Proposal: add a HOL Guard skill for protected local Sentry agent workflows #337

Proposal

Add a focused protect-sentry-workflows-with-hol-guard skill to the maintained Sentry AI plugin source so users can put HOL Guard itself on a supported local coding-agent harness before that agent performs Sentry-related command/tool work.

This would be a direct integration in Sentry's official Claude/Cursor/Codex/Grok skill distribution, not a generic security checklist. The skill would install and invoke the real HOL Guard runtime, for example:

pipx install hol-guard
hol-guard detect --json
hol-guard install <detected-harness>
hol-guard run <detected-harness> --dry-run
hol-guard run <detected-harness>
hol-guard doctor <detected-harness> --json

Suggested scope:

• use the exact supported harness identifier returned by hol-guard detect --json rather than guessing an adapter;
• treat Guard deny, review-required, timeout, malformed, unavailable, or error states as stop conditions instead of falling back to an unprotected agent session;
• preserve Sentry's own auth, project/org targeting, MCP trust boundary, and human review practices;
• keep the architecture explicit: HOL Guard protects the supported local coding-agent harness. This would not claim that Guard runs inside Sentry's hosted MCP service or transparently intercepts every remote Sentry tool call;
• optionally document the separate plugin-scanner CLI only for Agent Skills/plugins/MCP packages before trust, not as a Sentry application-code scanner.

AGENTS.md currently makes src/skills/ the source of truth and publishes those skills into Sentry's Claude, Cursor, Codex, and Grok distribution repositories. If this placement fits the project, I can follow with the smallest task-shaped src/skills/<name>/SKILL.md contribution and run scripts/lint.sh / built-link validation as required.

HOL Guard: https://github.com/hashgraph-online/hol-guard

I searched current issues, pull requests, and repository code for HOL Guard / hol-guard immediately before filing and found no existing integration. Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this proposal; I checked its scope against the repository's current AGENTS.md contribution instructions and security boundary.