ai_stp

ai_stp runs a staged, non-executing safety suite before a public component can be treated as verified. A passed scan reduces known risk; it is not a guarantee that an artifact is harmless. Required checks block publication when they fail or cannot run. Optional checks produce visible warnings or incomplete coverage. ## Result states - **Passed** — the engine completed without a policy finding. - **Failed** — a blocking finding was detected; the catalog shows the sanitized reason. - **Warning** — a non-blocking finding needs review. - **Not run / degraded** — the engine did not produce a verdict; required coverage remains pending. - **Not applicable / skipped** — the check does not apply and is excluded from the percentage. ## Check inventory | Family | Checks | Method or technology | Risk reduced | | ------------------------- | --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | Integrity and provenance | `structure`, `digest`, `license`, `tags`, `source_repo` | Pydantic schemas, canonical serialization, SHA-256, repository/commit pinning | Tampered or misrepresented artifacts; OWASP A08 Software and Data Integrity Failures | | Safe extraction | `artifact_unpack`, `path_denylist` | Bounded archive extraction, path normalization, deny rules | Zip-slip, traversal, unsafe files; A01 Broken Access Control, A08 | | Secrets | `secrets_heuristic`, `secrets_gitleaks` | Owned pattern/entropy rules and [Gitleaks](https://github.com/gitleaks/gitleaks) | Embedded tokens, passwords and private keys; A02 Cryptographic Failures | | Prompt and hidden content | `pi_content_pack`, `content_hidden` | Owned prompt-injection and invisible-content rules | Prompt injection and covert instructions; OWASP LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure | | Generic SAST | `sast_opengrep` | Owned rules executed with [Opengrep](https://github.com/opengrep/opengrep) | Injection, unsafe subprocess and code patterns; A03 Injection, A04 Insecure Design | | MCP and hooks | `mcp_config_static`, `hook_schema_static`, `hook_command_argv` | Schema validation, URL/transport policy, argv analysis | SSRF, command injection, excessive capability; A03, A10 SSRF, LLM06 Excessive Agency | | Agent skills | `skill_static_gate` | Owned rules plus [NVIDIA SkillSpector](https://github.com/NVIDIA/SkillSpector) and [Cisco Skill Scanner](https://github.com/cisco-ai-defense/skill-scanner) when available | Malicious instructions, exfiltration and undeclared permissions; LLM01, LLM02, LLM06 | | Language SAST | `shell_obfuscation`, `sast_shellcheck`, `sast_bandit`, `sast_gosec`, `sast_eslint_security` | [ShellCheck](https://github.com/koalaman/shellcheck), [Bandit](https://github.com/PyCQA/bandit), [gosec](https://github.com/securego/gosec), [eslint-plugin-security](https://github.com/eslint-community/eslint-plugin-security) | Language-specific injection and insecure coding patterns; A03, A04 | | Dependencies | `sca_osv`, `sca_pip_audit`, `sca_govulncheck`, `sca_cargo_audit`, `sca_cargo_deny`, `sca_npm_audit` | [OSV-Scanner](https://github.com/google/osv-scanner), [pip-audit](https://github.com/pypa/pip-audit), [govulncheck](https://github.com/golang/vuln), [cargo-audit](https://github.com/rustsec/rustsec/tree/main/cargo-audit), [cargo-deny](https://github.com/EmbarkStudios/cargo-deny), native npm audit | Known vulnerable or prohibited dependencies; A06 Vulnerable and Outdated Components, LLM05 Supply Chain Vulnerabilities | | Documents | `document_pdf` | Static PDF action, JavaScript and suspicious-string inspection | Active document content and embedded prompt injection; A03, LLM01 | | Malware | `malware_clamav`, `malware_yara` | [ClamAV](https://github.com/Cisco-Talos/clamav), [YARA](https://github.com/VirusTotal/yara) | Known malware and policy signatures; A08 | | Setups | `setup_pin_aggregate` | Exact component pins and aggregate component evidence | A setup hiding an unsafe or unverified dependency; A06, A08, LLM05 | Checks are selected by component kind, detected languages and files, and the `minimal`, `standard`, or `strict` profile. External CLI engines run only when the platform enables them; an unavailable engine never becomes a pass. ## Why a check failed The expanded catalog view shows a sanitized reason next to every failed, warning, degraded, or not-run check. Sensitive values, secret material and local paths are never exposed. Use the check identifier when reporting an issue to the component author. The normative policy is maintained in `docs/contracts/validation-policy.md`; the catalog page is its reader-oriented projection.