From 2980551cab845699463a0636a158a3fd986012bc Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Thu, 27 Aug 2026 14:40:46 -0400 Subject: [PATCH 1/6] [skill] add HOL Guard runtime safety --- .claude-plugin/marketplace.json | 1 + README.md | 1 + skills/.claude-plugin/marketplace.json | 1 + skills/devsecops/hol-guard/SKILL.md | 107 +++++++++++++++++++++++++ 4 files changed, 110 insertions(+) create mode 100644 skills/devsecops/hol-guard/SKILL.md diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index a55b257..7ac2eb9 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -32,6 +32,7 @@ "strict": false, "skills": [ "./devsecops/secrets-gitleaks", + "./devsecops/hol-guard", "./devsecops/iac-checkov", "./devsecops/container-grype", "./devsecops/container-hadolint", diff --git a/README.md b/README.md index 6178770..c3a4285 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,7 @@ SecOpsAgentKit provides specialized Claude Code skills for security operations, - **[container-grype](skills/devsecops/container-grype/SKILL.md)** - Container vulnerability scanning and dependency risk assessment using [Grype](https://github.com/anchore/grype) with CVSS, EPSS, and CISA KEV prioritization - **[container-hadolint](skills/devsecops/container-hadolint/SKILL.md)** - Dockerfile security linting and best practice validation using [Hadolint](https://github.com/hadolint/hadolint) +- **[hol-guard](skills/devsecops/hol-guard/SKILL.md)** - AI agent runtime protection using [HOL Guard](https://github.com/hashgraph-online/hol-guard) with fail-closed pre-tool enforcement - **[iac-checkov](skills/devsecops/iac-checkov/SKILL.md)** - Infrastructure as Code security scanning using [Checkov](https://www.checkov.io/) with 750+ built-in policies - **[sca-trivy](skills/devsecops/sca-trivy/SKILL.md)** - Software Composition Analysis and container vulnerability scanning using [Trivy](https://aquasecurity.github.io/trivy/) for CVE detection - **[secrets-gitleaks](skills/devsecops/secrets-gitleaks/SKILL.md)** - Hardcoded secret detection and prevention in git repositories using [Gitleaks](https://github.com/gitleaks/gitleaks) diff --git a/skills/.claude-plugin/marketplace.json b/skills/.claude-plugin/marketplace.json index 6469a51..ac5ccda 100644 --- a/skills/.claude-plugin/marketplace.json +++ b/skills/.claude-plugin/marketplace.json @@ -20,6 +20,7 @@ "skills": [ "./devsecops/container-grype", "./devsecops/container-hadolint", + "./devsecops/hol-guard", "./devsecops/iac-checkov", "./devsecops/sca-trivy", "./devsecops/secrets-gitleaks", diff --git a/skills/devsecops/hol-guard/SKILL.md b/skills/devsecops/hol-guard/SKILL.md new file mode 100644 index 0000000..cbca9ef --- /dev/null +++ b/skills/devsecops/hol-guard/SKILL.md @@ -0,0 +1,107 @@ +--- +name: hol-guard +description: > + Runtime safety for supported local AI coding harnesses using HOL Guard before mutation-bearing tool work. + Use when: (1) protecting a local coding agent before commands or file changes, (2) requiring fail-closed + approval and denial behavior before tool execution, (3) collecting Guard status, doctor, receipt, and audit + evidence while preserving the harness native authorization, sandbox, and confirmation controls. +version: 0.1.0 +maintainer: kantorcodes +category: devsecops +tags: [hol-guard, agent-security, runtime-security, ai-safety, devsecops, approvals, audit] +frameworks: [OWASP, NIST, SOC2] +dependencies: + tools: [hol-guard] +references: + - https://github.com/hashgraph-online/hol-guard +--- + +# HOL Guard Runtime Safety + +Use HOL Guard as an additional pre-tool runtime-safety layer for supported local AI coding harnesses. Keep the harness own authentication, permissions, confirmations, sandboxing, and provider policy enabled. + +## Safety rules + +- Do not claim protection until HOL Guard itself reports healthy evidence for the detected harness. +- Do not guess or hard-code a harness identifier. Use `hol-guard detect --json` and reuse the exact supported identifier it returns. +- If Guard returns deny, review, unhealthy status, unexpected mutation, or an error, stop mutation-bearing work. Never fall back to launching the raw harness as a protection bypass. +- Never approve a blocked action without reading the Guard risk reason and confirming the requested scope. +- Keep HOL Guard Cloud optional. Do not connect or sync unless the user explicitly requests it. +- Never weaken native harness controls because Guard is installed. +- Do not read or copy `.env` files, credentials, or secret stores into prompts or external services. + +## Install and verify + +Probe the real CLI first: + +```bash +hol-guard --version +``` + +If it is unavailable and the user asked to install Guard, prefer an isolated stable install: + +```bash +pipx install --force "hol-guard==3.0.0" +hol-guard --version +``` + +If `pipx` is unavailable, report that isolated CLI installation is recommended instead of silently modifying the active Python environment. + +## Protect the detected harness + +Run from the target workspace: + +```bash +hol-guard status +hol-guard detect --json +``` + +Use only the exact supported harness identifier returned by detection. Then run the Guard-owned setup and verification path: + +```bash +hol-guard bootstrap +hol-guard install +hol-guard run --dry-run +hol-guard doctor --json +hol-guard run +hol-guard status +``` + +The dry run and `doctor` must succeed before claiming protection. If detection finds no supported harness, or bootstrap/install/dry-run/doctor fails, stop and report the exact failure instead of starting an unprotected session. + +## Handle approval-gated work + +Inspect Guard-owned decisions before resolving them: + +```bash +hol-guard approvals +hol-guard approvals open +hol-guard receipts +hol-guard diff +``` + +When Guard returns a request ID and the user has authorized the specific decision: + +```bash +hol-guard approvals approve +hol-guard approvals deny +``` + +A prior approval does not authorize a different request. + +## Audit evidence + +Use Guard evidence surfaces rather than inventing success: + +```bash +hol-guard receipts +hol-guard inventory +hol-guard abom --format json +hol-guard events +``` + +Report only evidence actually returned by Guard. Keep optional cloud synchronization disabled unless explicitly requested. + +## Output + +Return a concise report with the detected harness identifier, HOL Guard version, bootstrap/install/dry-run/doctor/run results, final status evidence, pending approvals or blocks, and the exact next safe command if work remains blocked. From 1f3f84006c9acdbb2bab006b90bd66c4c21df7fc Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Thu, 27 Aug 2026 18:38:57 -0400 Subject: [PATCH 2/6] fix: refresh HOL Guard stable pin to 3.0.5 --- skills/devsecops/hol-guard/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/devsecops/hol-guard/SKILL.md b/skills/devsecops/hol-guard/SKILL.md index cbca9ef..decac9d 100644 --- a/skills/devsecops/hol-guard/SKILL.md +++ b/skills/devsecops/hol-guard/SKILL.md @@ -41,7 +41,7 @@ hol-guard --version If it is unavailable and the user asked to install Guard, prefer an isolated stable install: ```bash -pipx install --force "hol-guard==3.0.0" +pipx install --force "hol-guard==3.0.5" hol-guard --version ``` From 8caf4ef7a27c567e43faa3a112178e9293cca0b3 Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Thu, 27 Aug 2026 22:35:50 -0400 Subject: [PATCH 3/6] fix: refresh HOL Guard stable pin to 3.0.10 --- skills/devsecops/hol-guard/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/devsecops/hol-guard/SKILL.md b/skills/devsecops/hol-guard/SKILL.md index decac9d..45bbbe9 100644 --- a/skills/devsecops/hol-guard/SKILL.md +++ b/skills/devsecops/hol-guard/SKILL.md @@ -41,7 +41,7 @@ hol-guard --version If it is unavailable and the user asked to install Guard, prefer an isolated stable install: ```bash -pipx install --force "hol-guard==3.0.5" +pipx install --force "hol-guard==3.0.10" hol-guard --version ``` From bbf84616b1801480ea672aac3d05a23fa272b5d4 Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Thu, 27 Aug 2026 23:19:39 -0400 Subject: [PATCH 4/6] fix(skill): refresh HOL Guard stable pin to 3.0.11 --- skills/devsecops/hol-guard/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/devsecops/hol-guard/SKILL.md b/skills/devsecops/hol-guard/SKILL.md index 45bbbe9..873ebb3 100644 --- a/skills/devsecops/hol-guard/SKILL.md +++ b/skills/devsecops/hol-guard/SKILL.md @@ -41,7 +41,7 @@ hol-guard --version If it is unavailable and the user asked to install Guard, prefer an isolated stable install: ```bash -pipx install --force "hol-guard==3.0.10" +pipx install --force "hol-guard==3.0.11" hol-guard --version ``` From ead5b6b636090f167897168db6505415dffafee1 Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Fri, 28 Aug 2026 00:07:45 -0400 Subject: [PATCH 5/6] fix(hol-guard): refresh pinned stable release to 3.0.12 --- skills/devsecops/hol-guard/SKILL.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/skills/devsecops/hol-guard/SKILL.md b/skills/devsecops/hol-guard/SKILL.md index 873ebb3..64e4057 100644 --- a/skills/devsecops/hol-guard/SKILL.md +++ b/skills/devsecops/hol-guard/SKILL.md @@ -38,14 +38,14 @@ Probe the real CLI first: hol-guard --version ``` -If it is unavailable and the user asked to install Guard, prefer an isolated stable install: +If it is unavailable and the user asked to install Guard, prefer the isolated pinned stable install used by this contribution: ```bash -pipx install --force "hol-guard==3.0.11" +pipx install --force "hol-guard==3.0.12" hol-guard --version ``` -If `pipx` is unavailable, report that isolated CLI installation is recommended instead of silently modifying the active Python environment. +Do not silently replace this pin with `latest`, a prerelease, or a branch URL. If `pipx` is unavailable, report that isolated CLI installation is recommended instead of silently modifying the active Python environment. ## Protect the detected harness From 6a5c031ab88dd4b84ed3c441e192426fd185c63f Mon Sep 17 00:00:00 2001 From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com> Date: Fri, 28 Aug 2026 12:42:06 -0400 Subject: [PATCH 6/6] fix(skill): pass request id to approvals open --- skills/devsecops/hol-guard/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/devsecops/hol-guard/SKILL.md b/skills/devsecops/hol-guard/SKILL.md index 64e4057..271d3d7 100644 --- a/skills/devsecops/hol-guard/SKILL.md +++ b/skills/devsecops/hol-guard/SKILL.md @@ -75,7 +75,7 @@ Inspect Guard-owned decisions before resolving them: ```bash hol-guard approvals -hol-guard approvals open +hol-guard approvals open hol-guard receipts hol-guard diff ```