How do I install the Guard skill?

Run npx skillmds@latest add gabrielmoreira/guard in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Guard skill do?

HOL Guard Skill Guidance It is listed under Coding & Dev Tools on SkillMD.

Is Guard safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Guard?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Guard free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Guard by gabrielmoreira — Agent Skill

Name: Guard
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

File contents

HOL Guard Skill Guidance

Use this guidance when an AI agent is about to add or update dependencies.

Before package installs

Preview the install decision:
- hol-guard protect --dry-run -- npm install <package>
Check current workspace risk posture:
- hol-guard supply-chain scan --json
Explain a specific package verdict:
- hol-guard supply-chain explain <package>@<version> --ecosystem <ecosystem>
Confirm package manager interception is installed:
- hol-guard package-shims status --json
Repair a missing or tampered package manager shim:
- hol-guard package-shims repair --manager npm --json

Cursor editor and Cursor CLI

Cursor has two protection surfaces. Cursor editor covers MCP servers in .cursor/mcp.json. Cursor CLI covers the cursor-agent command path. Keep them distinct when activating, checking, repairing, or removing Guard.

Connect Cursor editor protection:
- hol-guard apps connect cursor --surface editor
Connect Cursor CLI protection:
- hol-guard apps connect cursor --surface cli
Test a Cursor surface without changing config:
- hol-guard apps test cursor --surface editor
- hol-guard apps test cursor --surface cli
Repair only the stale surface named by Guard Cloud:
- hol-guard apps repair cursor --surface editor
- hol-guard apps repair cursor --surface cli
Remove protection only after confirmation:
- hol-guard apps disconnect cursor --surface editor --confirm disconnect-cursor
- hol-guard apps disconnect cursor --surface cli --confirm disconnect-cursor

Guard owns trust checks, drift repair, redacted receipts, and Cloud sync. Cursor owns its native editor and CLI behavior. If a surface is missing, unsupported, or unavailable, report that state instead of inventing an install URL or fallback command.

During CI and automation

Route dependency installs through Guard:
- hol-guard protect -- npm ci
Use workspace audits before release:
- hol-guard supply-chain audit --json

If Guard blocks a package

Review the blocking reason and suggested fix version.
Prefer upgrading to a safe version.
If it is a verified false positive, use a scoped and expiring exception with recorded reason.

---name: guarddescription: HOL Guard Skill Guidance---# HOL Guard Skill GuidanceUse this guidance when an AI agent is about to add or update dependencies.## Before package installs1. Preview the install decision: - `hol-guard protect --dry-run -- npm install <package>`2. Check current workspace risk posture: - `hol-guard supply-chain scan --json`3. Explain a specific package verdict: - `hol-guard supply-chain explain <package>@<version> --ecosystem <ecosystem>`4. Confirm package manager interception is installed: - `hol-guard package-shims status --json`5. Repair a missing or tampered package manager shim: - `hol-guard package-shims repair --manager npm --json`## Cursor editor and Cursor CLICursor has two protection surfaces. **Cursor editor** covers MCP servers in `.cursor/mcp.json`. **Cursor CLI** covers the `cursor-agent` command path. Keep them distinct when activating, checking, repairing, or removing Guard.1. Connect Cursor editor protection: - `hol-guard apps connect cursor --surface editor`2. Connect Cursor CLI protection: - `hol-guard apps connect cursor --surface cli`3. Test a Cursor surface without changing config: - `hol-guard apps test cursor --surface editor` - `hol-guard apps test cursor --surface cli`4. Repair only the stale surface named by Guard Cloud: - `hol-guard apps repair cursor --surface editor` - `hol-guard apps repair cursor --surface cli`5. Remove protection only after confirmation: - `hol-guard apps disconnect cursor --surface editor --confirm disconnect-cursor` - `hol-guard apps disconnect cursor --surface cli --confirm disconnect-cursor`Guard owns trust checks, drift repair, redacted receipts, and Cloud sync. Cursor owns its native editor and CLI behavior. If a surface is missing, unsupported, or unavailable, report that state instead of inventing an install URL or fallback command.## During CI and automation- Route dependency installs through Guard: - `hol-guard protect -- npm ci`- Use workspace audits before release: - `hol-guard supply-chain audit --json`## If Guard blocks a package- Review the blocking reason and suggested fix version.- Prefer upgrading to a safe version.- If it is a verified false positive, use a scoped and expiring exception with recorded reason.

Frequently asked questions

Guard