Security checks
What ai_stp checks, which engines it uses, and which risks each check reduces.
ai_stp runs a staged, non-executing safety suite before a public component can be treated as verified. A passed scan reduces known risk; it is not a guarantee that an artifact is harmless. Required checks block publication when they fail or cannot run. Optional checks produce visible warnings or incomplete coverage.
Result states
- Passed — the engine completed without a policy finding.
- Failed — a blocking finding was detected; the catalog shows the sanitized reason.
- Warning — a non-blocking finding needs review.
- Not run / degraded — the engine did not produce a verdict; required coverage remains pending.
- Not applicable / skipped — the check does not apply and is excluded from the percentage.
Check inventory
| Family | Checks | Method or technology | Risk reduced |
|---|---|---|---|
| Integrity and provenance | structure, digest, license, tags, source_repo | Pydantic schemas, canonical serialization, SHA-256, repository/commit pinning | Tampered or misrepresented artifacts; OWASP A08 Software and Data Integrity Failures |
| Safe extraction | artifact_unpack, path_denylist | Bounded archive extraction, path normalization, deny rules | Zip-slip, traversal, unsafe files; A01 Broken Access Control, A08 |
| Secrets | secrets_heuristic, secrets_gitleaks | Owned pattern/entropy rules and Gitleaks | Embedded tokens, passwords and private keys; A02 Cryptographic Failures |
| Prompt and hidden content | pi_content_pack, content_hidden | Owned prompt-injection and invisible-content rules | Prompt injection and covert instructions; OWASP LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure |
| Generic SAST | sast_opengrep | Owned rules executed with Opengrep | Injection, unsafe subprocess and code patterns; A03 Injection, A04 Insecure Design |
| MCP and hooks | mcp_config_static, hook_schema_static, hook_command_argv | Schema validation, URL/transport policy, argv analysis | SSRF, command injection, excessive capability; A03, A10 SSRF, LLM06 Excessive Agency |
| Agent skills | skill_static_gate | Owned rules plus NVIDIA SkillSpector and Cisco Skill Scanner when available | Malicious instructions, exfiltration and undeclared permissions; LLM01, LLM02, LLM06 |
| Language SAST | shell_obfuscation, sast_shellcheck, sast_bandit, sast_gosec, sast_eslint_security | ShellCheck, Bandit, gosec, eslint-plugin-security | Language-specific injection and insecure coding patterns; A03, A04 |
| Dependencies | sca_osv, sca_pip_audit, sca_govulncheck, sca_cargo_audit, sca_cargo_deny, sca_npm_audit | OSV-Scanner, pip-audit, govulncheck, cargo-audit, cargo-deny, native npm audit | Known vulnerable or prohibited dependencies; A06 Vulnerable and Outdated Components, LLM05 Supply Chain Vulnerabilities |
| Documents | document_pdf | Static PDF action, JavaScript and suspicious-string inspection | Active document content and embedded prompt injection; A03, LLM01 |
| Malware | malware_clamav, malware_yara | ClamAV, YARA | Known malware and policy signatures; A08 |
| Setups | setup_pin_aggregate | Exact component pins and aggregate component evidence | A setup hiding an unsafe or unverified dependency; A06, A08, LLM05 |
Checks are selected by component kind, detected languages and files, and the minimal, standard, or strict profile. External CLI engines run only when the platform enables them; an unavailable engine never becomes a pass.
Why a check failed
The expanded catalog view shows a sanitized reason next to every failed, warning, degraded, or not-run check. Sensitive values, secret material and local paths are never exposed. Use the check identifier when reporting an issue to the component author.
The normative policy is maintained in docs/contracts/validation-policy.md; the catalog page is its reader-oriented projection.