Proposal: maintained HOL Guard skill for protected local PostHog agent workflows

Proposal

Add a focused HOL Guard skill to PostHog's maintained context-mill distribution for developers who run PostHog setup, audit, or maintenance work through supported local coding-agent harnesses.

This would put HOL Guard itself into the PostHog Wizard/MCP skill distribution rather than adding generic security prose. The skill would install and invoke the real HOL Guard runtime before the local coding agent performs state-changing command/tool work, while keeping PostHog-native auth, project targeting, previews, validation, and human review authoritative.

Suggested scope:

• ship initially as a discoverable role: skill, not a new top-level Wizard command;
• install HOL Guard locally and use hol-guard detect --json to identify a supported coding-agent harness;
• use the Guard-owned install, run, and doctor flow for that detected harness;
• treat deny, review-required, timeout, malformed, unavailable, or error states as stop conditions instead of falling back to an unprotected agent session;
• preserve PostHog's own Wizard/MCP safeguards and make the boundary explicit: HOL Guard protects supported local coding-agent execution, not PostHog's hosted services or MCP server internals;
• keep plugin-scanner scoped to Agent Skills/plugins/MCP packages before trust, not PostHog application vulnerability scanning.

context-mill is the direct distribution surface: its README explicitly invites new skills, builds them into versioned dist/skills artifacts, and the PostHog Wizard/MCP consumers fetch those maintained releases. If maintainers agree on placement, I can follow with the smallest context/skills/<name> contribution and run the documented npm test && npm run build checks.

HOL Guard: https://github.com/hashgraph-online/hol-guard
Maintained HOL Guard Agent Skill reference: https://github.com/hashgraph-online/hol-guard-plugin/tree/main/skills/hol-guard

I searched current issues, PRs, and repository code for HOL Guard / hol-guard immediately before filing and found no existing route.

Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this proposal; I checked the scope against the current README and CONTRIBUTING.md.

Read README and CONTRIBUTING.md first, then inspect the context/skills/ structure and the documented skill build flow. Confirm the maintainers' placement decision before adding a discoverable skill, and consider the work done when npm test && npm run build passes for the versioned distribution artifacts.