Menu
Build Stave from source and verify the binary and control catalog work, adapting to what is already installed
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Author, test, and verify a custom Stave control using the forge toolchain
Run Stave against a tiny example observation and read your first findings — no AWS account required
Deploy a known-vulnerable Bishop Fox IAM lab, evaluate it with Stave, and confirm findings match the documented attack paths — trust via an independent oracle
Export Stave observation facts to JSONL/SMT-LIB and derive compound cross-asset chains with Z3, Soufflé, or Prolog — detection CEL alone cannot express
Capture a read-only configuration snapshot of your real AWS account and evaluate it with Stave on a local, deterministic snapshot
Verify cloud infrastructure security using the Stave platform with machine-verifiable contracts at every step
Based on SOC occupation classification
| name | stave-setup |
| description | Build Stave from source and verify the binary and control catalog work, adapting to what is already installed |
| triggers | ["first time touching Stave","install Stave","build Stave","set up Stave","get started with Stave"] |
| requires | ["go (>= 1.26 — see https://go.dev/dl/)","git",{"jq (apt":"sudo apt install jq)"}] |
Installs prerequisites, builds Stave from source, and verifies the binary + control catalog. Adapts to what is already installed — skip steps whose check already passes.
Time: ~5 minutes. No AWS account needed.
go version
wget https://go.dev/dl/go1.26.5.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.26.5.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
go version # → go1.26.x
jq --version || sudo apt install -y jq
git clone https://github.com/sufield/stave
cd stave
make build
Use make build, NOT bare go build — make build runs sync-schemas /
sync-controls first, which a fresh clone needs. If the build fails, report the
make output verbatim (usually a Go-version mismatch).
./stave version
Expect a version line (e.g. edge (production)). Both ./stave version and
./stave --version work.
./stave controls list -i controls | wc -l
Expect 2,600+ controls. If 0, the controls/ directory didn't clone — re-check step 3.
./stave search "privilege escalation"
Expect multiple results with control IDs and descriptions.
A working stave binary with 2,600+ controls, search functioning.
Next: first-evaluation.