Registry › Compare › HOL Guard vs SkillSpector

HOL Guard vs SkillSpector

HOL Guard leads on trust: 91.3/100 (Grade A) against 63.4/100 (Grade C), a 27.9-point gap. HOL Guard leads on supply-chain integrity and provenance, and rests on broader evidence.

A HOL Guard 91.3

Open-source antivirus and firewall for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

hashgraph-online/hol-guard · #18 overall · #2 Security & Guardrails · coverage B (3/5)

Choose HOL Guard if supply-chain integrity and provenance matter most.

+13.1Safety / Integrity: 100% of recent commits signed, against 66%
+7.2Identity / Provenance: package provenance attested, against none
+2.7Transparency: OSSF Scorecard 8.8 against 5.7
+1.8Adoption

C SkillSpector 63.4

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

NVIDIA/SkillSpector · #596 overall · #9 Security & Guardrails · coverage C (2/5)

SkillSpector doesn't lead on any scored dimension in this pair.

Where they differ

23.5

Safety / IntegrityHOL Guard +13.1

10.4

18.0

Identity / ProvenanceHOL Guard +7.2

10.8

16.0

TransparencyHOL Guard +2.7

13.3

20.0

MaintenanceHOL Guard +0.1

19.9

12.4

AdoptionHOL Guard +1.8

10.6

+1.4

Runtime calibrationHOL Guard +3.0

-1.6

Full evidence table

An independent, evidence-based trust comparison of HOL Guard and SkillSpector, two Security & Guardrails projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	HOL Guardhashgraph-online/hol-guard	SkillSpectorNVIDIA/SkillSpector
HVTrust score	91.3	63.4
Evidence grade	A	C
Coverage grade	B	C
Overall rank	#18	#596
Rank in Security & Guardrails	#2	#9
GitHub stars	1.1k	26.1k
Last updated	today	1d ago
Build provenance	Yes	No
OSSF Scorecard	8.8 / 10	5.7 / 10
License	Apache-2.0	Apache-2.0
Downloads	7k/wk	—
Trust dimensions (points earned)
Safety / integrity / 25	23.5	10.4
Identity & provenance / 18	18.0	10.8
Transparency / 17	16.0	13.3
Maintenance / 20	20.0	19.9
Adoption / 20	12.4	10.6
Runtime capability surface (full matrix)
MCP server	Implemented	Implemented
External providers	3 — Anthropic, Google Gemini, Multi-provider (LiteLLM)	5 — Amazon Bedrock, Anthropic, Azure OpenAI, …
Requires API keys	No	Yes
Plugin surface	extensions	extensions
Provenance drift	Match	—

Open in the live compare tool → HOL Guard profile SkillSpector profile More Security & Guardrails →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →