guard git:20260526.a13faa9C

Immutable. This exact content is served forever at /api/v1/blob/b8abc885294765ea.

# HOL Guard Skill Guidance

Use this guidance when an AI agent is about to add or update dependencies.

## Before package installs

1. Preview the install decision:
   - `hol-guard protect --dry-run -- npm install <package>`
2. Check current workspace risk posture:
   - `hol-guard supply-chain scan --json`
3. Explain a specific package verdict:
   - `hol-guard supply-chain explain <package>@<version> --ecosystem <ecosystem>`

## During CI and automation

- Route dependency installs through Guard:
  - `hol-guard protect -- npm ci`
- Use workspace audits before release:
  - `hol-guard supply-chain audit --json`

## If Guard blocks a package

- Review the blocking reason and suggested fix version.
- Prefer upgrading to a safe version.
- If it is a verified false positive, use a scoped and expiring exception with recorded reason.