Rule-pack interop: ATR (462 detection rules, MIT) as a supply source for plugin-scanner?

[eeee2345]

Hi @kantorcodes — caught hol-guard / plugin-scanner this week. We're in the same problem space from different ends: you cover harness-level interception and CI gating, I maintain Agent Threat Rules (ATR), an MIT-licensed YAML detection-rule library that ships to MISP via CIRCL Luxembourg (336 rules, PR #1207), Microsoft Agent Governance Toolkit (287 rules with weekly auto-sync, PR #1277), Cisco AI Defense skill-scanner (314 rules, PR #99), and Microsoft PyRIT (PR #1715, merged 2026-05-27 by Roman Lutz).

Wanted to open a peer conversation rather than a PR. plugin-scanner appears to express checks in Python; ATR rules are declarative YAML with regex / pattern / semantic / behavioral / trace method-planes (SPEC v1.1). Two specific things I think would be useful for HOL:

1. plugin-scanner could optionally consume agent-threat-rules (npm agent-threat-rules, PyPI pyatr) as a rule source. Roughly 100 of our 462 rules cover plugin / skill / MCP server supply-chain attacks: rug pull patterns, unicode poisoning, manifest tampering, name spoofing.
2. ATR could publish a HOL-targeted profile (profiles/hol-guard.yaml) selecting the subset relevant to Codex / Claude Code / Hermes plugin scanning.

If interesting, happy to draft a small proof-of-concept on a fork. If not the right shape, no worries.

ATR repo: https://github.com/Agent-Threat-Rule/agent-threat-rules
SPEC: https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/SPEC.md