HOL Guard Skill Guidance

Use this guidance when an AI agent is about to add or update dependencies.

Before package installs

1. Preview the install decision:
   • hol-guard protect --dry-run -- npm install <package>
2. Check current workspace risk posture:
   • hol-guard supply-chain scan --json
3. Explain a specific package verdict:
   • hol-guard supply-chain explain <package>@<version> --ecosystem <ecosystem>
4. Confirm package manager interception is installed:
   • hol-guard package-shims status --json
5. Repair a missing or tampered package manager shim:
   • hol-guard package-shims repair --manager npm --json

Cursor editor and Cursor CLI

Cursor has two protection surfaces. Cursor editor covers MCP servers in .cursor/mcp.json. Cursor CLI covers the cursor-agent command path. Keep them distinct when activating, checking, repairing, or removing Guard.

1. Connect Cursor editor protection:
   • hol-guard apps connect cursor --surface editor
2. Connect Cursor CLI protection:
   • hol-guard apps connect cursor --surface cli
3. Test a Cursor surface without changing config:
   • hol-guard apps test cursor --surface editor
   • hol-guard apps test cursor --surface cli
4. Repair only the stale surface named by Guard Cloud:
   • hol-guard apps repair cursor --surface editor
   • hol-guard apps repair cursor --surface cli
5. Remove protection only after confirmation:
   • hol-guard apps disconnect cursor --surface editor --confirm disconnect-cursor
   • hol-guard apps disconnect cursor --surface cli --confirm disconnect-cursor

Guard owns trust checks, drift repair, redacted receipts, and Cloud sync. Cursor owns its native editor and CLI behavior. If a surface is missing, unsupported, or unavailable, report that state instead of inventing an install URL or fallback command.

During CI and automation