@blamejs/exceptd-skills 0.12.27 → 0.12.28

package/data/rfc-references.json

@@ -152,8 +152,10 @@
     "lag_notes": "RFC 7519 is the spec; RFC 8725 (Best Current Practices) is what implementations should follow. Many MCP servers still hand-roll JWT validation and miss BCP 225 guidance.",
     "skills_referencing": [
       "api-security",
+      "cloud-iam-incident",
       "cloud-security",
       "identity-assurance",
+      "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "sector-healthcare",
@@ -301,8 +303,10 @@
     "relevance": "BCP 225. Required reading for any MCP / agent / AI-API auth implementation. Covers algorithm-confusion attacks, kid traversal, audience pinning. mcp-agent-trust uses this as the JWT-handling baseline.",
     "skills_referencing": [
       "api-security",
+      "cloud-iam-incident",
       "cloud-security",
       "identity-assurance",
+      "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "webapp-security"
@@ -421,6 +425,7 @@
     "skills_referencing": [
       "ai-c2-detection",
       "api-security",
+      "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "sector-healthcare"
@@ -557,5 +562,44 @@
       "coordinated-vuln-disclosure"
     ],
     "last_verified": "2026-05-13"
+  },
+  "RFC-7591": {
+    "number": 7591,
+    "title": "OAuth 2.0 Dynamic Client Registration Protocol",
+    "status": "Proposed Standard",
+    "published": "2015-07",
+    "tracker": "https://www.rfc-editor.org/info/rfc7591",
+    "relevance": "Dynamic Client Registration is the legitimate OAuth flow for self-service app onboarding into an IdP. Operator-facing: when DCR is enabled without strong attestation, a compromised tenant or compromised admin can register a malicious app whose redirect_uri exfiltrates auth codes — the 2023-2024 Microsoft Storm-0558 / Midnight Blizzard incidents exercised this surface via consent abuse on tenant-published apps. Pair with RFC 7592 (DCR Management Protocol) for full lifecycle controls.",
+    "skills_referencing": [
+      "idp-incident-response",
+      "identity-assurance"
+    ],
+    "last_verified": "2026-05-15"
+  },
+  "RFC-8693": {
+    "number": 8693,
+    "title": "OAuth 2.0 Token Exchange",
+    "status": "Proposed Standard",
+    "published": "2020-01",
+    "tracker": "https://www.rfc-editor.org/info/rfc8693",
+    "relevance": "Token exchange is the canonical mechanism for cloud IAM impersonation and service-account delegation chains (AWS STS AssumeRoleWithWebIdentity, GCP Workload Identity Federation, Azure Workload Identity). Operator-facing: token-exchange chains are the modern equivalent of pass-the-token — a compromised upstream token mints downstream tokens with widened audience claims. Audit chain depth + audience expansion + lifetime ladder.",
+    "skills_referencing": [
+      "cloud-iam-incident",
+      "identity-assurance"
+    ],
+    "last_verified": "2026-05-15"
+  },
+  "RFC-9068": {
+    "number": 9068,
+    "title": "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens",
+    "status": "Proposed Standard",
+    "published": "2021-10",
+    "tracker": "https://www.rfc-editor.org/info/rfc9068",
+    "relevance": "Standardises the JWT claim set for OAuth access tokens (typ, scope, client_id, etc.) that cloud IAM and SaaS APIs accept as bearer credentials. Operator-facing: when tokens omit the audience claim or accept loose typ values, replay across services becomes trivial — most cloud-IAM token-forgery incidents (Azure storm-0558 key-leak class) reduce to insufficient claim validation. Pair with RFC 8725 (JWT BCP) for hardening.",
+    "skills_referencing": [
+      "cloud-iam-incident",
+      "identity-assurance"
+    ],
+    "last_verified": "2026-05-15"
   }
 }

package/manifest-snapshot.json

@@ -1,8 +1,8 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-05-15T22:38:13.114Z",
+  "_generated_at": "2026-05-15T23:28:24.427Z",
   "atlas_version": "5.1.0",
-  "skill_count": 39,
+  "skill_count": 42,
   "skills": [
     {
       "name": "age-gates-child-safety",
@@ -339,6 +339,82 @@
       ],
       "dlp_refs": []
     },
+    {
+      "name": "cloud-iam-incident",
+      "version": "1.0.0",
+      "triggers": [
+        "access key public repo",
+        "aws account takeover",
+        "aws sso compromise",
+        "azure managed identity replay",
+        "cloud iam compromise",
+        "cloudtrail anomaly",
+        "cross account assume role",
+        "crypto mining cloud",
+        "federated trust abuse",
+        "gcp service account compromise",
+        "iam access key leak",
+        "iam identity center",
+        "imds metadata abuse",
+        "imdsv1 ssrf",
+        "oidc trust policy",
+        "scattered spider aws",
+        "snowflake aa24",
+        "workload identity federation"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "attack-techniques.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [
+        "AML.T0051"
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1078.004",
+        "T1098.001",
+        "T1538",
+        "T1552.005",
+        "T1580"
+      ],
+      "framework_gaps": [
+        "AU-ISM-1546-Cloud-Service-Account",
+        "AWS-Security-Hub-Coverage-Gap",
+        "CISA-Snowflake-AA24-IdP-Cloud",
+        "FedRAMP-IL5-IAM-Federated",
+        "ISO-27017-Cloud-IAM",
+        "NIST-800-53-AC-2-Cross-Account",
+        "SOC2-CC6-Access-Key-Leak-Public-Repo",
+        "UK-CAF-B2-Cloud-IAM"
+      ],
+      "rfc_refs": [
+        "RFC-7519",
+        "RFC-8693",
+        "RFC-8725",
+        "RFC-9068"
+      ],
+      "cwe_refs": [
+        "CWE-269",
+        "CWE-287",
+        "CWE-522",
+        "CWE-732",
+        "CWE-798",
+        "CWE-863"
+      ],
+      "d3fend_refs": [
+        "D3-CAA",
+        "D3-CBAN",
+        "D3-IOPR",
+        "D3-MFA",
+        "D3-NTA"
+      ],
+      "dlp_refs": []
+    },
     {
       "name": "cloud-security",
       "version": "1.0.0",
@@ -894,6 +970,83 @@
       "d3fend_refs": [],
       "dlp_refs": []
     },
+    {
+      "name": "idp-incident-response",
+      "version": "1.0.0",
+      "triggers": [
+        "apt29 entra",
+        "auth0 breach",
+        "cozy bear",
+        "cross-tenant abuse",
+        "entra app consent",
+        "entra id compromise",
+        "federated trust abuse",
+        "help-desk social engineering",
+        "identity provider incident",
+        "idp incident",
+        "management api token leak",
+        "mfa factor swap",
+        "midnight blizzard",
+        "oauth consent abuse",
+        "octo tempest",
+        "okta breach",
+        "okta compromise",
+        "onelogin breach",
+        "ping identity breach",
+        "saml token forgery",
+        "scattered spider",
+        "service account compromise",
+        "storm-0875",
+        "tenant compromise"
+      ],
+      "data_deps": [
+        "attack-techniques.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T1078.004",
+        "T1098.001",
+        "T1199",
+        "T1556.007",
+        "T1606.002"
+      ],
+      "framework_gaps": [
+        "AU-ISM-1559-IdP",
+        "DORA-Art-19-IdP-4h",
+        "ISO-27001-2022-A.5.16-Federated",
+        "NIS2-Art-21-Federated-Identity",
+        "NIST-800-53-IA-5-Federated",
+        "OFAC-Sanctions-Threat-Actor-Negotiation",
+        "SOC2-CC6-OAuth-Consent",
+        "UK-CAF-B2-IdP-Tenant"
+      ],
+      "rfc_refs": [
+        "RFC-7519",
+        "RFC-7591",
+        "RFC-8725",
+        "RFC-9421"
+      ],
+      "cwe_refs": [
+        "CWE-269",
+        "CWE-284",
+        "CWE-287",
+        "CWE-345",
+        "CWE-522",
+        "CWE-863"
+      ],
+      "d3fend_refs": [
+        "D3-CBAN",
+        "D3-IOPR",
+        "D3-MFA",
+        "D3-NTA"
+      ],
+      "dlp_refs": []
+    },
     {
       "name": "incident-response-playbook",
       "version": "1.0.0",
@@ -1289,6 +1442,70 @@
       ],
       "dlp_refs": []
     },
+    {
+      "name": "ransomware-response",
+      "version": "1.0.0",
+      "triggers": [
+        "akira ransomware",
+        "alphv",
+        "blackcat",
+        "blacksuit",
+        "cuba ransomware",
+        "cyber insurance ransomware",
+        "data theft before encryption",
+        "decryptor availability",
+        "double extortion",
+        "encryption event",
+        "exfil before encrypt",
+        "hunters international",
+        "immutable backup",
+        "lockbit",
+        "no more ransom",
+        "ofac sanctions ransomware",
+        "ransom payment",
+        "ransomhub",
+        "ransomware",
+        "ransomware incident",
+        "royal ransomware",
+        "shadow copy deletion"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T1059",
+        "T1078",
+        "T1486",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "Decryptor-Availability-Pre-Decision",
+        "EU-Sanctions-Reg-2014-833-Cyber",
+        "Immutable-Backup-Recovery",
+        "Insurance-Carrier-24h-Notification",
+        "OFAC-SDN-Payment-Block",
+        "PHI-Exfil-Before-Encrypt-Breach-Class"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-287",
+        "CWE-798"
+      ],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-IOPR",
+        "D3-NTA",
+        "D3-RPA"
+      ],
+      "dlp_refs": []
+    },
     {
       "name": "researcher",
       "version": "1.0.0",

package/manifest-snapshot.sha256

@@ -1 +1 @@
-259bbbc7ec375bfb21c2e8fe4c397cca265b33b357e19282d34acff932752237  manifest-snapshot.json
+ac16c35fbc0c164c00294ca821b6e44c12908800b5e6cfb339ea472c9a9ed5e0  manifest-snapshot.json