Proposal
Add a focused remotion-hol-guard Agent Skill to Remotion's maintained skills distribution for developers who run Remotion CLI work through a supported local coding-agent harness.
This would be a direct HOL Guard integration, not generic security prose. The maintained skill would install and invoke the real HOL Guard runtime before command-bearing agent work, for example:
pipx install hol-guard
hol-guard detect --json
hol-guard install <detected-harness>
hol-guard run <detected-harness> --dry-run
hol-guard run <detected-harness>
hol-guard doctor <detected-harness> --json
Suggested scope:
- protect the supported local coding-agent harness before Remotion CLI workflows such as render/still/studio operations;
- treat Guard deny, review-required, error, timeout, or unavailable states as stop conditions rather than falling back to an unprotected agent session;
- preserve Remotion's own rendering/deployment practices and avoid claiming that HOL Guard runs inside Remotion's hosted/Lambda infrastructure;
- optionally document the separate
plugin-scanner CLI for inspecting Agent Skills/plugins/MCP packages before trust.
The repository already distributes its maintained skills via npx skills add remotion-dev/skills and offers them from bun create video, so acceptance would give users an official recurring install/use path rather than a vendor-side link.
I searched current issues and PRs for HOL Guard / hol-guard immediately before filing and found no existing contribution. I also noticed this standalone repository's README is generated from the Remotion monorepo, so I am opening the issue first rather than guessing the canonical source file/PR landing path. If maintainers confirm placement, I can submit the smallest repository-conformant implementation.
HOL Guard: https://github.com/hashgraph-online/hol-guard
Maintained skill source: https://github.com/hashgraph-online/hol-guard-plugin/tree/main/skills/hol-guard
Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this focused proposal.
Proposal
Add a focused
remotion-hol-guardAgent Skill to Remotion's maintained skills distribution for developers who run Remotion CLI work through a supported local coding-agent harness.This would be a direct HOL Guard integration, not generic security prose. The maintained skill would install and invoke the real HOL Guard runtime before command-bearing agent work, for example:
Suggested scope:
plugin-scannerCLI for inspecting Agent Skills/plugins/MCP packages before trust.The repository already distributes its maintained skills via
npx skills add remotion-dev/skillsand offers them frombun create video, so acceptance would give users an official recurring install/use path rather than a vendor-side link.I searched current issues and PRs for
HOL Guard/hol-guardimmediately before filing and found no existing contribution. I also noticed this standalone repository's README is generated from the Remotion monorepo, so I am opening the issue first rather than guessing the canonical source file/PR landing path. If maintainers confirm placement, I can submit the smallest repository-conformant implementation.HOL Guard: https://github.com/hashgraph-online/hol-guard
Maintained skill source: https://github.com/hashgraph-online/hol-guard-plugin/tree/main/skills/hol-guard
Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this focused proposal.