hashgraph-online/hol-guard

Review signals: 1 connection review, 2 download and execute, 5 encoded execution, 537 hardcoded secret, 46 known vulnerability, 1 sensitive read. 115 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 11 distinct locations. 1 attributed processes.

PID 3850: /tmp/pipx<host-path> · hol-guard

Source contains download and execute; review its purpose. 2 distinct locations. 2 findings.

Source contains encoded execution; review its purpose. 3 distinct locations. 5 findings.

Gitleaks found a possible hardcoded secret; value withheld. 17 distinct locations. 190 findings.

OSV reports a known vulnerability in this dependency version. 13 distinct locations. 33 findings.

A repository process attempted to read this sensitive path. <guest-path> Support/Antigravity/User/settings.json 2 attributed processes.

1 download and execute matches retained as context; full list in the evidence.

37 encoded execution matches retained as context; full list in the evidence.

77 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• command test inspects a command without executing it or creating an approval: Real input produced the expected result: command.filesystem.recursive-delete

  Source: README.md

  Input: rm -rf ./build

  Expected: REVIEW verdict classified as recursive-delete, no approval created

  Command: /tmp/pipx/bin/hol-guard command test 'rm -rf ./build'

  Observed: command.filesystem.recursive-delete │ │ Risk classes destructive_shell │ │ Policy Not evaluated; this inspection creates no approvals or receipts │ ╰──────────────────────────────────────────────────────────────────────────────╯ ╭────────────────────────────────── Command ───────────────────────────────────╮ │ rm -rf ./build │ ╰──────────────────────────────────────────────────────────────────────────────╯ ╭──────────────────────────────────── Why ──────

• plugin-scanner detects Claude Code package formats: Real input produced the expected result: Ecosystems: claude

  Source: README.md

  Input: tests/fixtures/claude-plugin-good

  Expected: Claude ecosystem detected and scanned

  Command: /tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good

  Observed: Ecosystems: claude Detected packages: 1 ── Claude Plugin (18/18) ── ✅ Claude manifest exists +4 ✅ Claude required fields and semver +5 ✅ Claude marketplace structure +0 ✅ Claude custom paths are relative +4 ✅ Claude hooks and skills are parseable +5 ── Security (16/16) ── ✅ SECURITY.md found +3 ✅ LICENSE found +3 ✅ No hardcoded secrets +7 ✅ Runtime credential access +0 ✅ No dangerous MCP commands +0

Examples

• plugin-scanner scans a Claude Code plugin and reports a score: command completed successfully

  Source: README.md

  Input: tests/fixtures/claude-plugin-good

  Expected: Claude ecosystem scanned with 100/100 score

  Command: /tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good

  Observed: nal Security (0/0) ── ✅ Third-party GitHub Actions pinned to SHAs +0 ✅ No write-all GitHub Actions permissions +0 ✅ No privileged untrusted checkout patterns +0 ✅ Dependabot configured for automation surfaces +0 ✅ Dependency manifests have lockfiles +0 ── Code Quality (10/10) ── ✅ No eval or Function constructor +5 ✅ No shell injection patterns +5 Findings: critical:0, high:0, medium:0, low:0, info:0 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Final Score: 100/100 (A - Excellent) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Policy profile: default

• plugin-scanner writes a JSON report to --output: command completed successfully

  Source: README.md

  Input: scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json

  Expected: JSON file with scan-result.v1 schema

  Command: /tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json-checker-14461792bd82443099b38d0d37883a08

  Observed: l or Function constructor", "passed": true, "points": 5, "maxPoints": 5, "message": "No eval() or new Function() usage detected", "findings": [] }, { "name": "No shell injection patterns", "passed": true, "points": 5, "maxPoints": 5, "message": "No shell injection patterns detected", "findings": [] } ] } ], "findings": [], "timestamp": "2026-10-24T23:16:28.219748+00:00", "pluginDir": "<guest-path>" }

Local or hosted: local

Run HOL Guard's local command inspection (hol-guard command test) and the plugin-scanner scan on a Claude plugin fixture, both from the README, and get real results.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && git status 2>&1 | head -3; echo "---"; ls /inputs 2>&1; echo "CDP=$CDP_URL"
cd <guest-path> && cat README.md 2>/dev/null | head -c 7000
cd <guest-path> && sed -n '1,400p' README.md | tail -c +7000 | head -c 7500
which pipx uv pip3 2>&1; python3 -m pipx --version 2>&1 | head -2; python3 -m pip --version 2>&1; cat /etc/os-release | head -2; sudo -n true && echo SUDO_OK
sudo -n DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>&1 | tail -3; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq pipx python3-pip python3-venv >/tmp/apt.log 2>&1; echo "rc=$?"; tail -3 /tmp/apt.log; pipx --version
cd /tmp && export PIPX_HOME=/tmp/pipx/home PIPX_BIN_DIR=/tmp/pipx/bin && pipx install hol-guard 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"; ls /tmp/pipx/bin 2>&1
export PATH=/tmp/pipx/bin:$PATH; hol-guard --version; grep -m2 '^version' <guest-path>; hol-guard --help 2>&1 | head -60
export PATH=/tmp/pipx/bin:$PATH; hol-guard status 2>&1 | head -30; echo "rc=$?"; hol-guard command test 'rm -rf ./build' 2>&1 | head -40
export PATH=/tmp/pipx/bin:$PATH; cd <guest-path>; ls examples; find . -name plugin.json -path '*claude*' -not -path './node_modules/*' | head; find . -name '.claude-plugin' -type d | head -5; which plugin-guard; plugin-scanner --help 2>&1 | head -5
export PIPX_HOME=/tmp/pipx/home PIPX_BIN_DIR=/tmp/pipx/bin; cd /tmp && pipx install plugin-scanner 2>&1 | tail -4; /tmp/pipx/bin/plugin-scanner --version 2>&1 | head -2; /tmp/pipx/bin/plugin-scanner --help 2>&1 | head -30
cd <guest-path> && /tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good 2>&1 | head -60; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && grep -n -i -E 'cron|schedul|--once|--now|webhook|daemon|interval|loop' README.md | head -20; echo ---; grep -n 'inspect the command without executing' README.md; grep -n 'Ecosystems\|detects Codex, Claude Code' README.md | head; echo ---; grep -n -F 'Run it locally without an account.' README.md
cd <guest-path> && grep -rn -E 'while True|sched|cron|setInterval|--once' src --include=*.py 2>/dev/null | grep -v test | head -15; echo "---"; mkdir -p .coldpass/scan-json && /tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-json/report.json; echo "rc=$?"; ls -la .coldpass/scan-json; head -c 400 .coldpass/scan-json/report.json
cd <guest-path> && rm -rf .coldpass/scan-json && mkdir -p .coldpass/scan-example && ls -la .coldpass/ && ls -la <guest-path> 2>&1 | head -5
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
  {"kind":"claim","claim":"command test inspects a command without executing it or creating an approval","source":"README.md","source_file":"README.md","quote":"`command test` and `command explain` inspect the command without executing it or creating an approval.","input":"rm -rf ./build","expected":"REVIEW verdict classified as recursive-delete, no approval created","probe_kind":"cli","argv":["/tmp/pipx/bin/hol-guard","command","test","rm -rf ./build"],"expected_text":"command.filesystem.recursive-delete","cwd":"<guest-path>"},
  {"kind":"claim","claim":"plugin-scanner detects Claude Code package formats","source":"README.md","source_file":"README.md","quote":"The scanner detects Codex, Claude Code, DeepSeek Harness, Gemini CLI, Kimi Code, and OpenCode package formats.","input":"tests/fixtures/claude-plugin-good","expected":"Claude ecosystem detected and scanned","probe_kind":"cli","argv":["/tmp/pipx/bin/plugin-scanner","scan","tests/fixtures/claude-plugin-good"],"expected_text":"Ecosystems: claude","cwd":"<guest-path>"}
]
EOF
python3 -I -c 'import json;print(len(json.load(open(".coldpass/claims.json"))))'
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/pipx/bin/hol-guard","command","test","rm -rf ./build"],"cwd":"<guest-path>","expected_text":"command.filesystem.recursive-delete"}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","claim":"plugin-scanner scans a Claude Code plugin and reports a score","source":"README.md","input":"tests/fixtures/claude-plugin-good","expected":"Claude ecosystem scanned with 100/100 score","argv":["/tmp/pipx/bin/plugin-scanner","scan","tests/fixtures/claude-plugin-good"],"cwd":"<guest-path>","expected_text":"Final Score: 100/100"},
  {"kind":"example","claim":"plugin-scanner writes a JSON report to --output","source":"README.md","input":"scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json","expected":"JSON file with scan-result.v1 schema","argv":["/tmp/pipx/bin/plugin-scanner","scan","tests/fixtures/claude-plugin-good","--format","json","--output",".coldpass/scan-example/report.json"],"cwd":"<guest-path>","expected_file":".coldpass/scan-example/report.json","expected_text":"scan-result.v1"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md has no cron, schedule, loop, webhook, --once or --now wording; plugin-scanner and hol-guard CLIs are one-shot commands. src/ contains a guard daemon and internal while-loops, but no documented recurring product cycle. Guard runs on demand per README (hol-guard run/command test).","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run HOL Guard's local command inspection (hol-guard command test) and the plugin-scanner scan on a Claude plugin fixture, both from the README, and get real results.","operation_scope":"Local CLI only, Linux Ubuntu 24.04 guest, Python 3.12.3. No Guard Cloud, no account, no browser or CDP needed. Installed from PyPI as the README documents, not built from the pinned source snapshot.","steps":["sudo apt-get install -y pipx python3-pip python3-venv (README requires pipx)","pipx install hol-guard (installed 3.56.0)","hol-guard --version; hol-guard status (setup check, rc 0)","hol-guard command test 'rm -rf ./build' (REVIEW, rule command.filesystem.recursive-delete)","pipx install plugin-scanner (README Plugin Scanner section; installed 3.56.0)","plugin-scanner scan tests/fixtures/claude-plugin-good (Ecosystems: claude, Final Score 100/100)","plugin-scanner scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json (scan-result.v1 file written)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid true, replay PASS)"],"deviations":["Installed hol-guard and plugin-scanner from PyPI via pipx per README; installed version 3.56.0 differs from pyproject.toml version 3.55.1 of the pinned snapshot. The snapshot was not installed from source.","Installed pipx/pip with apt because they were missing (sudo apt-get, Ubuntu 24.04). Install succeeded.","Did not run interactive 'hol-guard init' first-run wizard or 'hol-guard connect' (consent/cloud steps); used the non-interactive commands above instead.","/inputs/coldpass-preflight.py does not exist in this guest; ran <guest-path> with the same flags instead.","No browser or CDP endpoint used: the operations here are local CLI and do not need a browser."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None needed for this run. Optional: build and test from the pinned commit source to confirm the 3.55.1 snapshot matches the 3.56.0 PyPI release."}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c 'import json,sys;d=json.load(sys.stdin);print("valid",d["valid"],"problems",d["problems"],"replay",d["replay"]["status"])'