@blamejs/exceptd-skills 0.13.60 → 0.13.63

package/data/_indexes/stale-content.json

@@ -3,10 +3,10 @@
     "schema_version": "1.0.0",
     "reference_date": "2026-05-15",
     "note": "Stale-content snapshot derived from audit-cross-skill checks. Re-runs of build-indexes against the same inputs produce byte-identical output (reference_date is manifest.threat_review_date, not 'now'). audit-cross-skill.js remains the canonical interactive audit.",
-    "finding_count": 2,
+    "finding_count": 1,
     "by_severity": {
       "high": 0,
-      "medium": 2,
+      "medium": 1,
       "low": 0
     }
   },
@@ -16,12 +16,6 @@
       "category": "badge_drift",
       "artifact": "README.md",
       "detail": "jurisdictions badge shows 35, live count is 34"
-    },
-    {
-      "severity": "medium",
-      "category": "researcher_claim_drift",
-      "artifact": "skills/researcher/skill.md",
-      "detail": "claims 37 specialized skills downstream; live count is 41"
     }
   ]
 }

package/data/_indexes/token-budget.json

@@ -3,8 +3,8 @@
     "schema_version": "1.0.0",
     "tokenizer_note": "Character-density approximation: 1 token ≈ 4 chars. This is the canonical rule-of-thumb for OpenAI tokenizers on English+technical text. Claude's tokenizer is typically more efficient on prose; treat this as an upper-bound budget for both. Consumers with stricter precision needs should re-tokenize with their own tokenizer.",
     "approx_chars_per_token": 4,
-    "total_chars": 1667894,
-    "total_approx_tokens": 416979,
+    "total_chars": 1671867,
+    "total_approx_tokens": 417973,
     "skill_count": 42
   },
   "skills": {
@@ -175,10 +175,10 @@
     },
     "framework-gap-analysis": {
       "path": "skills/framework-gap-analysis/skill.md",
-      "bytes": 32011,
-      "chars": 31903,
+      "bytes": 32006,
+      "chars": 31898,
       "lines": 406,
-      "approx_tokens": 7976,
+      "approx_tokens": 7975,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -192,9 +192,9 @@
           "approx_tokens": 818
         },
         "ttp-mapping": {
-          "bytes": 2089,
-          "chars": 2087,
-          "approx_tokens": 522
+          "bytes": 2084,
+          "chars": 2082,
+          "approx_tokens": 521
         },
         "exploit-availability-matrix": {
           "bytes": 1536,
@@ -235,10 +235,10 @@
     },
     "compliance-theater": {
       "path": "skills/compliance-theater/skill.md",
-      "bytes": 38664,
-      "chars": 38572,
+      "bytes": 38659,
+      "chars": 38567,
       "lines": 409,
-      "approx_tokens": 9643,
+      "approx_tokens": 9642,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -257,9 +257,9 @@
           "approx_tokens": 2025
         },
         "ttp-mapping": {
-          "bytes": 2210,
-          "chars": 2194,
-          "approx_tokens": 549
+          "bytes": 2205,
+          "chars": 2189,
+          "approx_tokens": 547
         },
         "exploit-availability-matrix": {
           "bytes": 2006,
@@ -515,10 +515,10 @@
     },
     "policy-exception-gen": {
       "path": "skills/policy-exception-gen/skill.md",
-      "bytes": 36837,
-      "chars": 36725,
+      "bytes": 36832,
+      "chars": 36720,
       "lines": 479,
-      "approx_tokens": 9181,
+      "approx_tokens": 9180,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -537,9 +537,9 @@
           "approx_tokens": 1363
         },
         "ttp-mapping": {
-          "bytes": 1948,
-          "chars": 1934,
-          "approx_tokens": 484
+          "bytes": 1943,
+          "chars": 1929,
+          "approx_tokens": 482
         },
         "exploit-availability-matrix": {
           "bytes": 2024,
@@ -770,10 +770,10 @@
     },
     "pqc-first": {
       "path": "skills/pqc-first/skill.md",
-      "bytes": 34118,
-      "chars": 33970,
-      "lines": 551,
-      "approx_tokens": 8493,
+      "bytes": 37988,
+      "chars": 37818,
+      "lines": 572,
+      "approx_tokens": 9455,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -787,9 +787,9 @@
           "approx_tokens": 1976
         },
         "ttp-mapping": {
-          "bytes": 2120,
-          "chars": 2108,
-          "approx_tokens": 527
+          "bytes": 2122,
+          "chars": 2110,
+          "approx_tokens": 528
         },
         "exploit-availability-matrix": {
           "bytes": 2472,
@@ -841,6 +841,11 @@
           "chars": 1471,
           "approx_tokens": 368
         },
+        "defensive-countermeasure-mapping": {
+          "bytes": 3868,
+          "chars": 3846,
+          "approx_tokens": 962
+        },
         "compliance-theater-check": {
           "bytes": 660,
           "chars": 660,
@@ -850,10 +855,10 @@
     },
     "skill-update-loop": {
       "path": "skills/skill-update-loop/skill.md",
-      "bytes": 47841,
-      "chars": 47707,
+      "bytes": 47833,
+      "chars": 47699,
       "lines": 522,
-      "approx_tokens": 11927,
+      "approx_tokens": 11925,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -862,9 +867,9 @@
           "approx_tokens": 113
         },
         "threat-context": {
-          "bytes": 1548,
-          "chars": 1542,
-          "approx_tokens": 386
+          "bytes": 1543,
+          "chars": 1537,
+          "approx_tokens": 384
         },
         "ttp-mapping": {
           "bytes": 1092,
@@ -907,9 +912,9 @@
           "approx_tokens": 699
         },
         "exploit-availability-matrix": {
-          "bytes": 2730,
-          "chars": 2724,
-          "approx_tokens": 681
+          "bytes": 2727,
+          "chars": 2721,
+          "approx_tokens": 680
         },
         "compliance-theater-check": {
           "bytes": 1677,
@@ -1065,10 +1070,10 @@
     },
     "attack-surface-pentest": {
       "path": "skills/attack-surface-pentest/skill.md",
-      "bytes": 33284,
-      "chars": 33141,
+      "bytes": 33290,
+      "chars": 33147,
       "lines": 388,
-      "approx_tokens": 8285,
+      "approx_tokens": 8287,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -1077,14 +1082,14 @@
           "approx_tokens": 1173
         },
         "framework-lag-declaration": {
-          "bytes": 4561,
-          "chars": 4551,
+          "bytes": 4563,
+          "chars": 4553,
           "approx_tokens": 1138
         },
         "ttp-mapping": {
-          "bytes": 2231,
-          "chars": 2210,
-          "approx_tokens": 553
+          "bytes": 2235,
+          "chars": 2214,
+          "approx_tokens": 554
         },
         "exploit-availability-matrix": {
           "bytes": 2455,
@@ -2095,10 +2100,10 @@
     },
     "mlops-security": {
       "path": "skills/mlops-security/skill.md",
-      "bytes": 46355,
-      "chars": 46061,
+      "bytes": 46350,
+      "chars": 46056,
       "lines": 332,
-      "approx_tokens": 11515,
+      "approx_tokens": 11514,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -2150,10 +2155,10 @@
     },
     "incident-response-playbook": {
       "path": "skills/incident-response-playbook/skill.md",
-      "bytes": 63158,
-      "chars": 62906,
+      "bytes": 63307,
+      "chars": 63055,
       "lines": 549,
-      "approx_tokens": 15727,
+      "approx_tokens": 15764,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -2167,9 +2172,9 @@
           "approx_tokens": 2541
         },
         "ttp-mapping": {
-          "bytes": 4845,
-          "chars": 4837,
-          "approx_tokens": 1209
+          "bytes": 4992,
+          "chars": 4984,
+          "approx_tokens": 1246
         },
         "exploit-availability-matrix": {
           "bytes": 3811,
@@ -2205,10 +2210,10 @@
     },
     "ransomware-response": {
       "path": "skills/ransomware-response/skill.md",
-      "bytes": 48454,
-      "chars": 48274,
+      "bytes": 48452,
+      "chars": 48272,
       "lines": 371,
-      "approx_tokens": 12069,
+      "approx_tokens": 12068,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -2222,9 +2227,9 @@
           "approx_tokens": 1692
         },
         "ttp-mapping": {
-          "bytes": 2219,
-          "chars": 2219,
-          "approx_tokens": 555
+          "bytes": 2217,
+          "chars": 2217,
+          "approx_tokens": 554
         },
         "exploit-availability-matrix": {
           "bytes": 2592,

package/data/atlas-ttps.json

@@ -512,7 +512,7 @@
       "Multiple production AI assistant prompt injection incidents 2025-2026"
     ],
     "framework_gap": true,
-    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v5.1.0 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
+    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v5.6.0 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
     "controls_that_partially_help": [
       "NIST-800-53-AC-2",
       "ISO-27001-2022-A.8.28"

package/data/framework-control-gaps.json

@@ -365,7 +365,7 @@
       "Treating 'Top 25 addressed' as a compliance signal creates a compliance-theatre risk for organisations with significant AI surface",
       "No cross-walk requirement to ATLAS TTPs — CWE addresses weaknesses; ATLAS addresses adversary techniques. Both are needed for AI coverage"
     ],
-    "real_requirement": "Programmes that claim 'Top 25 addressed' as compliance evidence must additionally: (1) enumerate AI-relevant CWEs outside the Top 25 (CWE-1426 Improper Output Validation, CWE-1039 Inadequate Detection of Adversarial Input, CWE-1230 Exposure of Sensitive Info Through Metadata) with explicit treatment, (2) cross-walk to ATLAS v5.1.0 TTPs for adversarial coverage, (3) re-baseline against the next-published Top 25 with delta analysis. Aligns with EU CRA Annex I, UK NCSC, AU ISM, ISO 27001 A.8.28.",
+    "real_requirement": "Programmes that claim 'Top 25 addressed' as compliance evidence must additionally: (1) enumerate AI-relevant CWEs outside the Top 25 (CWE-1426 Improper Output Validation, CWE-1039 Inadequate Detection of Adversarial Input, CWE-1230 Exposure of Sensitive Info Through Metadata) with explicit treatment, (2) cross-walk to ATLAS v5.6.0 TTPs for adversarial coverage, (3) re-baseline against the next-published Top 25 with delta analysis. Aligns with EU CRA Annex I, UK NCSC, AU ISM, ISO 27001 A.8.28.",
     "status": "open",
     "opened_date": "2026-05-11",
     "evidence_cves": [],
@@ -1586,7 +1586,7 @@
       "LLM-API-as-C2 (SesameOp pattern, ATLAS AML.T0096) is not in the clause 6.1.2 example threat list — risk register templates omit it",
       "No requirement to link AI risk register entries to specific TTP IDs (ATLAS / ATT&CK) — risks remain framework-internal abstractions"
     ],
-    "real_requirement": "Clause 6.1.2 risk registers must (1) ingest ATLAS v5.1.0 TTPs as enumerated AI-specific threat sources, (2) cross-reference jurisdictional obligations (EU AI Act Annex III, NIS2 Art. 21, DORA Art. 28, UK CAF B4, AU ISM AI annex, ISO 27001:2022 A.5.7), (3) include AI-API-as-C2 and prompt-injection-as-RCE as named scenarios, (4) be re-run on threat-intel triggers, not only on calendar cycles.",
+    "real_requirement": "Clause 6.1.2 risk registers must (1) ingest ATLAS v5.6.0 TTPs as enumerated AI-specific threat sources, (2) cross-reference jurisdictional obligations (EU AI Act Annex III, NIS2 Art. 21, DORA Art. 28, UK CAF B4, AU ISM AI annex, ISO 27001:2022 A.5.7), (3) include AI-API-as-C2 and prompt-injection-as-RCE as named scenarios, (4) be re-run on threat-intel triggers, not only on calendar cycles.",
     "status": "open",
     "opened_date": "2026-05-11",
     "evidence_cves": [],
@@ -6199,7 +6199,7 @@
     }
   },
   "ATLAS-AML.T0048": {
-    "framework": "MITRE ATLAS v5.1.0",
+    "framework": "MITRE ATLAS v5.6.0",
     "control_id": "AML.T0048",
     "control_name": "External Harms — ML Supply Chain Compromise (bundled-codec / inference-server class)",
     "designed_for": "ATLAS AML.T0048 catalogues external harms from ML supply-chain compromise, including malicious model weights, poisoned training data, and compromised ML libraries. The technique-level guidance covers detection and mitigation at the model-artifact and library-consumption layer.",