Check Artifact Reputation
Overview
Gather provenance and intelligence without treating popularity, valid signing, a clean lookup, or a vendor label as a safety verdict. Prefer local identity and vendor sources before sending data to third parties.
Read references/reputation-evidence.md for source ordering and interpretation.
Workflow
Fix identity.
- Record artifact hashes, signer/certificate, exact version, source URL, domain, resolved destinations, and acquisition time.
Check local evidence.
- Inspect quarantine/provenance, signature/notarization, known installation records, local security detections, and expected vendor distribution paths.
Check authoritative sources.
- Prefer vendor advisories, release checksums/signatures, certificate status, official repositories, and current platform security sources.
- Date each lookup.
Decide whether external intelligence is appropriate.
- Explain whether the service receives only a hash/domain or may upload/retain the artifact.
- Obtain explicit approval before sending private artifacts, URLs, customer data, or unknown binaries.
Correlate results.
- Record detection names, engines/sources, first/last seen, submission context, prevalence, relations, and conflicting classifications.
- Distinguish “not present” from “known benign.”
Feed behavior analysis.
- Use reputation to prioritize static/dynamic checks, not replace them.
Output
Return identity, sources/date, privacy decision, reputation observations, conflicts, interpretation limits, confidence effect, and next behavioral check.
1---2name: check-artifact-reputation3description: Check reputation for a suspicious artifact, signer, hash, URL, domain, certificate, package, or vendor. Use when threat intelligence informs triage while privacy, stale data, false positives, and behavior limits stay explicit.4---56# Check Artifact Reputation78## Overview910Gather provenance and intelligence without treating popularity, valid signing, a clean lookup, or a vendor label as a safety verdict. Prefer local identity and vendor sources before sending data to third parties.1112Read [references/reputation-evidence.md](references/reputation-evidence.md) for source ordering and interpretation.1314## Workflow15161. Fix identity.17 - Record artifact hashes, signer/certificate, exact version, source URL, domain, resolved destinations, and acquisition time.18192. Check local evidence.20 - Inspect quarantine/provenance, signature/notarization, known installation records, local security detections, and expected vendor distribution paths.21223. Check authoritative sources.23 - Prefer vendor advisories, release checksums/signatures, certificate status, official repositories, and current platform security sources.24 - Date each lookup.25264. Decide whether external intelligence is appropriate.27 - Explain whether the service receives only a hash/domain or may upload/retain the artifact.28 - Obtain explicit approval before sending private artifacts, URLs, customer data, or unknown binaries.29305. Correlate results.31 - Record detection names, engines/sources, first/last seen, submission context, prevalence, relations, and conflicting classifications.32 - Distinguish “not present” from “known benign.”33346. Feed behavior analysis.35 - Use reputation to prioritize static/dynamic checks, not replace them.3637## Output3839Return identity, sources/date, privacy decision, reputation observations, conflicts, interpretation limits, confidence effect, and next behavioral check.
gaelic-ghost