@blamejs/exceptd-skills 0.12.10 → 0.12.11

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.12.11 — 2026-05-13
+
+**Patch: OSV source hardening, indicator regex widening, CWE/framework-gap reconciliation. v0.12.10 audit closeout.**
+
+### OSV source hardening
+
+`lib/source-osv.js` matures from greenfield to GHSA-parity:
+
+- **Structured fixture-I/O error envelope.** Missing or malformed `EXCEPTD_OSV_FIXTURE` paths no longer crash with a Node stack trace; the source returns `{ok:false, error, source:"offline"}` matching the GHSA convention. Operators piping the CLI through `jq` or scripting around exit codes get a structured failure they can branch on.
+- **Case-fold ids before lookup.** `fetchAdvisoryById("mal-2026-3083")` (lowercase) now resolves correctly. OSV.dev's `/v1/vulns/{id}` is case-sensitive — the source uppercases the id at entry before any branch on fixture lookup or network call.
+- **Highest-CVSS-version wins + compute from vector.** `extractCvss` previously overwrote the chosen vector on every loop iteration ("last wins" not "highest-version wins") and returned `null` `score` when the OSV record carried only a vector string with no embedded numeric tail. Both fixed: explicit version-comparison via the `CVSS:N.M` prefix, and a new `cvss3BaseScore(vector)` helper that computes the CVSS 3.1 base score per FIRST §7.1 (handles Scope:U + Scope:C). MAL-* records that previously normalized to `cvss_score: null` / `active_exploitation: "unknown"` now carry computed scores.
+- **GHSA-404 → OSV fallback for CVE-*.** `seedSingleAdvisory` previously routed `CVE-*` unconditionally through `source-ghsa`. When GHSA returned 404 for a CVE that had only PYSEC / RUSTSEC / SNYK / MAL coverage, the operator saw `GHSA returned HTTP 404` even though OSV had the record. Now: on GHSA-404 for a CVE-* id, retry via `source-osv.fetchAdvisoryById(id)`; surface the combined error when both 404.
+- **`epss_note` on non-CVE drafts.** Non-CVE catalog keys (MAL-*, SNYK-*, RUSTSEC-*, etc.) now carry a populated `epss_note` documenting the FIRST EPSS API limitation — drafts no longer look incomplete to downstream consumers grepping for the field.
+- **`verification_sources` deduped.** The canonical `osv.dev/vulnerability/<id>` URL was previously both prepended unconditionally AND pulled from `rec.references[]`. Deduped via `new Set` before return.
+- **`buildDiff` error categorization.** Returns `unreachable_count` + `normalize_error_count` separately so an operator can distinguish "OSV unreachable" from "10 ids returned but none normalized cleanly."
+- **`GHSA-` dropped from `OSV_ID_PREFIXES`.** The export previously listed GHSA-* even though the dispatcher unconditionally routes GHSA-* through `source-ghsa`. `isOsvId("GHSA-...")` now returns false. A top-of-file comment documents the routing decision (GHSA has richer field coverage for that namespace).
+- **`OSV_HOST_OVERRIDE` env var for offline HTTP testing.** New stubbing surface — lets `tests/source-osv.test.js` spin up a local HTTP server to exercise HTTP 500 / 429 / timeout / parse-error paths previously uncovered. 429 surfaces as `rate-limited`; timeout error message clarified.
+- **`seedSingleAdvisory` exported** for in-process testing.
+
+### Indicator regex widening
+
+`gha-workflow-script-injection-sink` (added v0.12.10) previously anchored on `run:\s*\|` (block-scalar pipe only). Single-line `run: echo "${{ github.event.comment.body }}"` bypassed the regex despite being the same vulnerability class. Widened to `run:[\s\S]*?...` which admits both block-scalar AND single-line forms. The indicator's `confidence` drops from `deterministic` → `high` and `deterministic` flag flips to `false` to reflect the reasoning step still required for the false-positive demotion (sandboxed `pull_request` + `contents: read` permissions). `tests/gha-workflow-script-injection-sink.test.js` lands as a new end-to-end regex test with 8 fixture YAML cases covering both the catch and the FP-demotion classes. All 5 of this repo's own `.github/workflows/*.yml` files remain clean against the widened regex.
+
+### CWE reverse-references
+
+The v0.12.10 catalog additions cited existing CWEs (CWE-89, CWE-77, CWE-94) without updating their reverse-reference `evidence_cves` arrays. Bidirectional linkage restored: CWE-89 now lists CVE-2026-42208 (LiteLLM SQLi), CWE-77 lists MAL-2026-3083 (elementary-data secondary classification), CWE-94 adds MAL-2026-3083 alongside the existing CVE-2025-53773 and CVE-2026-30615.
+
+### Framework-control-gaps key reconciliation
+
+Eight `framework_control_gaps` keys used by the v0.12.10 catalog additions did not resolve in `data/framework-control-gaps.json`. Six reconciled to canonical existing forms: `SLSA-L3` → `SLSA-v1.0-Build-L3`; `OWASP-LLM01` → `OWASP-LLM-Top-10-2025-LLM01`; `NIST-800-218-PO.4` → `NIST-800-218-SSDF`; `NIS2-Art21-2d` / `-2g` → `NIS2-Art21-patch-management`; `NIS2-Art21-2e` → `NIS2-Art21-incident-handling`. Two genuinely-distinct citations gained new entries in the framework-gaps catalog: `EU-CRA-Art13` (essential cybersecurity requirements + technical documentation; the elementary-data class of supply-chain compromise where the maintainer is a victim) and `NIST-800-53-SI-10` (information input validation; the trust-boundary-vs-inside-boundary distinction that argument-injection / SQL-injection / prompt-injection exploit). All `framework_control_gaps` references in the catalog now resolve to a real entry.
+
+### Repository
+
+- `lib/source-ghsa.js` "unrecognized id format" error message widened to enumerate the OSV-native prefixes operators can pass via `--advisory` (was previously CVE/GHSA only).
+- `README.md` documents the OSV source: install command, `--advisory MAL-...` form, `EXCEPTD_OSV_FIXTURE` env var, the fresh-disclosure workflow expanded to mention OSV's coverage breadth.
+
+Test count: 462 → 492 (+30: 18 OSV source-hardening tests + 10 indicator regex tests + 2 catalog drift assertions). Predeploy gates: 15/15. Skills: 38/38 signed and verified.
+
 ## 0.12.10 — 2026-05-13
 
 **Patch: OSV.dev wired as an upstream source, three new catalog entries, one new library-author indicator.**

package/README.md

@@ -135,6 +135,7 @@ You want to refresh CVE/RFC data, run currency checks, or generate reports. Inst
 npx @blamejs/exceptd-skills doctor                                # health check
 npx @blamejs/exceptd-skills refresh --apply --swarm               # pull KEV/NVD/EPSS/RFC/GHSA + apply
 npx @blamejs/exceptd-skills refresh --advisory CVE-2026-45321     # seed one CVE draft from GHSA
+npx @blamejs/exceptd-skills refresh --advisory MAL-2026-3083      # seed via OSV (MAL-/SNYK-/RUSTSEC-/USN-/PYSEC-/GO-/MGASA-/UVI-)
 npx @blamejs/exceptd-skills refresh --curate CVE-2026-45321       # surface editorial questions for a draft
 npx @blamejs/exceptd-skills refresh --network                     # swap data/ from latest signed npm tarball
 ```
@@ -148,7 +149,7 @@ exceptd help
 
 Air-gapped operation: run `exceptd refresh --prefetch` on a connected host, copy the resulting `.cache/upstream/` to the airgap, run `exceptd refresh --from-cache <path> --apply` over there. The vendored upstream snapshots replace every network call.
 
-Fresh-disclosure workflow (v0.12.0): the nightly auto-PR job pulls KEV / NVD / EPSS / IETF / **GHSA** (added in v0.12.0). KEV typically takes days; NVD ~10 days; GHSA fires within hours of disclosure and covers npm + PyPI + Maven + Go + NuGet + …. New CVE IDs land as drafts (`_auto_imported: true`, `_draft: true`) that the catalog validator treats as warnings, not errors — operators get the fresh entry immediately, editorial review (framework gaps, IoCs, ATLAS/ATT&CK refs) follows via `exceptd refresh --curate <CVE-ID>`. For "I want this CVE today, not tomorrow": `exceptd refresh --advisory <CVE-or-GHSA-ID> --apply`.
+Fresh-disclosure workflow (v0.12.0): the nightly auto-PR job pulls KEV / NVD / EPSS / IETF / **GHSA** (added in v0.12.0) / **OSV** (added in v0.12.10). KEV typically takes days; NVD ~10 days; GHSA fires within hours of disclosure and covers npm + PyPI + Maven + Go + NuGet + …; OSV aggregates the OSSF Malicious Packages dataset (`MAL-*` keys) + Snyk + RustSec + Mageia + Ubuntu USN + Go Vuln DB + PYSEC + UVI on top of GHSA — useful for malicious-package compromises that don't have CVEs yet (`exceptd refresh --advisory MAL-2026-3083`). New IDs land as drafts (`_auto_imported: true`, `_draft: true`) that the catalog validator treats as warnings, not errors — operators get the fresh entry immediately, editorial review (framework gaps, IoCs, ATLAS/ATT&CK refs) follows via `exceptd refresh --curate <ID>`. For "I want this advisory today, not tomorrow": `exceptd refresh --advisory <CVE-or-GHSA-or-MAL-or-SNYK-or-RUSTSEC-ID> --apply`.
 
 Optional env vars for higher rate budgets:
 
@@ -157,6 +158,7 @@ Optional env vars for higher rate budgets:
 | `NVD_API_KEY` | Lifts NVD 2.0 from 5 → 50 requests per 30s window. Free key at <https://nvd.nist.gov/developers/request-an-api-key>. |
 | `GITHUB_TOKEN` | Lifts GitHub Releases + GHSA from 60 → 5000 requests per hour. |
 | `EXCEPTD_GHSA_FIXTURE` | Path to a JSON fixture matching the api.github.com/advisories shape. For offline tests + air-gap workflows. |
+| `EXCEPTD_OSV_FIXTURE` | Path to a JSON fixture matching the OSV schema (https://ossf.github.io/osv-schema/). For offline tests + air-gap workflows against the OSV source (added v0.12.10). |
 | `EXCEPTD_REGISTRY_FIXTURE` | Path to a JSON fixture matching the npm registry response. Used by `doctor --registry-check` + `run --upstream-check` + `refresh --network` for offline testing. |
 
 ### 3. Maintainer (extend / sign / publish)

package/data/_indexes/_meta.json

@@ -1,17 +1,17 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-13T17:30:56.669Z",
+  "generated_at": "2026-05-13T21:19:48.889Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 49,
   "source_hashes": {
-    "manifest.json": "b7501793892cdfd22ede52a21ec60629d000a5a562373948dd33c1b840776189",
+    "manifest.json": "b7e77cd5de579732b6dd352720557c3ba2ac93f472de50f4e1f861a665a2760b",
     "data/atlas-ttps.json": "f3f75ff2778a0a2c7d953a21386bc4f265cb2685ce41242eee45f9e9f2a6add6",
-    "data/cve-catalog.json": "e4ee5a94bfab0109c2dbd9531a1cd3ad96ce37ad4ec36523d699beace5b6d5d4",
-    "data/cwe-catalog.json": "9d71498894a74a235d2c9dae97d062499529cb031184a4011172bf6dce9f3c3d",
+    "data/cve-catalog.json": "197f5313d93f0a7225d5ff275e21cbd067b3970a6f2fdc6da35f81c847e8bdee",
+    "data/cwe-catalog.json": "19ce1fad3ed0b0687ec9a328b2d6cd1b544eea7f19140234ec1a8467de1f908d",
     "data/d3fend-catalog.json": "d219520c8d3eb61a270b25ea60f64721035e98a8d5d51d1a4e1f1140d9a586f9",
     "data/dlp-controls.json": "8ea8d907aea0a2cfd772b048a62122a322ba3284a5c36a272ad5e9d392564cb5",
     "data/exploit-availability.json": "7dad52f459c324c40aa4df7cd9157f6a19f670fdfb9d8f687d777c9d99798668",
-    "data/framework-control-gaps.json": "8804a10bf77e987453ea76ae717153118dc5cc625f42e98f78213b08fa144f73",
+    "data/framework-control-gaps.json": "9240ea4a825090fe2716947f2f6f9171c065a133ef003e04d2fbc4f01fc55bdf",
     "data/global-frameworks.json": "84fd19061f052e4ccf66308a7b8d3fd38e00325e97e9e5e19e4d9b302c128957",
     "data/rfc-references.json": "583360bae01e324d752bd28a7d344b4276478381426428d683fc82b0ac19d64a",
     "data/zeroday-lessons.json": "d670e73dfd5237ceb71a56326676d90c05387b9547f8ed6f3a60a153854b444b",

package/data/_indexes/activity-feed.json

@@ -349,7 +349,7 @@
       "artifact": "data/framework-control-gaps.json",
       "path": "data/framework-control-gaps.json",
       "schema_version": "1.0.0",
-      "entry_count": 59
+      "entry_count": 61
     },
     {
       "date": "2026-05-01",

package/data/_indexes/catalog-summaries.json

@@ -150,7 +150,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 59,
+      "entry_count": 61,
       "sample_keys": [
         "NIST-800-53-SI-2",
         "NIST-800-53-SC-8",

package/data/_indexes/frequency.json

@@ -2084,7 +2084,9 @@
       "AU-Essential-8-MFA",
       "AU-Essential-8-Patch",
       "EU-AI-Act-Art-15",
+      "EU-CRA-Art13",
       "NIS2-Art21-incident-handling",
+      "NIST-800-53-SI-10",
       "UK-CAF-A1",
       "UK-CAF-B2",
       "UK-CAF-C1",

package/data/cve-catalog.json

@@ -708,11 +708,11 @@
       "Set npm registry cooldown: .npmrc `before=72h` (npm 11+) or `minimumReleaseAge=4320` to refuse any fresh-publish under 72 hours"
     ],
     "framework_control_gaps": {
-      "SLSA-L3": "FIRST documented npm package shipping valid SLSA provenance while being malicious — provenance only proves WHICH pipeline built the artifact, not that the pipeline BEHAVED AS INTENDED. SLSA L3 build integrity is necessary but insufficient against cache-poisoning attacks within the build.",
+      "SLSA-v1.0-Build-L3": "FIRST documented npm package shipping valid SLSA provenance while being malicious — provenance only proves WHICH pipeline built the artifact, not that the pipeline BEHAVED AS INTENDED. SLSA L3 build integrity is necessary but insufficient against cache-poisoning attacks within the build.",
       "NIST-800-53-SA-12": "Supply chain protection treats provenance + signing as the trust anchor. CVE-2026-45321 demonstrates both can be intact on a malicious package.",
       "NIST-800-218-SSDF": "PS.3 + PO.3 don't address cache poisoning between sibling workflows in the same repo. SSDF presumes per-workflow trust isolation that GitHub Actions' shared actions/cache breaks.",
       "EU-CRA-Art13": "Required vulnerability handling doesn't cover the case where the upstream maintainer is unwitting — the maintainer was a victim, not a participant.",
-      "NIS2-Art21-2d": "Supply chain risk management presumes detectable signal at consumption. Valid provenance neutralizes the standard consumer-side check.",
+      "NIS2-Art21-patch-management": "Supply chain risk management presumes detectable signal at consumption. Valid provenance neutralizes the standard consumer-side check.",
       "DORA-Art28": "ICT third-party risk doesn't cover transitive cache poisoning in upstream CI/CD."
     },
     "atlas_refs": [
@@ -875,11 +875,11 @@
       "GHCR :latest re-points to clean image; rebuild any image FROM elementary-data:0.23.3"
     ],
     "framework_control_gaps": {
-      "SLSA-L3": "Same shape as CVE-2026-45321 — provenance valid, payload malicious. The publishing pipeline ran on a malicious orphan commit and emitted a legitimate signed release. SLSA-L3 attests WHICH pipeline built the artifact, not that the pipeline was driven by trusted inputs.",
+      "SLSA-v1.0-Build-L3": "Same shape as CVE-2026-45321 — provenance valid, payload malicious. The publishing pipeline ran on a malicious orphan commit and emitted a legitimate signed release. SLSA-L3 attests WHICH pipeline built the artifact, not that the pipeline was driven by trusted inputs.",
       "NIST-800-53-SA-12": "Supply chain protection treats signed release as the trust anchor. The signature was valid; the input to the signing pipeline was attacker-controlled.",
-      "NIST-800-218-PO.4": "Define and use secure development security checks. Direct interpolation of github.event.* into run: scripts is a documented secure-development anti-pattern (GitHub Actions docs explicitly warn against it) but is not framework-enforced.",
+      "NIST-800-218-SSDF": "Define and use secure development security checks. Direct interpolation of github.event.* into run: scripts is a documented secure-development anti-pattern (GitHub Actions docs explicitly warn against it) but is not framework-enforced.",
       "EU-CRA-Art13": "Required vulnerability handling doesn't address the case where the maintainer was an unwitting publisher.",
-      "NIS2-Art21-2d": "Supply chain risk management presumes detectable signal at consumption. Valid signature neutralizes consumer-side checks."
+      "NIS2-Art21-patch-management": "Supply chain risk management presumes detectable signal at consumption. Valid signature neutralizes consumer-side checks."
     },
     "atlas_refs": [
       "AML.T0010",
@@ -1026,8 +1026,8 @@
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-10": "Input validation control doesn't address argument-vs-statement distinction in SQL libraries. SI-10 is satisfied by 'we validate inputs' regardless of whether the validation runs before the SQL parameter binding.",
-      "OWASP-LLM01": "Prompt injection control set doesn't address the AI-PROXY backend SQL surface — LiteLLM is the substrate that gates LLM API access, not the LLM itself.",
-      "NIS2-Art21-2e": "Cryptographic measures control doesn't address application-layer SQL injection.",
+      "OWASP-LLM-Top-10-2025-LLM01": "Prompt injection control set doesn't address the AI-PROXY backend SQL surface — LiteLLM is the substrate that gates LLM API access, not the LLM itself.",
+      "NIS2-Art21-incident-handling": "Cryptographic measures control doesn't address application-layer SQL injection.",
       "EU-AI-Act-Art-15": "Robustness + cybersecurity requirement is undefined operationally for AI gateway infrastructure."
     },
     "atlas_refs": [
@@ -1126,8 +1126,8 @@
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-10": "Input validation control doesn't address the argv-vs-string boundary that argument injection exploits — many MCP servers concatenate user input into shell commands without registering this as a code-review failure.",
-      "OWASP-LLM01": "Prompt-injection-as-access-control gap — the attacker doesn't compromise the MCP server directly; they feed adversarial input that the AI passes through.",
-      "NIS2-Art21-2g": "Patch management presumes traditional CVE timelines; MCP plugin ecosystem patch awareness lags."
+      "OWASP-LLM-Top-10-2025-LLM01": "Prompt-injection-as-access-control gap — the attacker doesn't compromise the MCP server directly; they feed adversarial input that the AI passes through.",
+      "NIS2-Art21-patch-management": "Patch management presumes traditional CVE timelines; MCP plugin ecosystem patch awareness lags."
     },
     "atlas_refs": [
       "AML.T0053",

package/data/cwe-catalog.json

@@ -115,7 +115,7 @@
     "skills_referencing": [
       "exploit-scoring"
     ],
-    "evidence_cves": [],
+    "evidence_cves": ["CVE-2026-42208"],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
       "ISO-27001-2022-A.8.28",
@@ -247,7 +247,8 @@
     ],
     "evidence_cves": [
       "CVE-2025-53773",
-      "CVE-2026-30615"
+      "CVE-2026-30615",
+      "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -392,7 +393,7 @@
       "mcp-agent-trust",
       "ai-attack-surface"
     ],
-    "evidence_cves": [],
+    "evidence_cves": ["MAL-2026-3083"],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
       "ISO-27001-2022-A.8.28"

package/data/framework-control-gaps.json

@@ -1494,5 +1494,57 @@
       "AML.T0048"
     ],
     "attack_refs": []
+  },
+  "EU-CRA-Art13": {
+    "framework": "EU Cyber Resilience Act (2024/2847)",
+    "control_id": "Art. 13",
+    "control_name": "Essential cybersecurity requirements + technical documentation",
+    "designed_for": "Manufacturers placing products with digital elements on the EU market; sets the essential cybersecurity requirements (Annex I) and the technical-documentation duty",
+    "misses": [
+      "Vulnerability handling clauses presume the maintainer is aware of the vulnerability and able to remediate. The elementary-data PyPI worm (MAL-2026-3083) compromised the publishing pipeline — the maintainer was a victim, not a participant — and the published release carried a valid signature.",
+      "'Technical documentation' obligations do not require the manufacturer to retain or publish the build-pipeline configuration that produced each release. Operators consuming a malicious release have no way to inspect the workflow that built it.",
+      "Art. 14 (24-hour notification of actively-exploited vulnerabilities) clock starts from manufacturer awareness; supply-chain-victim manufacturers may not know they are exploited until consumer-side detection (StepSecurity / Snyk / OSV) surfaces the IoCs."
+    ],
+    "real_requirement": "Manufacturer publishes the canonical build-pipeline definition alongside each release (workflow file hash, runner attestation, scope of secrets accessed). Operators verify the published pipeline matches the pipeline that produced the release-being-installed. Notification clock starts from FIRST awareness — manufacturer's OR competent-authority's OR widely-published security researcher's.",
+    "status": "open",
+    "opened_date": "2026-05-13",
+    "evidence_cves": [
+      "MAL-2026-3083",
+      "CVE-2025-53773"
+    ],
+    "atlas_refs": [
+      "AML.T0010",
+      "AML.T0055"
+    ],
+    "attack_refs": [
+      "T1195.001",
+      "T1195.002"
+    ]
+  },
+  "NIST-800-53-SI-10": {
+    "framework": "NIST SP 800-53 Rev 5",
+    "control_id": "SI-10",
+    "control_name": "Information Input Validation",
+    "designed_for": "Validating untrusted input at system boundaries before consumption by downstream code paths",
+    "misses": [
+      "Treats 'input validation' as a single layer at the trust boundary. Modern injection classes (SQL, argument, command, prompt) live INSIDE the trust boundary — the input is already 'validated' as authentic but the consumer concatenates it into a syntax the original validator did not anticipate (SQL query, kubectl argv, shell command).",
+      "Does not distinguish argv-array vs string-form invocation. CVE-2026-39884 (mcp-server-kubernetes argument injection) and the broader CWE-88 class are invisible to a SI-10-compliant codebase that 'validates' the user-input string for length and character class.",
+      "Does not address parameterised-query vs string-concat distinction. CVE-2026-42208 (LiteLLM SQLi on CISA KEV) is the cardinal recent example — input was validated, then concatenated into SQL during error-handling, which the validator did not gate.",
+      "Auditing for SI-10 typically samples function boundaries; the argument-injection / SQL-injection / prompt-injection failure modes all occur inside the boundary."
+    ],
+    "real_requirement": "Per-injection-class structural controls in addition to boundary validation. Parameterised queries enforced at the ORM/driver level (CWE-89). Argv-array form for spawned subprocesses (CWE-88). Tool-arg / function-call sanitisation in MCP / AI-agent surfaces (CWE-94). Lint rules flagging string-concat into SQL, exec, or AI-tool arguments. SI-10 compliance attestation augmented with a per-class checklist that names the specific structural control.",
+    "status": "open",
+    "opened_date": "2026-05-13",
+    "evidence_cves": [
+      "CVE-2026-42208",
+      "CVE-2026-39884"
+    ],
+    "atlas_refs": [
+      "AML.T0053"
+    ],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ]
   }
 }

package/data/playbooks/library-author.json

@@ -760,10 +760,10 @@
         {
           "id": "gha-workflow-script-injection-sink",
           "type": "file_path",
-          "value": "Within the release-workflows artifact (any file under .github/workflows/*.yml): a `run:` shell script body directly interpolates an attacker-controllable github.event field — ${{ github.event.comment.body }}, ${{ github.event.issue.body }}, ${{ github.event.issue.title }}, ${{ github.event.pull_request.body }}, ${{ github.event.pull_request.title }}, ${{ github.event.review.body }}, ${{ github.event.head_commit.message }}, ${{ github.head_ref }}, ${{ github.event.discussion.body }}, ${{ github.event.discussion.title }} — without first capturing the value into an env: variable. Grep regex (multi-line YAML aware): `run:\\s*\\|[\\s\\S]*?\\$\\{\\{\\s*github\\.(event\\.(comment|issue|pull_request|review|head_commit|discussion)\\.|head_ref)`. Corroborate via the branch-tag-protection artifact: if any workflow with this sink also triggers on `pull_request_target` / `issue_comment` / `pull_request_review_comment` AND its job has `permissions: contents: write` (or unrestricted GITHUB_TOKEN), the sink is exploitable by any GitHub user who can comment on the repo.",
+          "value": "Within the release-workflows artifact (any file under .github/workflows/*.yml): a `run:` shell — block-scalar (`run: |`) OR single-line (`run: <command>`) — interpolates an attacker-controllable github.event field — ${{ github.event.comment.body }}, ${{ github.event.issue.body }}, ${{ github.event.issue.title }}, ${{ github.event.pull_request.body }}, ${{ github.event.pull_request.title }}, ${{ github.event.review.body }}, ${{ github.event.head_commit.message }}, ${{ github.head_ref }}, ${{ github.event.discussion.body }}, ${{ github.event.discussion.title }} — without first capturing the value into an env: variable. Grep regex (multi-line YAML aware, matches both block-scalar and single-line run: shapes): `run:[\\s\\S]*?\\$\\{\\{\\s*github\\.(event\\.(comment|issue|pull_request|review|head_commit|discussion)\\.|head_ref)`. Corroborate via the branch-tag-protection artifact: if any workflow with this sink also triggers on `pull_request_target` / `issue_comment` / `pull_request_review_comment` AND its job has `permissions: contents: write` (or unrestricted GITHUB_TOKEN), the sink is exploitable by any GitHub user who can comment on the repo.",
           "description": "GitHub Actions script-injection sink. Elementary-data 0.23.3 (April 2026) was forged via this exact pattern — `${{ github.event.comment.body }}` interpolated into a `run:` block in update_pylon_issue.yml, escalated via the workflow's GITHUB_TOKEN to publish a malicious release. Without this indicator, a publisher account compromise via attacker-controlled comments looks identical to a clean release at the consumer side.",
-          "confidence": "deterministic",
-          "deterministic": true,
+          "confidence": "high",
+          "deterministic": false,
           "false_positive_checks_required": [
             "If the run: block reads the github.event field via an `env:` variable first (env: COMMENT_BODY: ${{ github.event.comment.body }}) and then references $COMMENT_BODY in the shell — that is the documented-safe pattern; demote to miss.",
             "If the workflow only runs in a sandboxed `pull_request` event (not `pull_request_target`) AND has default `permissions: contents: read` AND does not use secrets.* — the sink is not exploitable; demote to miss."

package/lib/refresh-external.js

@@ -125,10 +125,14 @@ Modes:
   --swarm            fan out sources across worker threads. Best with --from-cache.
   --advisory <id>    (v0.12.0) seed a single catalog entry from an advisory ID.
                      CVE-* and GHSA-* route through the GitHub Advisory
-                     Database. MAL-*, SNYK-*, RUSTSEC-*, USN-*, UVI-*, GO-*,
-                     MGASA-*, PYSEC-*, and other OSV-native namespaces route
-                     through OSV.dev (v0.12.10). Writes a DRAFT to
-                     data/cve-catalog.json marked with _auto_imported: true.
+                     Database. When GHSA returns 404 for a CVE-* id
+                     (CNAs / OSV mirrors operate on different cadences) the
+                     dispatcher falls back to OSV.dev's /v1/vulns/{id}
+                     before failing (v0.12.11). MAL-*, SNYK-*, RUSTSEC-*,
+                     USN-*, UVI-*, GO-*, MGASA-*, PYSEC-*, and other
+                     OSV-native namespaces route through OSV.dev (v0.12.10).
+                     Writes a DRAFT to data/cve-catalog.json marked with
+                     _auto_imported: true.
                      Editorial fields (framework_control_gaps, iocs,
                      atlas_refs, attack_refs) remain null pending review via:
                        exceptd run cve-curation --advisory <id>
@@ -861,7 +865,27 @@ async function seedSingleAdvisory(opts) {
   const sourceName = useOsv ? "osv" : "ghsa";
   const fixtureEnv = useOsv ? "EXCEPTD_OSV_FIXTURE" : "EXCEPTD_GHSA_FIXTURE";
 
-  const result = await sourceMod.fetchAdvisoryById(id, {});
+  let result = await sourceMod.fetchAdvisoryById(id, {});
+  // F4 (v0.12.11): CVE-* identifiers may have an OSV record before GHSA
+  // publishes one (CNAs and OSV mirrors operate on different cadences).
+  // When GHSA returns 404 specifically, retry through OSV's /v1/vulns/{id}
+  // — OSV indexes CVE ids as primary keys. If both 404, surface a combined
+  // error message so operators know both sources were tried before failing.
+  let fallbackSourceUsed = null;
+  if (!result.ok && !useOsv && /^CVE-/i.test(id) && /HTTP 404/.test(result.error || "")) {
+    const fallback = await osvMod.fetchAdvisoryById(id, {});
+    if (fallback.ok) {
+      result = fallback;
+      fallbackSourceUsed = "osv";
+    } else if (/HTTP 404/.test(fallback.error || "") || /not in fixture/.test(fallback.error || "")) {
+      // Both sources tried, both 404 — combine the error message.
+      const combined = { ok: false, verb: "refresh", error: `--advisory ${id}: not found in GHSA or OSV (GHSA: ${result.error}; OSV: ${fallback.error})`, source: "offline", routed_to: "ghsa+osv", hint: `Both GHSA and OSV.dev returned 404 for ${id}. Verify the CVE id (CVE-YYYY-NNNN) and that an advisory record exists upstream.` };
+      if (opts.json) process.stdout.write(JSON.stringify(combined) + "\n");
+      else process.stderr.write(`[refresh --advisory] ${combined.error}\n  hint: ${combined.hint}\n`);
+      process.exitCode = 2;
+      return;
+    }
+  }
   if (!result.ok) {
     const err = { ok: false, verb: "refresh", error: `--advisory ${id}: ${result.error}`, source: result.source, routed_to: sourceName, hint: `Verify the ID format (CVE-YYYY-NNNN, GHSA-*, MAL-*, SNYK-*, RUSTSEC-*, USN-*, etc.) and network reachability. Set ${fixtureEnv} for offline testing.` };
     if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
@@ -869,17 +893,21 @@ async function seedSingleAdvisory(opts) {
     process.exitCode = 2;
     return;
   }
+  // If the OSV fallback fired, normalize/route through the OSV module from
+  // here on — the advisory shape is OSV's, not GHSA's.
+  const effectiveMod = fallbackSourceUsed === "osv" ? osvMod : sourceMod;
+  const effectiveName = fallbackSourceUsed === "osv" ? "osv" : sourceName;
   const advisory = result.advisories[0];
   if (!advisory) {
-    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: no matching advisory found`, source: result.source, routed_to: sourceName };
+    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: no matching advisory found`, source: result.source, routed_to: effectiveName };
     if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
     else process.stderr.write(`[refresh --advisory] ${err.error}\n`);
     process.exitCode = 2;
     return;
   }
-  const normalized = sourceMod.normalizeAdvisory(advisory);
+  const normalized = effectiveMod.normalizeAdvisory(advisory);
   if (!normalized) {
-    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: advisory could not be normalized (missing required fields)`, routed_to: sourceName, source_id: advisory.ghsa_id || advisory.id || null };
+    const err = { ok: false, verb: "refresh", error: `--advisory ${id}: advisory could not be normalized (missing required fields)`, routed_to: effectiveName, source_id: advisory.ghsa_id || advisory.id || null };
     if (opts.json) process.stdout.write(JSON.stringify(err) + "\n");
     else process.stderr.write(`[refresh --advisory] ${err.error}\n`);
     process.exitCode = 2;
@@ -1063,4 +1091,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { ALL_SOURCES, loadCtx, parseArgs };
+module.exports = { ALL_SOURCES, loadCtx, parseArgs, seedSingleAdvisory };

package/lib/source-ghsa.js

@@ -119,7 +119,13 @@ async function fetchAdvisoryById(id, opts = {}) {
   if (/^CVE-\d{4}-\d+$/i.test(id)) {
     return fetchAdvisories({ ...opts, path: `/advisories?cve_id=${encodeURIComponent(id.toUpperCase())}` });
   }
-  return { ok: false, error: `unrecognized id format (expected CVE-YYYY-NNNN or GHSA-*): ${id}`, source: "offline" };
+  // v0.12.11: widen the error to enumerate OSV-native prefixes — operators
+  // running `exceptd refresh --advisory FOO-BAR` previously got an error
+  // mentioning only CVE / GHSA, even though MAL-*, SNYK-*, RUSTSEC-*,
+  // USN-*, PYSEC-*, GO-*, MGASA-*, UVI- are also valid id shapes routed
+  // through source-osv. The hint here mirrors lib/refresh-external.js
+  // seedSingleAdvisory's documented acceptance set.
+  return { ok: false, error: `unrecognized id format: ${id}. Expected one of: CVE-YYYY-NNNN, GHSA-* (routed through source-ghsa); MAL-* / SNYK-* / RUSTSEC-* / USN-* / PYSEC-* / GO-* / MGASA-* / UVI- (routed through source-osv).`, source: "offline" };
 }
 
 /**

package/lib/source-osv.js

@@ -39,17 +39,24 @@
 const https = require("https");
 const fs = require("fs");
 
+// OSV_HOST_OVERRIDE lets tests redirect the network call to a local HTTP
+// server bound on 127.0.0.1:<port>. The override accepts either a bare
+// `host:port` string or a full `http://host:port` URL. When set, the
+// underlying request switches from `https` to `http` so the test server
+// doesn't need a TLS cert. Production callers never set this.
 const OSV_HOST = "api.osv.dev";
 const REQUEST_TIMEOUT_MS = 10000;
 const USER_AGENT = "exceptd-security/source-osv (+https://exceptd.com)";
 
-// Identifier namespaces OSV uses as PRIMARY keys (i.e. that route through
-// this module rather than GHSA's CVE-search path). Keep this list in sync
-// with the dispatcher in lib/refresh-external.js — adding a new prefix
-// here is not enough; the dispatcher's --advisory regex must also accept it.
+// Identifier namespaces OSV uses as PRIMARY keys. GHSA-* is intentionally
+// NOT in this list — `seedSingleAdvisory` in lib/refresh-external.js routes
+// CVE-* and GHSA-* through `source-ghsa` because GHSA carries richer field
+// coverage (cvss object, vulnerable_version_range string, ghsa_id linkage)
+// than OSV's import of the same advisories. Keep this list in sync with the
+// dispatcher in lib/refresh-external.js — adding a new prefix here is not
+// enough; the dispatcher's --advisory regex must also accept it.
 const OSV_ID_PREFIXES = [
   "MAL-",     // OSSF Malicious Packages
-  "GHSA-",    // GitHub Security Advisories (OSV import)
   "SNYK-",    // Snyk
   "RUSTSEC-", // RustSec
   "GO-",      // Go vuln DB
@@ -72,24 +79,47 @@ const OSV_ID_PREFIXES = [
 
 /**
  * Return true when `id` looks like an OSV-native primary key (i.e. NOT a
- * CVE-* identifier). CVE-* identifiers continue to route through the GHSA
- * source because GHSA carries richer field coverage for CVE-keyed records.
+ * CVE-* identifier and NOT a GHSA-* identifier). Both CVE-* and GHSA-*
+ * route through `source-ghsa` for richer field coverage.
  */
 function isOsvId(id) {
   if (!id || typeof id !== "string") return false;
   const up = id.toUpperCase();
   if (/^CVE-\d{4}-\d+$/.test(up)) return false;
+  if (up.startsWith("GHSA-")) return false;
   return OSV_ID_PREFIXES.some((p) => up.startsWith(p));
 }
 
 /**
- * Low-level HTTPS GET against OSV. Resolves to { ok, record|error, source }.
+ * Resolve the OSV transport target. When OSV_HOST_OVERRIDE is set the
+ * request switches to plain HTTP on the override host:port so test
+ * harnesses can stand up a local server without TLS. Production omits the
+ * override entirely and lands on api.osv.dev over HTTPS.
  */
-function osvGet(path, timeoutMs = REQUEST_TIMEOUT_MS) {
+function osvTransport() {
+  const override = process.env.OSV_HOST_OVERRIDE;
+  if (!override) return { mod: https, host: OSV_HOST, port: 443 };
+  // Accept either "host:port" or a full URL.
+  let raw = override.trim();
+  if (/^https?:\/\//i.test(raw)) {
+    const u = new URL(raw);
+    return { mod: require("http"), host: u.hostname, port: parseInt(u.port, 10) || 80 };
+  }
+  const [h, p] = raw.split(":");
+  return { mod: require("http"), host: h || "127.0.0.1", port: parseInt(p, 10) || 80 };
+}
+
+/**
+ * Low-level GET against OSV. Resolves to { ok, record|error, source }.
+ * Honors OSV_HOST_OVERRIDE for offline tests.
+ */
+function osvGet(reqPath, timeoutMs = REQUEST_TIMEOUT_MS) {
   return new Promise((resolve) => {
-    const req = https.get({
-      host: OSV_HOST,
-      path,
+    const { mod, host, port } = osvTransport();
+    const req = mod.get({
+      host,
+      port,
+      path: reqPath,
       headers: {
         "Accept": "application/json",
         "User-Agent": USER_AGENT,
@@ -98,7 +128,11 @@ function osvGet(path, timeoutMs = REQUEST_TIMEOUT_MS) {
     }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
-        return resolve({ ok: false, error: `OSV returned HTTP ${res.statusCode}`, source: "offline" });
+        const status = res.statusCode;
+        const error = status === 429
+          ? `OSV rate-limited (HTTP 429)`
+          : `OSV returned HTTP ${status}`;
+        return resolve({ ok: false, error, status, source: "offline" });
       }
       const chunks = [];
       res.on("data", (c) => chunks.push(c));
@@ -111,20 +145,22 @@ function osvGet(path, timeoutMs = REQUEST_TIMEOUT_MS) {
         }
       });
     });
-    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("timeout", () => req.destroy(new Error("OSV request timed out")));
     req.on("error", (e) => resolve({ ok: false, error: e.message, source: "offline" }));
   });
 }
 
 /**
- * Low-level HTTPS POST against OSV. Body is JSON-stringified.
+ * Low-level POST against OSV. Body is JSON-stringified.
  */
-function osvPost(path, body, timeoutMs = REQUEST_TIMEOUT_MS) {
+function osvPost(reqPath, body, timeoutMs = REQUEST_TIMEOUT_MS) {
   return new Promise((resolve) => {
     const payload = Buffer.from(JSON.stringify(body), "utf8");
-    const req = https.request({
-      host: OSV_HOST,
-      path,
+    const { mod, host, port } = osvTransport();
+    const req = mod.request({
+      host,
+      port,
+      path: reqPath,
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -136,7 +172,11 @@ function osvPost(path, body, timeoutMs = REQUEST_TIMEOUT_MS) {
     }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
-        return resolve({ ok: false, error: `OSV returned HTTP ${res.statusCode}`, source: "offline" });
+        const status = res.statusCode;
+        const error = status === 429
+          ? `OSV rate-limited (HTTP 429)`
+          : `OSV returned HTTP ${status}`;
+        return resolve({ ok: false, error, status, source: "offline" });
       }
       const chunks = [];
       res.on("data", (c) => chunks.push(c));
@@ -149,7 +189,7 @@ function osvPost(path, body, timeoutMs = REQUEST_TIMEOUT_MS) {
         }
       });
     });
-    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("timeout", () => req.destroy(new Error("OSV request timed out")));
     req.on("error", (e) => resolve({ ok: false, error: e.message, source: "offline" }));
     req.write(payload);
     req.end();
@@ -157,14 +197,36 @@ function osvPost(path, body, timeoutMs = REQUEST_TIMEOUT_MS) {
 }
 
 /**
- * Read EXCEPTD_OSV_FIXTURE and return an array of OSV records. Accepts
- * either a single object or an array on disk.
+ * Read EXCEPTD_OSV_FIXTURE and return a structured envelope. Matches the
+ * GHSA-source convention: on any failure (missing file, malformed JSON,
+ * root not object/array) return `{ ok: false, error, source: "offline" }`
+ * rather than throw — operators on the CLI surface get a structured error
+ * instead of a Node stack trace.
+ *
+ * Returns:
+ *   null                                          when env var is unset
+ *   { ok: true, advisories: [...], source }       on success
+ *   { ok: false, error, source: "offline" }       on any failure
  */
 function readFixture() {
   const fp = process.env.EXCEPTD_OSV_FIXTURE;
   if (!fp) return null;
-  const raw = JSON.parse(fs.readFileSync(fp, "utf8"));
-  return Array.isArray(raw) ? raw : [raw];
+  let raw;
+  try {
+    raw = fs.readFileSync(fp, "utf8");
+  } catch (e) {
+    return { ok: false, error: `fixture: ${e.message}`, source: "offline" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { ok: false, error: `fixture: ${e.message}`, source: "offline" };
+  }
+  if (parsed == null || (typeof parsed !== "object")) {
+    return { ok: false, error: `fixture: root must be an OSV record object or array (got ${typeof parsed})`, source: "offline" };
+  }
+  return { ok: true, advisories: Array.isArray(parsed) ? parsed : [parsed], source: "fixture" };
 }
 
 /**
@@ -176,12 +238,19 @@ function readFixture() {
  */
 async function fetchAdvisoryById(id, opts = {}) {
   if (!id || typeof id !== "string") {
-    return { ok: false, error: "id is required (MAL-*, GHSA-*, SNYK-*, etc.)", source: "offline" };
+    return { ok: false, error: "id is required (MAL-*, SNYK-*, RUSTSEC-*, etc.)", source: "offline" };
   }
+  // OSV.dev's /v1/vulns/{id} is case-sensitive — `mal-2026-3083` 404s while
+  // `MAL-2026-3083` resolves. Uppercase at entry so operators piping
+  // lowercase ids from grep/jq don't get a surprising 404 from the network
+  // path. Fixture lookup already case-folds, so this normalization is a
+  // no-op there but harmless.
+  id = id.toUpperCase();
   const fixture = readFixture();
   if (fixture) {
-    const want = id.toUpperCase();
-    const match = fixture.find((rec) => {
+    if (!fixture.ok) return fixture; // F1: structured error envelope
+    const want = id;
+    const match = fixture.advisories.find((rec) => {
       const recId = (rec && rec.id) ? String(rec.id).toUpperCase() : null;
       if (recId === want) return true;
       const aliases = Array.isArray(rec?.aliases) ? rec.aliases.map((a) => String(a).toUpperCase()) : [];
@@ -205,9 +274,10 @@ async function fetchAdvisoriesForPackage(name, ecosystem, version, opts = {}) {
   }
   const fixture = readFixture();
   if (fixture) {
+    if (!fixture.ok) return fixture; // F1: structured error envelope
     // Best-effort fixture filtering: match any record whose `affected[]`
     // contains the requested package + ecosystem (+ version when set).
-    const matches = fixture.filter((rec) => {
+    const matches = fixture.advisories.filter((rec) => {
       const affected = Array.isArray(rec?.affected) ? rec.affected : [];
       return affected.some((a) => {
         const pkg = a?.package || {};
@@ -241,37 +311,112 @@ function pickCatalogKey(rec) {
 }
 
 /**
- * Pull a numeric CVSS score out of an OSV severity[] entry (CVSS v3 / v4
- * vector strings start with "CVSS:3.x/" or "CVSS:4.0/"). Returns null if
- * no parseable score is present.
+ * CVSS 3.1 base-score computation from a vector string. Implements Table 6
+ * of the FIRST CVSS 3.1 specification. Used when an OSV record carries a
+ * vector but no embedded numeric score (the common case for MAL-* records).
+ * Returns null on malformed input.
+ *
+ * Reference: https://www.first.org/cvss/v3.1/specification-document
+ */
+function cvss3BaseScore(vector) {
+  if (typeof vector !== "string") return null;
+  const m = vector.match(/^CVSS:3\.\d\/(.+)$/);
+  if (!m) return null;
+  const parts = m[1].split("/");
+  const metrics = {};
+  for (const p of parts) {
+    const [k, v] = p.split(":");
+    if (!k || !v) return null;
+    metrics[k] = v;
+  }
+  // Required metrics — bail if any are missing.
+  for (const k of ["AV", "AC", "PR", "UI", "S", "C", "I", "A"]) {
+    if (!metrics[k]) return null;
+  }
+  const AV_W = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+  const AC_W = { L: 0.77, H: 0.44 };
+  const UI_W = { N: 0.85, R: 0.62 };
+  const CIA_W = { H: 0.56, L: 0.22, N: 0 };
+  // PR weights depend on Scope.
+  const PR_W_U = { N: 0.85, L: 0.62, H: 0.27 };
+  const PR_W_C = { N: 0.85, L: 0.68, H: 0.5 };
+  const scope = metrics.S;
+  if (scope !== "U" && scope !== "C") return null;
+  const av = AV_W[metrics.AV];
+  const ac = AC_W[metrics.AC];
+  const ui = UI_W[metrics.UI];
+  const pr = (scope === "C" ? PR_W_C : PR_W_U)[metrics.PR];
+  const c = CIA_W[metrics.C];
+  const i = CIA_W[metrics.I];
+  const a = CIA_W[metrics.A];
+  if ([av, ac, ui, pr, c, i, a].some((x) => x == null)) return null;
+  const iss = 1 - ((1 - c) * (1 - i) * (1 - a));
+  let impact;
+  if (scope === "U") {
+    impact = 6.42 * iss;
+  } else {
+    impact = 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15);
+  }
+  if (impact <= 0) return 0.0;
+  const exploitability = 8.22 * av * ac * pr * ui;
+  let base;
+  if (scope === "U") {
+    base = Math.min(impact + exploitability, 10);
+  } else {
+    base = Math.min(1.08 * (impact + exploitability), 10);
+  }
+  // roundUp1: round up to one decimal (CVSS 3.1 §7.1).
+  const rounded = Math.ceil(base * 10) / 10;
+  if (!Number.isFinite(rounded) || rounded < 0 || rounded > 10) return null;
+  return rounded;
+}
+
+/**
+ * Pull a numeric CVSS score + vector out of an OSV severity[] entry. CVSS
+ * vectors start with "CVSS:3.x/" or "CVSS:4.0/". When multiple vectors are
+ * present (e.g. both V3 and V4), the highest version wins regardless of
+ * array order. When the OSV record has no embedded numeric tail, the score
+ * is computed from the vector itself via cvss3BaseScore(). Returns null
+ * components when nothing parseable is present.
  */
 function extractCvss(rec) {
   const sev = Array.isArray(rec?.severity) ? rec.severity : [];
   let score = null;
-  let vector = null;
+  let bestVector = null;
+  let bestVersion = 0;
   for (const s of sev) {
     if (typeof s?.score !== "string") continue;
     const v = s.score.trim();
-    // Bare numeric score
+    // Bare numeric score (no vector prefix).
     const num = parseFloat(v);
     if (!Number.isNaN(num) && num >= 0 && num <= 10 && !v.includes("/")) {
       if (score == null) score = num;
       continue;
     }
-    // CVSS vector — accept the highest-version vector we see.
-    if (/^CVSS:[34]/.test(v)) {
-      vector = v;
-      // Try to parse the score out of the trailing fragment if encoded
-      // as "CVSS:3.1/AV:.../9.3" — most OSV records don't embed it here,
-      // but some Snyk-imported records do.
-      const m = v.match(/\/(\d+(?:\.\d+)?)$/);
-      if (m && score == null) {
-        const candidate = parseFloat(m[1]);
-        if (candidate >= 0 && candidate <= 10) score = candidate;
-      }
+    const m = v.match(/^CVSS:(\d+\.\d+)/);
+    if (!m) continue;
+    const ver = parseFloat(m[1]);
+    if (ver > bestVersion) {
+      bestVersion = ver;
+      bestVector = v;
     }
   }
-  return { score, vector };
+  // If we picked a vector, try to read an embedded score from the trailing
+  // fragment (some Snyk records carry it as ".../9.3"). Otherwise compute
+  // it from the vector for CVSS 3.x. CVSS 4.0 base-score derivation is
+  // intentionally not implemented here — that's a v0.13 follow-up.
+  if (bestVector && score == null) {
+    const tail = bestVector.match(/\/(\d+(?:\.\d+)?)$/);
+    if (tail) {
+      const candidate = parseFloat(tail[1]);
+      if (candidate >= 0 && candidate <= 10) score = candidate;
+    }
+    if (score == null && /^CVSS:3\./.test(bestVector)) {
+      const computed = cvss3BaseScore(bestVector);
+      if (computed != null) score = computed;
+    }
+  }
+  return { score, vector: bestVector };
 }
 
 /**
@@ -373,6 +518,23 @@ function normalizeAdvisory(rec) {
   // OSV.dev canonical advisory URL — used as the primary vendor advisory.
   const osvUrl = `https://osv.dev/vulnerability/${encodeURIComponent(rec.id)}`;
 
+  // F6: dedupe verification_sources. OSV records frequently carry the
+  // canonical osv.dev URL in references[] as well, which would otherwise
+  // produce a duplicate alongside the prepended `osvUrl`.
+  const verification_sources = Array.from(new Set([
+    osvUrl,
+    ...(/^CVE-/i.test(catalogKey) ? [`https://nvd.nist.gov/vuln/detail/${catalogKey}`] : []),
+    ...refUrls.slice(0, 10),
+  ]));
+
+  // F5: EPSS coverage does not extend to non-CVE identifiers. Surface this
+  // explicitly so curators know to re-query if MITRE later assigns a CVE
+  // id to the entry. Wording mirrors the MAL-2026-3083 catalog entry.
+  const isCveKey = /^CVE-/i.test(catalogKey);
+  const epss_note = isCveKey
+    ? null
+    : "EPSS coverage does not extend to non-CVE identifiers. FIRST EPSS API only indexes CVE keys; MAL-* / SNYK-* / GHSA-* / RUSTSEC-* / etc. return no data. Re-query and populate epss_score when MITRE assigns a CVE id and the entry is renamed.";
+
   return {
     [catalogKey]: {
       name: rec.summary || rec.id,
@@ -407,15 +569,12 @@ function normalizeAdvisory(rec) {
       epss_score: null,
       epss_percentile: null,
       epss_date: null,
-      epss_source: /^CVE-/i.test(catalogKey)
+      epss_note,
+      epss_source: isCveKey
         ? `https://api.first.org/data/v1/epss?cve=${catalogKey}`
         : null,
       source_verified: published || today,
-      verification_sources: [
-        osvUrl,
-        ...(/^CVE-/i.test(catalogKey) ? [`https://nvd.nist.gov/vuln/detail/${catalogKey}`] : []),
-        ...refUrls.slice(0, 10),
-      ],
+      verification_sources,
       vendor_advisories: [
         {
           vendor: "OSV.dev",
@@ -451,19 +610,26 @@ async function buildDiff(ctx) {
       status: "ok",
       diffs: [],
       errors: 0,
+      unreachable_count: 0,
+      normalize_error_count: 0,
       summary: "OSV: no ids requested (set ctx.osv_ids to seed a draft, or pass --advisory <MAL-...> for one-shot import).",
     };
   }
   const existingKeys = new Set(Object.keys(ctx.cveCatalog || {}));
   const diffs = [];
-  let errors = 0;
+  // F7: distinguish unreachable (fetch failed, network or 5xx) from
+  // normalize-rejected (record fetched but normalization produced null).
+  // Operators triaging a refresh-report want to know whether to chase a
+  // network outage or a malformed upstream record.
+  let unreachable = 0;
+  let normalizeErrors = 0;
   for (const id of ids) {
     const r = await fetchAdvisoryById(id);
-    if (!r.ok) { errors++; continue; }
+    if (!r.ok) { unreachable++; continue; }
     const rec = r.advisories[0];
-    if (!rec) { errors++; continue; }
+    if (!rec) { unreachable++; continue; }
     const normalized = normalizeAdvisory(rec);
-    if (!normalized) { errors++; continue; }
+    if (!normalized) { normalizeErrors++; continue; }
     const key = Object.keys(normalized)[0];
     if (existingKeys.has(key)) continue;
     diffs.push({
@@ -475,11 +641,14 @@ async function buildDiff(ctx) {
       source: "osv",
     });
   }
+  const errors = unreachable + normalizeErrors;
   return {
     status: errors === 0 ? "ok" : errors === ids.length ? "unreachable" : "partial",
     diffs,
     errors,
-    summary: `OSV fetched ${ids.length} id(s); ${diffs.length} new entry diff(s), ${errors} failure(s).`,
+    unreachable_count: unreachable,
+    normalize_error_count: normalizeErrors,
+    summary: `OSV fetched ${ids.length} id(s); ${diffs.length} new entry diff(s), ${unreachable} unreachable, ${normalizeErrors} normalize-rejected.`,
   };
 }
 
@@ -489,5 +658,7 @@ module.exports = {
   normalizeAdvisory,
   buildDiff,
   isOsvId,
+  extractCvss,
+  cvss3BaseScore,
   OSV_ID_PREFIXES,
 };

package/manifest-snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-05-13T17:30:20.755Z",
+  "_generated_at": "2026-05-13T21:19:34.827Z",
   "atlas_version": "5.1.0",
   "skill_count": 38,
   "skills": [

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -52,7 +52,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "GfdaqLFofMiou8doFBE68J+ll50MU3EfJh6N6mNL6RwjABmHsbyfOXCeEpR3NlhbDrYJaG4hpZg4PwhN+t9QAA==",
-      "signed_at": "2026-05-13T17:30:20.336Z",
+      "signed_at": "2026-05-13T21:19:34.408Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -116,7 +116,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "m93naZQwujXBedWEjRN+88R1b2q/Dzs595Rz0ufsctsSVL2kiqlorzqqwL4mIXBDUM/HJAMRyFzPQoxOhh5qBw==",
-      "signed_at": "2026-05-13T17:30:20.338Z",
+      "signed_at": "2026-05-13T21:19:34.410Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -179,7 +179,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "gvC+DFTp8TONJiYIq/Uvg/uTCWyQ2vjdU8hhNEjYqTghxwnNbryePTmvcxb1VZDBSv1r+kyE2MpHRBzSdLhxDQ==",
-      "signed_at": "2026-05-13T17:30:20.338Z",
+      "signed_at": "2026-05-13T21:19:34.411Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -225,7 +225,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "FqTRjHfEgw56pyHnyWzNtnhzDMEePBtmuamtW/iyX+h4yqbvP4Fyr7NRjRs3EgqT4j7oHuEZhV9Jt6ZTBgN4AA==",
-      "signed_at": "2026-05-13T17:30:20.339Z"
+      "signed_at": "2026-05-13T21:19:34.411Z"
     },
     {
       "name": "compliance-theater",
@@ -256,7 +256,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "69KnW3ol+BZAcIbex0JJo6/71BgBE4S4o9CxZPd5kgzm5kb85PwzE6KfnK40OaE1jz36FUYJgiQZo/T7RiDhAA==",
-      "signed_at": "2026-05-13T17:30:20.339Z"
+      "signed_at": "2026-05-13T21:19:34.412Z"
     },
     {
       "name": "exploit-scoring",
@@ -285,7 +285,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "k13lnnr4U4H58LOr2rj+ygF80RnVsdpAyGLXAdyLaY5oJFwfmEMMZQVLrcPhDx6cIQgP+Muzgtolhkh577kCCw==",
-      "signed_at": "2026-05-13T17:30:20.340Z"
+      "signed_at": "2026-05-13T21:19:34.412Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -322,7 +322,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "X4avgw01bNVZjoiYDF+NN9qSOTjaH2I/7nRbPByoTLzMcORO7zTrZtqpGExJiV3Dmn0EtJ2dX07P65MqQIWHCA==",
-      "signed_at": "2026-05-13T17:30:20.340Z",
+      "signed_at": "2026-05-13T21:19:34.412Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -379,7 +379,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "SQWndklQmECBemQj42XTfdXM9+7iH+LgIb+qanQsUGT6dhQi7RsXlLeMxe74hVvwpDeUKsn22u23J4bWJh+HCw==",
-      "signed_at": "2026-05-13T17:30:20.340Z",
+      "signed_at": "2026-05-13T21:19:34.412Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -414,7 +414,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "Dc740zhVm0mtlbj80QfgPcAKFyLZbbDJx/gdNHyYui0XKC3YNxykjcbqKOXnfdLAKkeLwWjMqZefkQk49wueAQ==",
-      "signed_at": "2026-05-13T17:30:20.341Z",
+      "signed_at": "2026-05-13T21:19:34.413Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -442,7 +442,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "3w189PCSFqXTTqlzNc14EKcW7vZ/CtAkuKB2hE4ERdJX+0DNo5AOfrPLjOD1/LdZpPLayEjDTZ83WGtEsMu1Cw==",
-      "signed_at": "2026-05-13T17:30:20.341Z"
+      "signed_at": "2026-05-13T21:19:34.413Z"
     },
     {
       "name": "global-grc",
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "S/YXUpI/mcG2FpdUTgMsccWBtTaR5A4Ph4QFQw31S9w9Hn/z3sOFHLkb1B5YSwlg+mMOtSIxMdet1eLGSZkTDg==",
-      "signed_at": "2026-05-13T17:30:20.342Z"
+      "signed_at": "2026-05-13T21:19:34.414Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -501,7 +501,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "84nQaJylnNIZ47BD7dSBryWwntprRc9zqoTb6i5K7jV6cq7bUm6fVlrCTlFGg/oWLMX3x9JHmc9hqZhgdzRMCw==",
-      "signed_at": "2026-05-13T17:30:20.342Z"
+      "signed_at": "2026-05-13T21:19:34.414Z"
     },
     {
       "name": "pqc-first",
@@ -553,7 +553,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "oEkK5bLS/G5RIHnxlNFJYdzhTJbKZnkJv+W4iS9UJ/uszZHgZGoxygELPc4kn3FowV5eE988SQYG4WKlXtNzCg==",
-      "signed_at": "2026-05-13T17:30:20.342Z",
+      "signed_at": "2026-05-13T21:19:34.414Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -600,7 +600,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "JCrqB0GmldDIYPpgC+U3DDzxpYWJa0QgEQF7L1T8kxY0U0bsa7cw87CNC5KGk1VZRNsCa3v/I4XR1E/T5GkpBA==",
-      "signed_at": "2026-05-13T17:30:20.343Z"
+      "signed_at": "2026-05-13T21:19:34.415Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -637,7 +637,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "ctxS+0nGTJgJ4YroLpckhG+ryjYxfwvisSeGt2o8OF6eiQBlu/VbrOk03Jb+qkahgD0mLnSeBE4sjRwekGL9BQ==",
-      "signed_at": "2026-05-13T17:30:20.343Z",
+      "signed_at": "2026-05-13T21:19:34.415Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -672,7 +672,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "cdmQWTu9bFjeheH/B6pa88zCtPqVeEDDElnC/h7pUQ/JQSh9HuqCSiK/Jv2C4gaLA9h0dmKVe7NEFajshrZZDA==",
-      "signed_at": "2026-05-13T17:30:20.343Z"
+      "signed_at": "2026-05-13T21:19:34.415Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -743,7 +743,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "6YqZpHsmUz1/aTyOPNDUgJquKaacOqEqTIELHc5wlaydDz4bYboutEu/YiTYy+wF/nYo2nOyuJfMdR8jsYwEDQ==",
-      "signed_at": "2026-05-13T17:30:20.343Z"
+      "signed_at": "2026-05-13T21:19:34.416Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -803,7 +803,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "+ELdD+1AY5DymBitH7wU65CS60NY1nDoLowJAFn7cE5Gr/5jy9BTkyxsm7PEXaSlXWMOkTf/HQ+uyzyxUVD/Bw==",
-      "signed_at": "2026-05-13T17:30:20.344Z"
+      "signed_at": "2026-05-13T21:19:34.416Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -878,7 +878,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "H1N113M/YhnEPQptJ2B88wwAOB4eMPKuVABQ4DSlMjFMsX0ts1DBCupHHDoHcJHbi8vs+Wi10ekpL5SnsroZDQ==",
-      "signed_at": "2026-05-13T17:30:20.344Z"
+      "signed_at": "2026-05-13T21:19:34.416Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -955,7 +955,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "TmV9ZBDYqp2pHIbNZKQYf+kZLNAiyagnH/pjK9+LiSd7OdFIN3KEpFHPUNzcivB/CT5q7nl7Tsmvc9UvGo8WDg==",
-      "signed_at": "2026-05-13T17:30:20.344Z"
+      "signed_at": "2026-05-13T21:19:34.416Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1012,7 +1012,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "XZigwq8X/csfrdG10O6Q1V5q0zUqSQGd3QrjRKkZ4fkaodG4mZahYuIQqxc8rU9jjtGAm9LtBXYB+I5csqj9Bw==",
-      "signed_at": "2026-05-13T17:30:20.344Z"
+      "signed_at": "2026-05-13T21:19:34.417Z"
     },
     {
       "name": "identity-assurance",
@@ -1079,7 +1079,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "pCvavMUh5wR/TFl03Vh6ggKJHWPjakOEPDh7IjaD/U3WLBGPF3eyLBzieNLrPDXxIBbCJqnt9E79Bd4e73xCCg==",
-      "signed_at": "2026-05-13T17:30:20.345Z"
+      "signed_at": "2026-05-13T21:19:34.417Z"
     },
     {
       "name": "ot-ics-security",
@@ -1135,7 +1135,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "3V0ZpDLRTmCBx5Li+9m3XKA+k9QR+l0aE55cRPMX+UTDRlStKSG5PgrSGcL2ZKJog9hKaUPmjIVh7kkn54SfAg==",
-      "signed_at": "2026-05-13T17:30:20.345Z"
+      "signed_at": "2026-05-13T21:19:34.417Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1187,7 +1187,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "UCiNjncvhkZItmLQA/Sm1/NCsOiLMwdCjfUw+067v4NIxhaMMaqRrAeD3KgMyEtov7m2Hq2kfwYSt5+DQsYDCQ==",
-      "signed_at": "2026-05-13T17:30:20.345Z"
+      "signed_at": "2026-05-13T21:19:34.418Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1237,7 +1237,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "i8ZUFT7hwTQJyqYXWh8rchdEUNv1kk0bzkF3BHOANFwuVoM0+mukOPr+rhKdOWCPjTX72EG+0Mbs6hBTSfBBAg==",
-      "signed_at": "2026-05-13T17:30:20.346Z"
+      "signed_at": "2026-05-13T21:19:34.418Z"
     },
     {
       "name": "webapp-security",
@@ -1311,7 +1311,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "3d+Hs8yfERF/NUuVhO3YFYCY+bVn7aAGbNCCyGeqYM2VIt7q/nzNXGfbNfJbSPezClwutOyxbzPwXMj+TjmMDA==",
-      "signed_at": "2026-05-13T17:30:20.346Z"
+      "signed_at": "2026-05-13T21:19:34.418Z"
     },
     {
       "name": "ai-risk-management",
@@ -1361,7 +1361,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "runa3PkfcThZmv5I+F6D1hOR/kfBeVOcdDZHsJ/59WOjsPj4BPi4d9MtP1vV7G9qq9daGGz6YzZGnejjin4pCA==",
-      "signed_at": "2026-05-13T17:30:20.346Z"
+      "signed_at": "2026-05-13T21:19:34.418Z"
     },
     {
       "name": "sector-healthcare",
@@ -1421,7 +1421,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "58fEAPnojhmGSpEIIyWIwfj65A2KB4SMyUCoieJ28OZaUktUF+56wLHQOdAW6v2fSeiriFqZEqGyKyLryGGcBg==",
-      "signed_at": "2026-05-13T17:30:20.346Z"
+      "signed_at": "2026-05-13T21:19:34.419Z"
     },
     {
       "name": "sector-financial",
@@ -1502,7 +1502,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "wByxWUburbU5PB7EHLDVAByCpMbhKRTWqSoVsBmxIDsz2jCiKb3ogJutFnAV2r2oXuQIUaffGvrvACIrJ2GlBQ==",
-      "signed_at": "2026-05-13T17:30:20.347Z"
+      "signed_at": "2026-05-13T21:19:34.419Z"
     },
     {
       "name": "sector-federal-government",
@@ -1571,7 +1571,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "gdiwq/+AQxxNJ2t90dITyLd2ZWdDKHxbyS2I+AVRdM45VVKQEAY4XyheGZW8m5wdDF7N9X2ENIE5CRMfP5jnCA==",
-      "signed_at": "2026-05-13T17:30:20.347Z"
+      "signed_at": "2026-05-13T21:19:34.420Z"
     },
     {
       "name": "sector-energy",
@@ -1636,7 +1636,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "3M6nshB0ZNfr3H/rpcy58+/yve91u8kiTOhwUBePTZ0lQeuzlXZZV6/36i/NTWKC4SwgMn8fsZCpLxA5llRaCg==",
-      "signed_at": "2026-05-13T17:30:20.348Z"
+      "signed_at": "2026-05-13T21:19:34.420Z"
     },
     {
       "name": "api-security",
@@ -1705,7 +1705,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rLOJBYVELFSVT2zLEByuko5Z1+HwGY99pQOC1XIVHs9l7gmY7F8N8luU/EBvVDcnT9w6nPiC5YKmCy/50LbxBQ==",
-      "signed_at": "2026-05-13T17:30:20.348Z"
+      "signed_at": "2026-05-13T21:19:34.420Z"
     },
     {
       "name": "cloud-security",
@@ -1786,7 +1786,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "PyA9IHcGNrCLC0AJW2jF5D5XheA60igeirjHb3IOz/HitBEg3t2g/siP6pAUImx3IUmwp9vh+A6k+KBuyHRgBQ==",
-      "signed_at": "2026-05-13T17:30:20.348Z"
+      "signed_at": "2026-05-13T21:19:34.421Z"
     },
     {
       "name": "container-runtime-security",
@@ -1848,7 +1848,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "/RQD2SZghTsrG7qurGb1uabyJ2IL9nmbqd412k8tqZw6nzdvvNFWcYDUGBACEQLbSlJvuaJeQdMHQH5ZzzkNDA==",
-      "signed_at": "2026-05-13T17:30:20.349Z"
+      "signed_at": "2026-05-13T21:19:34.421Z"
     },
     {
       "name": "mlops-security",
@@ -1919,7 +1919,7 @@
         "MITRE ATLAS v5.2 — track AML.T0010 sub-technique expansion and any new MLOps-pipeline-specific TTPs"
       ],
       "signature": "BeACZFTsTRZyGuOEc7NPGnGUQ84ZrFbYRsg+yqJxCH7QOM69jYJTnExyAyxXfiJyoytzSffJQNK3h0E48rm0BQ==",
-      "signed_at": "2026-05-13T17:30:20.349Z"
+      "signed_at": "2026-05-13T21:19:34.421Z"
     },
     {
       "name": "incident-response-playbook",
@@ -1981,7 +1981,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "oy63A4wX5g9rYq3wWYGSS9L7wndNaa1+wJPRPtiHMvQ6CNhTzN8kCs9Ur2SkT7U9BKYdfPLni0gGMjoeDbx+AA==",
-      "signed_at": "2026-05-13T17:30:20.349Z"
+      "signed_at": "2026-05-13T21:19:34.422Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2034,7 +2034,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "EFhMVyQdiLRtYPHsMADrX3aDXyWd/F5sjnGoWtUTeTiIOmrhFMOCHsvpTPotfsLt0u3LgRK5ACgjgeON8PgQAg==",
-      "signed_at": "2026-05-13T17:30:20.350Z"
+      "signed_at": "2026-05-13T21:19:34.422Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2102,7 +2102,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "MMWvg3lIf5ygm31zyf1E43t3W9MfRbMBBPrqlj1wOa8AxVJL8LICnAXfmyJ/TNJXwpF+rfZeDdoxXkql8wmtBA==",
-      "signed_at": "2026-05-13T17:30:20.350Z"
+      "signed_at": "2026-05-13T21:19:34.422Z"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 38 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:9f17cd00-16e6-4fd2-b943-190a84d36bc4",
+  "serialNumber": "urn:uuid:dac8abdb-9a54-4d36-9f4b-21e8dde200ea",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-13T17:23:27.661Z",
+    "timestamp": "2026-05-13T21:19:35.259Z",
     "tools": [
       {
         "name": "hand-written",
@@ -13,10 +13,10 @@
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.12.10",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.12.11",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.12.10",
+      "version": "0.12.11",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 38 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
       "licenses": [
         {
@@ -25,11 +25,11 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.12.10",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.12.11",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.12.10"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.12.11"
         },
         {
           "type": "vcs",