Guard

# HOL Guard Skill Guidance

Use this guidance when an AI agent is about to add or update dependencies.

## Before package installs

1. Preview the install decision:
   - `hol-guard protect --dry-run -- npm install <package>`
2. Check current workspace risk posture:
   - `hol-guard supply-chain scan --json`
3. Explain a specific package verdict:
   - `hol-guard supply-chain explain <package>@<version> --ecosystem <ecosystem>`
4. Confirm package manager interception is installed:
   - `hol-guard package-shims status --json`
5. Repair a missing or tampered package manager shim:
   - `hol-guard package-shims repair --manager npm --json`

## Cursor editor and Cursor CLI

Cursor has two protection surfaces. **Cursor editor** covers MCP servers in `.cursor/mcp.json`. **Cursor CLI** covers the `cursor-agent` command path. Keep them distinct when activating, checking, repairing, or removing Guard.

1. Connect Cursor editor protection:
   - `hol-guard apps connect cursor --surface editor`
2. Connect Cursor CLI protection:
   - `hol-guard apps connect cursor --surface cli`
3. Test a Cursor surface without changing config:
   - `hol-guard apps test cursor --surface editor`
   - `hol-guard apps test cursor --surface cli`
4. Repair only the stale surface named by Guard Cloud:
   - `hol-guard apps repair cursor --surface editor`
   - `hol-guard apps repair cursor --surface cli`
5. Remove protection only after confirmation:
   - `hol-guard apps disconnect cursor --surface editor --confirm disconnect-cursor`
   - `hol-guard apps disconnect cursor --surface cli --confirm disconnect-cursor`

Guard owns trust checks, drift repair, redacted receipts, and Cloud sync. Cursor owns its native editor and CLI behavior. If a surface is missing, unsupported, or unavailable, report that state instead of inventing an install URL or fallback command.

## During CI and automation

- Route dependency installs through Guard:
  - `hol-guard protect -- npm ci`
- Use workspace audits before release:
  - `hol-guard supply-chain audit --json`

## If Guard blocks a package

- Review the blocking reason and suggested fix version.
- Prefer upgrading to a safe version.
- If it is a verified false positive, use a scoped and expiring exception with recorded reason.