@blamejs/exceptd-skills 0.13.47 → 0.13.48

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.13.48 — 2026-05-21
+
+Collector predicate tightening across `secrets`, `library-author`, `crypto-codebase`, and `cred-stores`.
+
+### Bugs
+
+- **`secrets` collector demotes hits scoped exclusively to test / fixture / example paths.** Previously a JWT literal in `fulcio_test.go` or a private-key block in `cosign-test.key` flipped `jwt-token-with-secret-context` / `ssh-private-key-block` to `hit`. The collector now splits hits into production-scope vs. test-scope (segments `/test/` `/tests/` `/spec/` `/fixtures/` `/examples/` `/samples/` `/demo/` `/testdata/`, plus `*.test.<ext>` / `*.spec.<ext>` / `*_test.<ext>` / `*-test[-.]*` filename conventions). The indicator fires only when at least one production-scope hit exists. Test-only hits stay visible in the `secret-regex-scan-text-files` artifact for operator inspection but don't trip the signal. Mirrors the existing `crypto-codebase` demotion pattern.
+- **`library-author` recognises container-native publish workflows.** The previous heuristic only matched npm / pypi / cargo / goreleaser / softprops-action-gh-release publish paths. Workflows using `ko publish` / `cosign sign(-blob)` / `crane push` / `oras push` / `docker push` / `docker/build-push-action` were missed, which falsely flipped `publish-workflow-no-id-token-write` on projects (e.g. sigstore/cosign) that use `id-token: write` for OIDC-based publishing. Now those workflows are recognized as publish-related, AND any workflow declaring `id-token: write` inside a `permissions:` block with executable `steps:` is treated as publish context.
+- **`crypto-codebase` test-path demotion now covers Go's `_test.go` convention.** The previous regex matched only `*.test.<ext>` / `*.spec.<ext>` (dot-separated). Go convention is `foo_test.go` (underscore-separated); those test files were not demoted and false-positive'd indicators like `weak-hash-import` (md5 in a Go test using a "token" variable). Added `(?:^|[\\/])[^\\/]+_test\.[a-z]+$` to the demotion regex.
+
+### Features
+
+- **`cred-stores` surfaces a `credentials-file-perms-check` artifact** documenting whether the POSIX-mode-bit check ran (`captured: true` on Linux / macOS) or was skipped (`captured: false, reason: "...skipped on win32..."` on Windows). Previously the `credentials-file-bad-perms` signal was silently absent from `signal_overrides` on Windows, indistinguishable from "indicator not catalogued". Mirrors the `secrets` collector's `world-writable-secret-files` skip pattern.
+
 ## 0.13.47 — 2026-05-21
 
 `cicd-pipeline-compromise` collect | run pipe now produces a verdict when the operator opts in to the CI-fleet ownership attestation.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-21T16:44:49.627Z",
+  "generated_at": "2026-05-21T17:21:55.109Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "e206a4bf8b7e84f787bdc8af0b7ca6d41d5a08c3f9a91d612f65e2f29c9c2269",
+    "manifest.json": "d609674fbe018083de83b4219c280889b616756dfdbf11d026cccf6594c80684",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
     "data/attack-techniques.json": "49b6010b317edd219def135171ea8f3b1bbf1e00e9c5a08bf7237215ff54e2c3",
     "data/cve-catalog.json": "a09c83af3f9679a7ea73935726a1ff9de2cab94b4ab6321fc017fc147747d7c3",

package/lib/collectors/cred-stores.js

@@ -439,6 +439,24 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
       captured: false,
       reason: "secret-tool / security dump-keychain require interactive auth or platform-specific binaries; out of stdlib collector scope",
     },
+    // Surface the POSIX-mode-bit skip on Windows so operators see the
+    // indicator was considered but skipped, mirroring the secrets
+    // collector's world-writable-secret-files skip artifact. Without
+    // this, credentials-file-bad-perms silently absent from
+    // signal_overrides looks indistinguishable from "indicator not
+    // catalogued".
+    "credentials-file-perms-check": isPosix
+      ? {
+          value: permViolations.length > 0
+            ? `${permViolations.length} carrier(s) with mode != expected: ${permViolations.map(v => `${v.id}=${v.mode_octal}`).join(", ")}`
+            : "all checked carriers at expected mode",
+          captured: true,
+        }
+      : {
+          value: "skipped on win32 — POSIX mode bits not load-bearing",
+          captured: false,
+          reason: "Windows uses ACLs, not POSIX mode bits; credentials-file-bad-perms indicator left to operator-supplied evidence on this platform",
+        },
   };
 
   if (permViolations.length > 0) {

package/lib/collectors/crypto-codebase.js

@@ -59,7 +59,10 @@ function isTestPath(rel) {
   for (const seg of TEST_PATH_SEGMENTS) {
     if (norm.includes(seg)) return true;
   }
+  // `foo.test.js`, `bar.spec.py` (dot-separated)
   if (/\.(test|spec)\.[a-z]+$/i.test(rel)) return true;
+  // `foo_test.go` (Go convention), `_test.py` (some Python projects)
+  if (/(?:^|[\\/])[^\\/]+_test\.[a-z]+$/i.test(rel)) return true;
   return false;
 }
 

package/lib/collectors/library-author.js

@@ -66,9 +66,17 @@ function walkWorkflows(root) {
 }
 
 function looksLikePublishWorkflow(name, content) {
-  // Heuristic: filename starts with `release`/`publish`/`deploy` OR
-  // the workflow body mentions `npm publish` / `pypi-publish` /
-  // `cargo publish` / `goreleaser` somewhere.
+  // Heuristic: filename starts with `release`/`publish`/`deploy`, OR
+  // the workflow body invokes a known publish/release tool (npm /
+  // pypi / cargo / goreleaser / ko / cosign / crane / oras / docker /
+  // GitHub releases / sigstore-action). The container-native shapes
+  // matter because projects that publish via `ko publish` / `cosign
+  // sign-blob` (sigstore-style) DO use `id-token: write`, and the
+  // narrower npm/pypi/cargo matcher missed those workflows entirely.
+  // Filename `build.*` deliberately omitted — many projects use it
+  // for ordinary CI (lint / test / typecheck), not publishing.
+  // Cosign-style `build.yaml` is still recognized via its body
+  // content (cosign / id-token: write / etc.).
   const lower = name.toLowerCase();
   if (/^(release|publish|deploy)/.test(lower)) return true;
   if (/\bnpm\s+publish\b/.test(content)) return true;
@@ -76,6 +84,19 @@ function looksLikePublishWorkflow(name, content) {
   if (/\bcargo\s+publish\b/.test(content)) return true;
   if (/goreleaser/.test(content)) return true;
   if (/softprops\/action-gh-release/.test(content)) return true;
+  // Container + sigstore release tooling.
+  if (/\bko\s+(?:publish|build|apply|resolve)\b/.test(content)) return true;
+  if (/\bcosign\s+sign(?:-blob)?\b/.test(content)) return true;
+  if (/sigstore\/cosign-installer/.test(content)) return true;
+  if (/\bcrane\s+(?:push|copy|append)\b/.test(content)) return true;
+  if (/\boras\s+(?:push|copy)\b/.test(content)) return true;
+  // GitHub Container Registry / generic docker push paths.
+  if (/docker\/build-push-action/.test(content)) return true;
+  if (/\bdocker\s+push\b/.test(content)) return true;
+  // Sigstore OIDC token issuance is the canonical signal that a
+  // workflow is publishing artifacts — id-token: write inside a
+  // permissions block + the workflow runs more than a test job.
+  if (/id-token:\s*write/.test(content) && /\bsteps:/.test(content)) return true;
   return false;
 }
 

package/lib/collectors/secrets.js

@@ -30,6 +30,34 @@ const DEFAULT_EXCLUDES = new Set([
   "target", ".idea", ".vscode",
 ]);
 
+// Path segments that denote test / fixture / example material. Hits
+// scoped exclusively to these paths are downgraded — a private-key
+// block in `cosign-test.key` or a JWT literal in `_test.go` is
+// expected test material, not a real secret. If at least one hit
+// exists outside these paths, the indicator still fires. Mirrors
+// the crypto-codebase collector's isTestPath shape.
+const TEST_PATH_SEGMENTS = [
+  "/test/", "/tests/", "/spec/", "/specs/", "/__tests__/",
+  "/fixtures/", "/fixture/", "/examples/", "/example/",
+  "/sample/", "/samples/", "/demo/", "/demos/",
+  "/testdata/", "/test-data/", "/test_data/",
+];
+
+function isTestPath(rel) {
+  const norm = "/" + rel.replace(/\\/g, "/").toLowerCase() + "/";
+  for (const seg of TEST_PATH_SEGMENTS) {
+    if (norm.includes(seg)) return true;
+  }
+  // foo.test.js / bar.spec.py — dot-separated convention.
+  if (/\.(test|spec)\.[a-z]+$/i.test(rel)) return true;
+  // foo_test.go (Go) / bar_test.py (some Python) — underscore convention.
+  if (/(?:^|[\\/])[^\\/]+_test\.[a-z]+$/i.test(rel)) return true;
+  // Files whose name itself includes the substring "test" before a
+  // key extension (e.g. cosign-test.key, github-test-token.json).
+  if (/-test[-.][^\\/]*$/i.test(rel)) return true;
+  return false;
+}
+
 const ENV_FILE_PREDICATE = (name) => {
   if (name === ".env" || name === ".envrc") return true;
   if (name.startsWith(".env.")) return true;
@@ -235,14 +263,32 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     }
   }
 
+  // Split hits into production vs test-path. The indicator fires
+  // only when at least one PROD hit exists. Test-only hits stay in
+  // the artifact for operator inspection but don't flip the signal.
   const hitsByIndicator = {};
+  const prodHitsByIndicator = {};
   for (const h of allHits) {
     (hitsByIndicator[h.indicator_id] = hitsByIndicator[h.indicator_id] || []).push(h);
+    if (!isTestPath(h.file)) {
+      (prodHitsByIndicator[h.indicator_id] = prodHitsByIndicator[h.indicator_id] || []).push(h);
+    }
   }
+  // Same split for the file-presence indicators (ssh-private-keys
+  // artifact backs the ssh-private-key-block content scan AND the
+  // ssh-key-bad-perms posture check below). Filter out test-named
+  // private-key files (e.g. cosign-test.key) for the signal too.
+  const prodSshPrivateKeys = sshPrivateKeys.filter(f => !isTestPath(f.rel));
+
   const signal_overrides = {};
   for (const p of INDICATOR_PATTERNS) {
-    signal_overrides[p.id] = hitsByIndicator[p.id] && hitsByIndicator[p.id].length > 0 ? "hit" : "miss";
+    signal_overrides[p.id] = prodHitsByIndicator[p.id] && prodHitsByIndicator[p.id].length > 0 ? "hit" : "miss";
   }
+  // ssh-private-key-block is also flipped by file presence (a private
+  // key file with the matching magic bytes counts even without a
+  // content scan match — e.g. binary-only key formats). Re-flip when
+  // any non-test private-key file was discovered.
+  if (prodSshPrivateKeys.length > 0) signal_overrides["ssh-private-key-block"] = "hit";
   // world-writable-env-file predicate (per data/playbooks/secrets.json):
   //   restricted to env-files artifact entries
   //   any .env / .env.* / .envrc with mode 0666 or 0664 (group/world writable)

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.13.47",
+  "version": "0.13.48",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-21T16:32:59.757Z",
+      "signed_at": "2026-05-21T17:02:34.780Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -117,7 +117,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vSVqu4wBm+d68ujZmM6Rto/HzViCkE0gPUcv/MYE/bjFiqamf/s0On4kTOo1KIveV9cOwYNxiItaGEWlVkRFDg==",
-      "signed_at": "2026-05-21T16:32:59.759Z",
+      "signed_at": "2026-05-21T17:02:34.782Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -180,7 +180,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "RIgXKvolQjgJdnlrDnVOd90IOY1B7VHHZD/YJQRzouL+wUeOLclPrdK/EgEuFyiu7lR4bi+Pl6aGB9G9tOxYCQ==",
-      "signed_at": "2026-05-21T16:32:59.760Z",
+      "signed_at": "2026-05-21T17:02:34.782Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -226,7 +226,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "RYOxeq/o3uTwTWq4H7RcdH2Aclg9UyCERfUH9Frwkzncsowg7LgxpaEDc3swTCv73HMEGbU8wVbXguZ4JxHUCQ==",
-      "signed_at": "2026-05-21T16:32:59.760Z"
+      "signed_at": "2026-05-21T17:02:34.783Z"
     },
     {
       "name": "compliance-theater",
@@ -257,7 +257,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "DneJCPKCPcoe6nQ82XptqSqNfSRdt1orKaO+o7K36YCciDrzwJb+1BuBLusPDtpcdDaGY0y0e+AqiTYJklhBAQ==",
-      "signed_at": "2026-05-21T16:32:59.761Z"
+      "signed_at": "2026-05-21T17:02:34.783Z"
     },
     {
       "name": "exploit-scoring",
@@ -286,7 +286,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-21T16:32:59.761Z"
+      "signed_at": "2026-05-21T17:02:34.784Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -323,7 +323,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "XgrzcA2brPhXrSTxrcLnJec0OpgGYJBoSTUlJ10UdePHffxqb9LTVGnfbmEk1ykQifXREZexui2bG7X/+eFfCQ==",
-      "signed_at": "2026-05-21T16:32:59.762Z",
+      "signed_at": "2026-05-21T17:02:34.784Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -380,7 +380,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "9+hZlZOqZdeACUmamQk66L5levZhhwnFXuYRhdT6Mce99eQaKT7wNfWq12hXQztkRcVRKaFH+a01zwJQwsRQCA==",
-      "signed_at": "2026-05-21T16:32:59.762Z",
+      "signed_at": "2026-05-21T17:02:34.785Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -415,7 +415,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ciqhVloMWWXEigPZvvwoV2c54tEqsDqsoc+sS/mNTFFJk2H+tz2+XUrgfEPRuYw0FeyNB6/+27pL2NpKHzUqAg==",
-      "signed_at": "2026-05-21T16:32:59.762Z",
+      "signed_at": "2026-05-21T17:02:34.785Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-21T16:32:59.763Z"
+      "signed_at": "2026-05-21T17:02:34.785Z"
     },
     {
       "name": "global-grc",
@@ -475,7 +475,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-21T16:32:59.763Z"
+      "signed_at": "2026-05-21T17:02:34.786Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -502,7 +502,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-21T16:32:59.764Z"
+      "signed_at": "2026-05-21T17:02:34.786Z"
     },
     {
       "name": "pqc-first",
@@ -554,7 +554,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vhc3wuQEro/86s1ro2b/KakUXg8QVnySYTBqA7ebzv9oeR2HYO5bvGEJp3oOHWtL37JDqcCAHYadSN/qxIyCCA==",
-      "signed_at": "2026-05-21T16:32:59.764Z",
+      "signed_at": "2026-05-21T17:02:34.786Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -601,7 +601,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "MS35nWm8djfJGn4OOoT0JKJ2aO+Dkbb6wOOWJYvNZlRKT3UGA59o2gxg1JOnD20hb/RwxtkmCujhl2tuYSR+AQ==",
-      "signed_at": "2026-05-21T16:32:59.764Z"
+      "signed_at": "2026-05-21T17:02:34.787Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -638,7 +638,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-21T16:32:59.765Z",
+      "signed_at": "2026-05-21T17:02:34.787Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -673,7 +673,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "WAu5fRirzSOcnnZsTx2d/JJZwa/LPpXCi+31qATTGLmoNuhyy81k3ooPe9kCM3E0CLMtvTePg9DagYqBninZDQ==",
-      "signed_at": "2026-05-21T16:32:59.765Z"
+      "signed_at": "2026-05-21T17:02:34.787Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -744,7 +744,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "7eEwCXFd9pDKUw7yCUbRJSjfzozE44dwwwemCQUPm8JBPztLltibD9bL/RszSbYyCrYJmVb5Drncz2cGe62gCw==",
-      "signed_at": "2026-05-21T16:32:59.765Z"
+      "signed_at": "2026-05-21T17:02:34.788Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -804,7 +804,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-21T16:32:59.766Z"
+      "signed_at": "2026-05-21T17:02:34.788Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -879,7 +879,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "fgxG344JGYBWWWwFXZ1IzGipWKP7EyBhrsvsbsb0CCGXfv/MvNHVNI6G0zQddCsWX1JeQbhZT3Vk8v1uJKDTDA==",
-      "signed_at": "2026-05-21T16:32:59.766Z"
+      "signed_at": "2026-05-21T17:02:34.789Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -956,7 +956,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-21T16:32:59.766Z"
+      "signed_at": "2026-05-21T17:02:34.789Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1013,7 +1013,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "gqF8eU3VBrZhO2WnlcqKa7wm1d2mmWtvpbmx0kNCgHojNV+qEt+Ij84RO6bZvaUqhfYPWizWL79Fa4DL0curAQ==",
-      "signed_at": "2026-05-21T16:32:59.767Z"
+      "signed_at": "2026-05-21T17:02:34.789Z"
     },
     {
       "name": "identity-assurance",
@@ -1080,7 +1080,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-21T16:32:59.767Z"
+      "signed_at": "2026-05-21T17:02:34.790Z"
     },
     {
       "name": "ot-ics-security",
@@ -1136,7 +1136,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-21T16:32:59.768Z"
+      "signed_at": "2026-05-21T17:02:34.790Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1188,7 +1188,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-21T16:32:59.768Z"
+      "signed_at": "2026-05-21T17:02:34.790Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1238,7 +1238,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-21T16:32:59.768Z"
+      "signed_at": "2026-05-21T17:02:34.791Z"
     },
     {
       "name": "webapp-security",
@@ -1312,7 +1312,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-21T16:32:59.769Z"
+      "signed_at": "2026-05-21T17:02:34.791Z"
     },
     {
       "name": "ai-risk-management",
@@ -1362,7 +1362,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-21T16:32:59.769Z"
+      "signed_at": "2026-05-21T17:02:34.791Z"
     },
     {
       "name": "sector-healthcare",
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-21T16:32:59.770Z"
+      "signed_at": "2026-05-21T17:02:34.792Z"
     },
     {
       "name": "sector-financial",
@@ -1503,7 +1503,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-21T16:32:59.770Z"
+      "signed_at": "2026-05-21T17:02:34.792Z"
     },
     {
       "name": "sector-federal-government",
@@ -1572,7 +1572,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-21T16:32:59.771Z"
+      "signed_at": "2026-05-21T17:02:34.793Z"
     },
     {
       "name": "sector-energy",
@@ -1637,7 +1637,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-21T16:32:59.771Z"
+      "signed_at": "2026-05-21T17:02:34.793Z"
     },
     {
       "name": "sector-telecom",
@@ -1723,7 +1723,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-21T16:32:59.771Z"
+      "signed_at": "2026-05-21T17:02:34.793Z"
     },
     {
       "name": "api-security",
@@ -1792,7 +1792,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-21T16:32:59.772Z"
+      "signed_at": "2026-05-21T17:02:34.794Z"
     },
     {
       "name": "cloud-security",
@@ -1873,7 +1873,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-21T16:32:59.772Z"
+      "signed_at": "2026-05-21T17:02:34.794Z"
     },
     {
       "name": "container-runtime-security",
@@ -1935,7 +1935,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-21T16:32:59.772Z"
+      "signed_at": "2026-05-21T17:02:34.794Z"
     },
     {
       "name": "mlops-security",
@@ -2006,7 +2006,7 @@
         "MITRE ATLAS v5.6.0 (released February 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: ATLAS v5.5 / v6.0 — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "BGNE6ZQWBA1LmsUFe8tU0L67iGDSrFqiuqaZD2f1KqfcyqqzQfMs9PWNHFzxxaJmXeKlm87eU8lgELF0bX+RBA==",
-      "signed_at": "2026-05-21T16:32:59.773Z"
+      "signed_at": "2026-05-21T17:02:34.795Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2068,7 +2068,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "FkZQerh3VHVJAwIcCktDyMRh5KE2+Em/i0ek8zEz7JG/PXtQx8ujHWTh3VjZbOLhPNtdB2qxgXOIAYIofaVOAQ==",
-      "signed_at": "2026-05-21T16:32:59.773Z"
+      "signed_at": "2026-05-21T17:02:34.795Z"
     },
     {
       "name": "ransomware-response",
@@ -2148,7 +2148,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "n3UToNuN3A1HgLvcuqmIx8vrZY71+r/79waK92jG+rSX4uYOzkmxMUpROrE5K9bDwMezNBHdjWv8Uul6zugyDQ==",
-      "signed_at": "2026-05-21T16:32:59.774Z"
+      "signed_at": "2026-05-21T17:02:34.796Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2201,7 +2201,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-21T16:32:59.774Z"
+      "signed_at": "2026-05-21T17:02:34.796Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2269,7 +2269,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "+OO0RhQ303RJV7kaH38IuZpLeQbapep6Ds4Re/WEZu0FHBwKSlwvF7jbtP7KQ57xldJYn/xZm2jaszyOacMfDg==",
-      "signed_at": "2026-05-21T16:32:59.775Z"
+      "signed_at": "2026-05-21T17:02:34.796Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2349,7 +2349,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-21T16:32:59.775Z"
+      "signed_at": "2026-05-21T17:02:34.797Z"
     },
     {
       "name": "idp-incident-response",
@@ -2430,11 +2430,11 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-21T16:32:59.775Z"
+      "signed_at": "2026-05-21T17:02:34.797Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "qkKqW3EHhuVNY9gKPnQRU+CSezvT9b9LS3T4jx+YhNKaPydIUeUs5UsdPJDP+0Wo1ztFSCAcgQLrIYjLo2xVDw=="
+    "signature_base64": "nw33cErie1hRrgMQTFi2dn+VfjEXgeOiPlP6NM7YM72ZmCGuwTaNAx8WNqvRRaaS+gQPAZkkoqV3dunmPtR/Cw=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.13.47",
+  "version": "0.13.48",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:251fa007-6fc7-4558-bcc4-079d9d52c351",
+  "serialNumber": "urn:uuid:6a15616c-041c-4304-b686-e2087467ba07",
   "version": 1,
   "metadata": {
-    "timestamp": "2045-09-26T16:12:55.000Z",
+    "timestamp": "2082-05-26T09:01:32.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.47"
+        "version": "0.13.48"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.47",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.48",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.47",
+      "version": "0.13.48",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.47",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.48",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e97a2a2d55c00e8699dc0ba5d2b785e67d6de04ad7ee47707c5a6cf388b0952d"
+          "content": "37cb415548abd88f9732781eaebea63c5674a980599b89563862de57c96501e5"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.47"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.48"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f6e135db6cf29df6a3ab3efaa0e542579a5f0d96fd7ac06f3a8108bc6f65c132"
+          "content": "af6fb0211611b3121dcac81c324d118607ba75437c662935587aa05cd5557f23"
         },
         {
           "alg": "SHA3-512",
-          "content": "cc2f080a037f639d8694dc824592a1132755513f8b18ceb1041a283be27e9b50170122edacea4f9fb89828d3300342277a0bfbb363aa09964e26ed2c855433df"
+          "content": "ef952c6a67ed91d54375f571e74254ba0f9bff773da8330652808e5a2da2d39730b37cbc97380b3b56caf34cf3bb24b46f411b30fd24665bd4c88adecbe7bddf"
         }
       ]
     },
@@ -926,11 +926,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3844551461b3ee675627c08b03a99a0944a6783ee7f389eb2c2080af38878cc6"
+          "content": "ca9fe6c5613c36cd7b7b016863f76b6081284847d7a519b54354e8b428542eb4"
         },
         {
           "alg": "SHA3-512",
-          "content": "71612bf63aca6d387c3ad57f0b19c55486defd506de48e09b9f2c71b35bf2331cb7d9c0f7608e87954fe67256d9be150ab7eba4daaa4ee418e300a7e90133a77"
+          "content": "07658edb8e5d00b7fd2a67c0d3166074251521d7821210f8f28226fd02108c7b8a8980f0ff573b82350bef2afe2d5f53d02dbee8aae41be01db7f6fbf4ae6d19"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fdf7a4b18ea536c39aad7f7c4b7a95c0d00d0b284224527b540bcfa69e91f5b3"
+          "content": "abc9ed4ffe582d4f1ab32fe4d964ae29c59bba0ef8fcfab6c94097e8f82569a7"
         },
         {
           "alg": "SHA3-512",
-          "content": "166586d799505c55ea8802ba2b7c3520b07f8fd115326262a9e9fb70fd4fe8b8d31edf87d466532f66aa80c066400406a2622ec63dbb8dcc8182fce059ea2a16"
+          "content": "a110cb3d582c78e6fb0793371606d38a0ed62cd0d84b9d454878931113485a10a9729283205256365bb43f96d6daee5f727777c673d8701a0ca8da5c8b99b973"
         }
       ]
     },
@@ -1001,11 +1001,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2bcebd3e3c5329f4d18f46c2f659f0b6473a453105eb9aa87f0bb1b82203fac3"
+          "content": "3b9eb4b785889d4b1416d4bcf3e234bfdad635297d460cf64d934e257d139704"
         },
         {
           "alg": "SHA3-512",
-          "content": "03dbd138a13daf6b6ecd70a70bef555ef464e59a9fee4642fcce5d48053ec7955aec217db4b4b30241248166a51d7c0f23ef46975e4e5f3c0fb366abd9f70e8d"
+          "content": "11c1d492d7e15da9e5e3f5ffce72cb1e002970a5a23be650da8506a61447bf988bc2da8deea9300ffe2e81ceb4f39abf9d48ea2b2224712835675cbc39d1a4d2"
         }
       ]
     },
@@ -1061,11 +1061,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3488120e9c8715f090dcacdb91aa216522f64c4f450af96befbd515c7067d945"
+          "content": "33456838e7363a51fcd69738fc1aa286ee30e53ed7049d64d672ca1994008e71"
         },
         {
           "alg": "SHA3-512",
-          "content": "8a0412500d66216a58464d714f44935c113a117236b5ccb077b0243cc630d5954cf04d19b13d481a30093ca02cf450284911eb22a4c58cb5cffdc610a4ec0809"
+          "content": "f310033529ffa980515daa40c155b309a56263a05214723df5567db709e22372a5caa772ba1ff0a4cd4e4ff1e398ecf4f81f15c186729fbe7c3d0e123ba16be9"
         }
       ]
     },
@@ -1661,11 +1661,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e206a4bf8b7e84f787bdc8af0b7ca6d41d5a08c3f9a91d612f65e2f29c9c2269"
+          "content": "d609674fbe018083de83b4219c280889b616756dfdbf11d026cccf6594c80684"
         },
         {
           "alg": "SHA3-512",
-          "content": "c8121e1f6295182604b5a9b9b2f96eb6508cf5888984f9e77464fac89ad69d0fc93d121ba82891d994eb5ee11b10c6e8472b290c4c56ee4606c77fa40c7a5902"
+          "content": "8deb8d28d05acf57f48c0e635d4858ee4325d749e60abd23476e4e1591ca61ae01815a4f5ca22b2c17444fcfbb3f11b47b49e60cf37e0e7ed01b4cb6d2d0b563"
         }
       ]
     },