: Untrusted data enters the context through files and packages at specified paths provided to the plugin-scanner lint and plugin-scanner verify commands in SKILL.md.
Boundary markers: The skill does not explicitly define boundary markers for the output of these scans.
Capability inventory: The skill can install packages via pipx, manage AI harnesses with hol-guard run/install, and synchronize data using hol-guard sync.
Sanitization: No specific sanitization methods for the content of scanned packages are mentioned; however, the tool is explicitly described as a security scanner intended to identify risks in such content.

hol-guard