plugin-scanner

Plugin Scanner

Use the open-source plugin-scanner CLI when a user asks to inspect an AI agent skill, plugin, MCP server, package, or repository before installation or use.

Scanning runs locally. Do not require an account, API key, hosted service, or remote decision endpoint, and do not send the target or findings to a hosted HOL service.

When to use this skill

Use this skill when the user asks to:

• scan or audit a SKILL.md before installing it;
• inspect an MCP server or agent plugin for security risks;
• check a third-party agent repository before trusting it;
• look for prompt injection, credential exposure, unsafe commands, or suspicious package/install behavior;
• validate a skill or plugin repository in CI or before publishing it.

Safety rules

• Never execute code from the target repository just to scan it.
• Never run the target's install scripts, package lifecycle hooks, or arbitrary shell commands.
• Never read .env files, credential stores, private keys, or unrelated user secrets.
• Prefer scanning a local path or a repository the user has already chosen to inspect.
• Treat scanner findings as security evidence, not a guarantee that a package is safe.
• Ask before installing plugin-scanner if the command is not already available.
• Do not upload the target, package names, URLs, findings, prompts, or workspace contents to a hosted service.

1. Check for the scanner

command -v plugin-scanner

If it is not installed, explain that plugin-scanner is a separate open-source CLI distribution built from the HOL Guard source repository. Install only after the user explicitly approves setup:

pipx install plugin-scanner==2.2.119

Do not assume an existing hol-guard installation also provides the scanner command. If pipx is unavailable, recommend an isolated Python CLI installation approach rather than silently modifying the user's Python environment.

2. Scan the target without executing it

For a repository or directory: