What Vettd does not check

Known limits and gaps

• Vettd analyzes the submitted artifact and public repository data. It does not run the asset or observe how it behaves at runtime. Model-driven assessment of behavior is not active yet.
• Only skills carry a published per-type checklist on this site today. Prompts, MCP servers, agents, and agentic apps are named as asset types but do not yet have their own published checklist here.
• Compatibility reports what an asset declares it needs. It does not yet detect conflicts between an asset and a particular environment.
• Signals are not refreshed on a schedule. A record reflects its last scan or import, and nothing more current.
• Framework labels are reference context, not automated end-to-end compliance certifications.
• A scan with no findings is inconclusive, not a pass.