Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Feature: optional HOL Guard SecurityScanner backend for skill publish scans

Open
  • Is something wrong?
#727 4 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
java
Domain
backend, security

Research direction

Start by reading the existing SecurityScanner contract, SkillScannerAdapter, and scanner documentation to understand how requests, health checks, and findings are represented. Then check how publish scans receive an unpacked package path and how scanner configuration is handled. Done means a local HOL Guard adapter maps findings and reports unavailable service errors explicitly, with benign and malicious fixtures plus adapter health and error tests.

Written by the indexing model from the issue text.

Description

effort/m priority/p0 risk/high triage/needs-info

Proposal

Add an optional HOL Guard-backed implementation of SkillHub's existing SecurityScanner interface for pre-trust skill/package scanning.

HOL Guard: https://github.com/hashgraph-online/hol-guard
Distribution/Agent Skill repo: https://github.com/hashgraph-online/hol-guard-plugin

Why this fits the current architecture

SkillHub already has the provider-neutral domain contract:

  • SecurityScanner.scan(SecurityScanRequest)
  • isHealthy()
  • getScannerType()

and currently maps the built-in scanner through SkillScannerAdapter. The published scanner docs also describe multiple analysis engines and a configurable scanner service URL.

A narrow integration could preserve that contract and add a HolGuardSecurityScannerAdapter that invokes HOL Guard locally against the unpacked skill/package path, then maps structured findings/severity into SkillHub's existing SecurityScanResponse / SecurityFinding model.

Intended boundary

  • local scanning; Guard Cloud not required
  • do not execute target install/lifecycle scripts merely to scan them
  • preserve SkillHub's existing review/publish semantics
  • fail explicitly if the configured scanner is unavailable rather than treating that as a clean result
  • map prompt-injection, unsafe-command, secret/exfiltration, plugin/MCP, and supply-chain findings into the existing response model
  • add malicious and benign SKILL.md/plugin fixtures plus adapter health/error tests

This would be an additional backend, not a request to replace SkillHub's built-in scanner or its existing engines.

If this direction fits the project, we can contribute the smallest adapter/config/docs/tests PR against the existing SecurityScanner abstraction.

Dominant language
Java
Stars
5.2k
Forks
841
Avg merge
1d 4h
Merged PRs (30d)
77

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from iflytek/skillhub

All issues in iflytek/skillhub

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.