Proposal
Add a focused HOL Guard skill to PostHog's maintained context-mill distribution for developers who run PostHog setup, audit, or maintenance work through supported local coding-agent harnesses.
This would put HOL Guard itself into the PostHog Wizard/MCP skill distribution rather than adding generic security prose. The skill would install and invoke the real HOL Guard runtime before the local coding agent performs state-changing command/tool work, while keeping PostHog-native auth, project targeting, previews, validation, and human review authoritative.
Suggested scope:
- ship initially as a discoverable
role: skill, not a new top-level Wizard command;
- install HOL Guard locally and use
hol-guard detect --json to identify a supported coding-agent harness;
- use the Guard-owned
install, run, and doctor flow for that detected harness;
- treat deny, review-required, timeout, malformed, unavailable, or error states as stop conditions instead of falling back to an unprotected agent session;
- preserve PostHog's own Wizard/MCP safeguards and make the boundary explicit: HOL Guard protects supported local coding-agent execution, not PostHog's hosted services or MCP server internals;
- keep
plugin-scanner scoped to Agent Skills/plugins/MCP packages before trust, not PostHog application vulnerability scanning.
context-mill is the direct distribution surface: its README explicitly invites new skills, builds them into versioned dist/skills artifacts, and the PostHog Wizard/MCP consumers fetch those maintained releases. If maintainers agree on placement, I can follow with the smallest context/skills/<name> contribution and run the documented npm test && npm run build checks.
HOL Guard: https://github.com/hashgraph-online/hol-guard
Maintained HOL Guard Agent Skill reference: https://github.com/hashgraph-online/hol-guard-plugin/tree/main/skills/hol-guard
I searched current issues, PRs, and repository code for HOL Guard / hol-guard immediately before filing and found no existing route.
Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this proposal; I checked the scope against the current README and CONTRIBUTING.md.
Proposal
Add a focused HOL Guard skill to PostHog's maintained context-mill distribution for developers who run PostHog setup, audit, or maintenance work through supported local coding-agent harnesses.
This would put HOL Guard itself into the PostHog Wizard/MCP skill distribution rather than adding generic security prose. The skill would install and invoke the real HOL Guard runtime before the local coding agent performs state-changing command/tool work, while keeping PostHog-native auth, project targeting, previews, validation, and human review authoritative.
Suggested scope:
role: skill, not a new top-level Wizard command;hol-guard detect --jsonto identify a supported coding-agent harness;install,run, anddoctorflow for that detected harness;plugin-scannerscoped to Agent Skills/plugins/MCP packages before trust, not PostHog application vulnerability scanning.context-millis the direct distribution surface: its README explicitly invites new skills, builds them into versioneddist/skillsartifacts, and the PostHog Wizard/MCP consumers fetch those maintained releases. If maintainers agree on placement, I can follow with the smallestcontext/skills/<name>contribution and run the documentednpm test && npm run buildchecks.HOL Guard: https://github.com/hashgraph-online/hol-guard
Maintained HOL Guard Agent Skill reference: https://github.com/hashgraph-online/hol-guard-plugin/tree/main/skills/hol-guard
I searched current issues, PRs, and repository code for
HOL Guard/hol-guardimmediately before filing and found no existing route.Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this proposal; I checked the scope against the current README and CONTRIBUTING.md.