Add HOL Guard third-party security plugin

[kantorcodes]

Problem

HOL Guard supports Cursor as a local AI-agent security harness, but Cursor users cannot currently discover or install Guard guidance through the official plugin marketplace. Setup is therefore disconnected from Cursor's native plugin/skill surface.

Solution

• register hol-guard in the official marketplace under third_party/hol-guard
• add a focused Agent Skill for installing, initializing, verifying, and operating the real hol-guard CLI
• document the explicit Cursor harness setup path and Guard status/doctor/approval/receipt flows
• keep the security boundary accurate: Guard respects Cursor's native tool approval and currently focuses on artifact trust before launch for Cursor
• make clear that hol-guard command test / command explain are inspection-only and are not an enforcement wrapper
• keep Guard Cloud optional for local protection

The plugin does not bundle HOL Guard or silently install system dependencies. It gives Cursor a native marketplace/skill path into the maintained upstream runtime at https://github.com/hashgraph-online/hol-guard.

Verification

• exact HOL Guard / hol-guard issue and PR dedupe in cursor/plugins: no existing result immediately before submission
• plugin and marketplace definitions validated against the repository's current schemas/plugin.schema.json and schemas/marketplace.schema.json
• marketplace name/source uniqueness checked
• SKILL.md uses Cursor's current name + description frontmatter convention
• install, init, status, doctor, approvals, receipts, command-inspection semantics, and Cursor's current approval boundary were cross-checked against the current HOL Guard release/3.0 documentation
• no CLA/DCO or AI-disclosure requirement is declared in the repository; web commit signoff is not required

The repository's Validate plugins pull-request workflow should run node scripts/validate-plugins.mjs against the submitted branch.

---

Note

Low Risk
Additive marketplace metadata and agent guidance only; no executable security enforcement or changes to core Cursor behavior in this repo.

Overview
Adds HOL Guard (third_party/hol-guard) to the official Cursor marketplace and plugin table so users can install Hashgraph Online’s runtime/supply-chain security guidance from Settings or /add-plugin hol-guard.

The new package is manifest + docs only: plugin.json, MIT LICENSE, CHANGELOG, README, and a hol-guard agent skill that walks agents through the real hol-guard CLI (pipx install, init, install cursor, status/doctor, approvals/receipts). The skill and README stress that the plugin does not bundle or silently install Guard, that command test / command explain are inspection-only, and that on Cursor Guard does not replace native tool approval (artifact trust before launch). Guard Cloud stays optional for local use.

Also registers the entry in .cursor-plugin/marketplace.json and trims trailing blank lines at the end of that file.

^{Reviewed by Cursor Bugbot for commit be3abd8. Bugbot is set up for automated code reviews on this repo. Configure here.}