@blamejs/exceptd-skills 0.14.18 → 0.14.20

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.14.20 — 2026-05-27
+
+Skill content cleanup:
+- `sector-telecom` no longer labels its analysis-procedure subsections with the CLI verb names that were removed in 0.13.0 (`govern`, `direct`, `look`, etc.) — the section headings are neutral procedural language now. Its reference to `cred-stores` is annotated as a playbook (not a skill, matching the convention three sibling skills already use), and its `last_threat_review` date is quoted consistently with every other skill.
+- `threat-model-currency` no longer pins an outdated date literal in its body that contradicted the frontmatter — it references the frontmatter `last_threat_review` so the assertion can't desync.
+- `pqc-first` no longer leaks the engine's internal phase numbering ("Phase 5 analyze") into operator-facing output prose.
+- `email-security-anti-phishing` no longer cites an internal contributor rule by name in its threat-context narrative.
+
+## 0.14.19 — 2026-05-27
+
+Catalog data-integrity pass:
+- The AI supply-chain CVE families ShadowMQ (`CVE-2025-23254`, `CVE-2025-30165`, `CVE-2024-50050`, `CVE-2025-60455`) and the Triton authentication-bypass pair (`CVE-2026-24206`, `CVE-2026-24207`) now carry their ATLAS mapping (`AML.T0049`, Exploit Public-Facing Application) — matching the sibling entries in the same families that were already mapped.
+- The `active_exploitation: "theoretical"` status (a published PoC with no observed in-the-wild exploitation) is now an explicit entry in the RWEP active-exploitation ladder instead of falling through to the zero default.
+- The `framework-control-gaps` catalog's declared entry count is corrected (it read 184 while the catalog held 192) and a validator gate now fails if the declared count ever drifts from the actual count again.
+- The derived staleness index counts jurisdictions consistently with the README and the catalog-summaries index (GLOBAL included → 35), clearing a false "badge drift" staleness finding.
+
 ## 0.14.18 — 2026-05-27
 
 `precondition_check_source` now reports accurate provenance. A precondition supplied in the submission is tagged `submission` (it was always `merged`, because the value was internally copied into the run options), and a precondition the engine auto-detected from the host is tagged `auto` (it was mislabeled `submission`). A genuine programmatic override that supplies the same precondition both ways is still `merged`. Precondition gating behavior is unchanged.

package/data/_indexes/_meta.json

@@ -1,18 +1,18 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-28T01:29:15.827Z",
+  "generated_at": "2026-05-28T02:33:36.583Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "942085b9f004cd46ededef88160239a7ab66946592f89e8e974bd411c6d9a10a",
+    "manifest.json": "dc4cdb2fa56243e42a1989558997a236e564176fa6c8e5dcae9de9d2dad8399b",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
-    "data/cve-catalog.json": "3d451dda7ac0c7d57a4075ae4bafd3148c6184b35dc1bc59d8b81d1f2641e430",
+    "data/cve-catalog.json": "03d8071c7ae244ccda7611c3bc66a5581c21e790d158c2948c3001f55aa5aac9",
     "data/cwe-catalog.json": "0b82f1ba29024720dcafb66aaa6c7b59b535badd28dbac8a5c08737c5f25e9a9",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "46094ad9b9584f454daddd28f4c5d27faf0ea0510daafd38fb60bf9d30f6a305",
+    "data/framework-control-gaps.json": "563890a91e25079c1b36f61d8cdf21176fba3801168c4b4697cabae3437b33c1",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
     "data/zeroday-lessons.json": "258252b9bff1fc11b05b76e10b659c1195971884bd44c92af5fefe17a5ca9512",
@@ -25,10 +25,10 @@
     "skills/rag-pipeline-security/skill.md": "792c6f48a7ff06785c24258cac1714068feafefb3f8f05e6c62ddce2f2f9128d",
     "skills/ai-c2-detection/skill.md": "de83dc284dc4f85a8a383c0b715ec7b9ea127ec49c3227bf4c72344bad4008ed",
     "skills/policy-exception-gen/skill.md": "238074319b57399c75d76439ef1ff67153b5a3207adf1556f3ca1e68cfe7cfaa",
-    "skills/threat-model-currency/skill.md": "4295c0efe31dcbec1a7bc96b8ce05d41414d918cbfc7fb7dffb2be7e4d873ae3",
+    "skills/threat-model-currency/skill.md": "637861b4dcd2cb608c08c5aa62a8ef73efc976584f901e612c73cf53b3559422",
     "skills/global-grc/skill.md": "57ca729034e9d33c527d869c1c4aa82fe37e496878a3cbcd9e5043cb62b7105d",
     "skills/zeroday-gap-learn/skill.md": "d8872a4f5e5e927ae087e8319996ec3b9e010aa23fca32248c0909051032db48",
-    "skills/pqc-first/skill.md": "3b41b59eb4e8480b691ff17185f42b9fbfd7665e369fc210feba496688cc77aa",
+    "skills/pqc-first/skill.md": "8b77569100d10201044d63a69cbc83c9cfe6d2c3568884aa900ef0eb72ba99c3",
     "skills/skill-update-loop/skill.md": "f7cd18df293b90c0d2afb6ba8b87664419becea6b63221f03efaf09c69586025",
     "skills/security-maturity-tiers/skill.md": "2e46c9332a5a6190d4605ba7bc653410659be19fab50c78c0a6732f84ebdb300",
     "skills/researcher/skill.md": "dc8ceab8f69af370abb1165ed14ead6f3e9d236a8f703165eba52014ebfd43ab",
@@ -47,14 +47,14 @@
     "skills/sector-financial/skill.md": "ad8f207a6ce255aad9c33ea9a3009fb707c0f59be9df565fe68679654488bb6e",
     "skills/sector-federal-government/skill.md": "7b513d2365390fdb546c0f266139a21ae247339f0e346695fcbc92ba3d7fa69a",
     "skills/sector-energy/skill.md": "9aed96c78e8aaeafd3b7564d26311d625b4466a1e3822281721bdbfcfca058ec",
-    "skills/sector-telecom/skill.md": "59193e39c2fd73fdd7fede38a956bc730bbe4b712d7d6020788bb4d85f001ad8",
+    "skills/sector-telecom/skill.md": "2f336a0b79cd28a3353ec0a72ce0469ac57305345d652247e7cb368f79ec8d4f",
     "skills/api-security/skill.md": "120ed75df17db4dfc4746b9d5bd6efd33786bbf68cb840670aeed0be505866f9",
     "skills/cloud-security/skill.md": "425be2c6e3563f011d0280bf03268425bf60923ae3d02eafbf1b56d04f0b7ffe",
     "skills/container-runtime-security/skill.md": "f22bf5a305f8a33884d49d9bfb25fa2bd00c4b3d0dc490bd12f20a7721683b4a",
     "skills/mlops-security/skill.md": "498549ddc9d870cb8d6a28a4d79b8d7058d5eed832d7c266c281084f4371ce46",
     "skills/incident-response-playbook/skill.md": "9c219de36c7d702dff8504a25e2f1b07459716ea2ed02f49d751f91dbeca1b01",
     "skills/ransomware-response/skill.md": "471b714c42717d43f81b2b582cd8e89ca8d3140de2ddc06cce15f012a0e19be1",
-    "skills/email-security-anti-phishing/skill.md": "250f266908f51f99a4cb3aec0d5dacfcf91fac9f3d95e5a117429a40ed2ff45a",
+    "skills/email-security-anti-phishing/skill.md": "da0b937350e538b55db8daa1f50047d9f4e889e6b89b040dcecfb71feecd63d7",
     "skills/age-gates-child-safety/skill.md": "639b79a2724415afe9e4469202f806e5bec022c0946c9496d4e17ed73aabbe21",
     "skills/cloud-iam-incident/skill.md": "5ec3800a0049b2123aff67bfab4ff28491a86d2daeb712283e5e88b10c3d5d7b",
     "skills/idp-incident-response/skill.md": "e67a2576e7f1c3bf89f499f5c977bc470ef29e8b3e3e45f4cb5bd45a82674282"
@@ -78,7 +78,7 @@
     "handoff_dag_nodes": 42,
     "summary_cards": 42,
     "section_offsets_skills": 42,
-    "token_budget_total_approx": 418252,
+    "token_budget_total_approx": 418226,
     "recipes": 8,
     "jurisdiction_clocks": 29,
     "did_ladders": 8,
@@ -87,7 +87,7 @@
     "frequency_fields": 7,
     "activity_feed_events": 54,
     "catalog_summaries": 11,
-    "stale_content_findings": 1
+    "stale_content_findings": 0
   },
   "invalidation_note": "If any source file in source_hashes has a different SHA-256 than recorded here, the indexes are stale. Re-run `npm run build-indexes`."
 }

package/data/_indexes/section-offsets.json

@@ -991,7 +991,7 @@
     },
     "threat-model-currency": {
       "path": "skills/threat-model-currency/skill.md",
-      "total_bytes": 33306,
+      "total_bytes": 33310,
       "total_lines": 448,
       "frontmatter": {
         "line_start": 1,
@@ -1059,16 +1059,16 @@
           "normalized_name": "exploit-availability-matrix",
           "line": 289,
           "byte_start": 20815,
-          "byte_end": 23164,
-          "bytes": 2349,
+          "byte_end": 23168,
+          "bytes": 2353,
           "h3_count": 0
         },
         {
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 308,
-          "byte_start": 23164,
-          "byte_end": 24732,
+          "byte_start": 23168,
+          "byte_end": 24736,
           "bytes": 1568,
           "h3_count": 0
         },
@@ -1076,8 +1076,8 @@
           "name": "Scoring",
           "normalized_name": "scoring",
           "line": 324,
-          "byte_start": 24732,
-          "byte_end": 25274,
+          "byte_start": 24736,
+          "byte_end": 25278,
           "bytes": 542,
           "h3_count": 0
         },
@@ -1085,8 +1085,8 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 343,
-          "byte_start": 25274,
-          "byte_end": 26204,
+          "byte_start": 25278,
+          "byte_end": 26208,
           "bytes": 930,
           "h3_count": 4
         },
@@ -1094,8 +1094,8 @@
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 375,
-          "byte_start": 26204,
-          "byte_end": 28177,
+          "byte_start": 26208,
+          "byte_end": 28181,
           "bytes": 1973,
           "h3_count": 4
         },
@@ -1103,8 +1103,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 417,
-          "byte_start": 28177,
-          "byte_end": 33306,
+          "byte_start": 28181,
+          "byte_end": 33310,
           "bytes": 5129,
           "h3_count": 0
         }
@@ -1327,7 +1327,7 @@
     },
     "pqc-first": {
       "path": "skills/pqc-first/skill.md",
-      "total_bytes": 37988,
+      "total_bytes": 38002,
       "total_lines": 572,
       "frontmatter": {
         "line_start": 1,
@@ -1449,16 +1449,16 @@
           "normalized_name": "output-format",
           "line": 515,
           "byte_start": 31983,
-          "byte_end": 33460,
-          "bytes": 1477,
+          "byte_end": 33474,
+          "bytes": 1491,
           "h3_count": 6
         },
         {
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 548,
-          "byte_start": 33460,
-          "byte_end": 37328,
+          "byte_start": 33474,
+          "byte_end": 37342,
           "bytes": 3868,
           "h3_count": 0
         },
@@ -1466,8 +1466,8 @@
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 569,
-          "byte_start": 37328,
-          "byte_end": 37988,
+          "byte_start": 37342,
+          "byte_end": 38002,
           "bytes": 660,
           "h3_count": 0
         }
@@ -3230,21 +3230,21 @@
     },
     "sector-telecom": {
       "path": "skills/sector-telecom/skill.md",
-      "total_bytes": 20862,
+      "total_bytes": 20754,
       "total_lines": 257,
       "frontmatter": {
         "line_start": 1,
         "line_end": 71,
         "byte_start": 0,
-        "byte_end": 1989
+        "byte_end": 1991
       },
       "sections": [
         {
           "name": "Threat Context (mid-2026)",
           "normalized_name": "threat-context",
           "line": 73,
-          "byte_start": 1990,
-          "byte_end": 5178,
+          "byte_start": 1992,
+          "byte_end": 5180,
           "bytes": 3188,
           "h3_count": 0
         },
@@ -3252,8 +3252,8 @@
           "name": "Framework Lag Declaration",
           "normalized_name": "framework-lag-declaration",
           "line": 87,
-          "byte_start": 5178,
-          "byte_end": 7260,
+          "byte_start": 5180,
+          "byte_end": 7262,
           "bytes": 2082,
           "h3_count": 0
         },
@@ -3261,8 +3261,8 @@
           "name": "TTP Mapping",
           "normalized_name": "ttp-mapping",
           "line": 91,
-          "byte_start": 7260,
-          "byte_end": 8694,
+          "byte_start": 7262,
+          "byte_end": 8696,
           "bytes": 1434,
           "h3_count": 0
         },
@@ -3270,8 +3270,8 @@
           "name": "Exploit Availability Matrix",
           "normalized_name": "exploit-availability-matrix",
           "line": 105,
-          "byte_start": 8694,
-          "byte_end": 9888,
+          "byte_start": 8696,
+          "byte_end": 9890,
           "bytes": 1194,
           "h3_count": 0
         },
@@ -3279,26 +3279,26 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 118,
-          "byte_start": 9888,
-          "byte_end": 15717,
-          "bytes": 5829,
+          "byte_start": 9890,
+          "byte_end": 15596,
+          "bytes": 5706,
           "h3_count": 7
         },
         {
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 180,
-          "byte_start": 15717,
-          "byte_end": 17232,
-          "bytes": 1515,
+          "byte_start": 15596,
+          "byte_end": 17087,
+          "bytes": 1491,
           "h3_count": 0
         },
         {
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 228,
-          "byte_start": 17232,
-          "byte_end": 19439,
+          "byte_start": 17087,
+          "byte_end": 19294,
           "bytes": 2207,
           "h3_count": 0
         },
@@ -3306,8 +3306,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 240,
-          "byte_start": 19439,
-          "byte_end": 20190,
+          "byte_start": 19294,
+          "byte_end": 20045,
           "bytes": 751,
           "h3_count": 0
         },
@@ -3315,9 +3315,9 @@
           "name": "Hand-Off / Related Skills",
           "normalized_name": "hand-off",
           "line": 250,
-          "byte_start": 20190,
-          "byte_end": 20862,
-          "bytes": 672,
+          "byte_start": 20045,
+          "byte_end": 20754,
+          "bytes": 709,
           "h3_count": 0
         }
       ]
@@ -3888,7 +3888,7 @@
     },
     "email-security-anti-phishing": {
       "path": "skills/email-security-anti-phishing/skill.md",
-      "total_bytes": 29232,
+      "total_bytes": 29207,
       "total_lines": 219,
       "frontmatter": {
         "line_start": 1,
@@ -3902,16 +3902,16 @@
           "normalized_name": "threat-context",
           "line": 62,
           "byte_start": 1381,
-          "byte_end": 5811,
-          "bytes": 4430,
+          "byte_end": 5786,
+          "bytes": 4405,
           "h3_count": 0
         },
         {
           "name": "Framework Lag Declaration",
           "normalized_name": "framework-lag-declaration",
           "line": 80,
-          "byte_start": 5811,
-          "byte_end": 9893,
+          "byte_start": 5786,
+          "byte_end": 9868,
           "bytes": 4082,
           "h3_count": 0
         },
@@ -3919,8 +3919,8 @@
           "name": "TTP Mapping",
           "normalized_name": "ttp-mapping",
           "line": 102,
-          "byte_start": 9893,
-          "byte_end": 11985,
+          "byte_start": 9868,
+          "byte_end": 11960,
           "bytes": 2092,
           "h3_count": 0
         },
@@ -3928,8 +3928,8 @@
           "name": "Exploit Availability Matrix",
           "normalized_name": "exploit-availability-matrix",
           "line": 116,
-          "byte_start": 11985,
-          "byte_end": 13825,
+          "byte_start": 11960,
+          "byte_end": 13800,
           "bytes": 1840,
           "h3_count": 0
         },
@@ -3937,8 +3937,8 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 135,
-          "byte_start": 13825,
-          "byte_end": 21267,
+          "byte_start": 13800,
+          "byte_end": 21242,
           "bytes": 7442,
           "h3_count": 0
         },
@@ -3946,8 +3946,8 @@
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 164,
-          "byte_start": 21267,
-          "byte_end": 23088,
+          "byte_start": 21242,
+          "byte_end": 23063,
           "bytes": 1821,
           "h3_count": 0
         },
@@ -3955,8 +3955,8 @@
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 181,
-          "byte_start": 23088,
-          "byte_end": 24890,
+          "byte_start": 23063,
+          "byte_end": 24865,
           "bytes": 1802,
           "h3_count": 0
         },
@@ -3964,8 +3964,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 192,
-          "byte_start": 24890,
-          "byte_end": 28097,
+          "byte_start": 24865,
+          "byte_end": 28072,
           "bytes": 3207,
           "h3_count": 0
         },
@@ -3973,8 +3973,8 @@
           "name": "Hand-Off / Related Skills",
           "normalized_name": "hand-off",
           "line": 207,
-          "byte_start": 28097,
-          "byte_end": 29232,
+          "byte_start": 28072,
+          "byte_end": 29207,
           "bytes": 1135,
           "h3_count": 0
         }

package/data/_indexes/stale-content.json

@@ -3,19 +3,12 @@
     "schema_version": "1.0.0",
     "reference_date": "2026-05-15",
     "note": "Stale-content snapshot derived from audit-cross-skill checks. Re-runs of build-indexes against the same inputs produce byte-identical output (reference_date is manifest.threat_review_date, not 'now'). audit-cross-skill.js remains the canonical interactive audit.",
-    "finding_count": 1,
+    "finding_count": 0,
     "by_severity": {
       "high": 0,
-      "medium": 1,
+      "medium": 0,
       "low": 0
     }
   },
-  "findings": [
-    {
-      "severity": "medium",
-      "category": "badge_drift",
-      "artifact": "README.md",
-      "detail": "jurisdictions badge shows 35, live count is 34"
-    }
-  ]
+  "findings": []
 }

package/data/_indexes/summary-cards.json

@@ -469,7 +469,7 @@
     "pqc-first": {
       "description": "Post-quantum cryptography first mentality — hard version gates (OpenSSL 3.5+), algorithm sunset tracking, HNDL assessment, loopback learning for NIST/IETF evolution",
       "threat_context_excerpt": "The post-quantum migration is not a planning exercise. It is an operational deadline against an adversary that is already collecting ciphertext.",
-      "produces": "The skill produces a structured PQC Readiness Assessment that scores the org's post-quantum migration posture against the NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204, SLH-DSA / FIPS 205), CNSA 2.0, and the BSI / ANSSI / NCSC migration guidance. The shape below is consumed downstream by `crypto` playbook runs (which feed the assessment into Phase 5 analyze), by `framework-gap-analysis` (for SC-8 / SC-13 / A.8.24 / A.10 lag declarations), and by `compliance-theater` (which compares the harvest-now-decrypt-later exposure against the org's data-classification claims). Preserve the per ...",
+      "produces": "The skill produces a structured PQC Readiness Assessment that scores the org's post-quantum migration posture against the NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204, SLH-DSA / FIPS 205), CNSA 2.0, and the BSI / ANSSI / NCSC migration guidance. The shape below is consumed downstream by `crypto` playbook runs (which feed the assessment into the analysis correlation step), by `framework-gap-analysis` (for SC-8 / SC-13 / A.8.24 / A.10 lag declarations), and by `compliance-theater` (which compares the harvest-now-decrypt-later exposure against the org's data-classification claims). Pr ...",
       "key_xrefs": {
         "cwe_refs": [
           "CWE-327"
@@ -1354,7 +1354,7 @@
     "sector-telecom": {
       "description": "Telecom and 5G security for mid-2026 — Salt Typhoon, Volt Typhoon, CALEA / IPA-LI gateway compromise, signaling-protocol abuse (SS7 / Diameter / GTP), 5G N6 / N9 isolation, gNB / DU / CU integrity, OEM-equipment supply-chain compromise, AI-RAN / O-RAN security",
       "threat_context_excerpt": "**Salt Typhoon (China nation-state; PRC Ministry of State Security nexus).** The 2024–2026 campaign — disclosed in successive Five Eyes joint advisories from October 2024 onward (CISA / NSA / FBI joint product reissued through 2025–2026) — compromised at least nine US carriers (publicly named: AT&T, Verizon, T-Mobile US, Lumen, Charter, Cox, Windstream, Consolidated, plus undisclosed others) and extended to AU / CA / NZ / UK Tier-1 carriers. Threat actor TTPs map to T1199 (Trusted Relationship) via OEM vendor supply chain, T1098 (Account Manipulation) for persistent admin access on NMS, and ...",
-      "produces": "The investigation evidence bundle returned by phase 5 + 6 has this shape:\n\n```json\n{\n  \"session_id\": \"telecom-<iso>\",\n  \"playbook_id\": \"sector-telecom\",\n  \"classification\": \"detected | clean | not_detected | inconclusive\",\n  \"evidence_hash\": \"sha256:...\",\n  \"telecom_specific_findings\": {\n    \"li_gateway_audit\": {\n      \"anomalous_activations\": 0,\n      \"activations_outside_ticket\": 0,\n      \"outbound_tunnel_to_non_allowlist_ip\": 0\n    },\n    \"gnb_attestation_state\": {\n      \"expected_hashes_compared\": 0,\n      \"drifted_basestations\": [],\n      \"downgrade_events\": 0\n    },\n    \"signaling_anomal ...",
+      "produces": "The investigation evidence bundle has this shape:\n\n```json\n{\n  \"session_id\": \"telecom-<iso>\",\n  \"playbook_id\": \"sector-telecom\",\n  \"classification\": \"detected | clean | not_detected | inconclusive\",\n  \"evidence_hash\": \"sha256:...\",\n  \"telecom_specific_findings\": {\n    \"li_gateway_audit\": {\n      \"anomalous_activations\": 0,\n      \"activations_outside_ticket\": 0,\n      \"outbound_tunnel_to_non_allowlist_ip\": 0\n    },\n    \"gnb_attestation_state\": {\n      \"expected_hashes_compared\": 0,\n      \"drifted_basestations\": [],\n      \"downgrade_events\": 0\n    },\n    \"signaling_anomaly_count\": {\n      \"ss7_p ...",
       "key_xrefs": {
         "cwe_refs": [
           "CWE-287",

package/data/_indexes/token-budget.json

@@ -3,8 +3,8 @@
     "schema_version": "1.0.0",
     "tokenizer_note": "Character-density approximation: 1 token ≈ 4 chars. This is the canonical rule-of-thumb for OpenAI tokenizers on English+technical text. Claude's tokenizer is typically more efficient on prose; treat this as an upper-bound budget for both. Consumers with stricter precision needs should re-tokenize with their own tokenizer.",
     "approx_chars_per_token": 4,
-    "total_chars": 1672973,
-    "total_approx_tokens": 418252,
+    "total_chars": 1672872,
+    "total_approx_tokens": 418226,
     "skill_count": 42
   },
   "skills": {
@@ -575,10 +575,10 @@
     },
     "threat-model-currency": {
       "path": "skills/threat-model-currency/skill.md",
-      "bytes": 33306,
-      "chars": 33120,
+      "bytes": 33310,
+      "chars": 33124,
       "lines": 448,
-      "approx_tokens": 8280,
+      "approx_tokens": 8281,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -612,9 +612,9 @@
           "approx_tokens": 765
         },
         "exploit-availability-matrix": {
-          "bytes": 2349,
-          "chars": 2331,
-          "approx_tokens": 583
+          "bytes": 2353,
+          "chars": 2335,
+          "approx_tokens": 584
         },
         "compliance-theater-check": {
           "bytes": 1568,
@@ -770,10 +770,10 @@
     },
     "pqc-first": {
       "path": "skills/pqc-first/skill.md",
-      "bytes": 37988,
-      "chars": 37818,
+      "bytes": 38002,
+      "chars": 37832,
       "lines": 572,
-      "approx_tokens": 9455,
+      "approx_tokens": 9458,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -837,9 +837,9 @@
           "approx_tokens": 375
         },
         "output-format": {
-          "bytes": 1477,
-          "chars": 1471,
-          "approx_tokens": 368
+          "bytes": 1491,
+          "chars": 1485,
+          "approx_tokens": 371
         },
         "defensive-countermeasure-mapping": {
           "bytes": 3868,
@@ -1880,10 +1880,10 @@
     },
     "sector-telecom": {
       "path": "skills/sector-telecom/skill.md",
-      "bytes": 20862,
-      "chars": 20762,
+      "bytes": 20754,
+      "chars": 20668,
       "lines": 257,
-      "approx_tokens": 5191,
+      "approx_tokens": 5167,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -1907,14 +1907,14 @@
           "approx_tokens": 299
         },
         "analysis-procedure": {
-          "bytes": 5829,
-          "chars": 5773,
-          "approx_tokens": 1443
+          "bytes": 5706,
+          "chars": 5664,
+          "approx_tokens": 1416
         },
         "output-format": {
-          "bytes": 1515,
-          "chars": 1515,
-          "approx_tokens": 379
+          "bytes": 1491,
+          "chars": 1491,
+          "approx_tokens": 373
         },
         "compliance-theater-check": {
           "bytes": 2207,
@@ -1927,9 +1927,9 @@
           "approx_tokens": 188
         },
         "hand-off": {
-          "bytes": 672,
-          "chars": 662,
-          "approx_tokens": 166
+          "bytes": 709,
+          "chars": 699,
+          "approx_tokens": 175
         }
       }
     },
@@ -2265,16 +2265,16 @@
     },
     "email-security-anti-phishing": {
       "path": "skills/email-security-anti-phishing/skill.md",
-      "bytes": 29232,
-      "chars": 29116,
+      "bytes": 29207,
+      "chars": 29091,
       "lines": 219,
-      "approx_tokens": 7279,
+      "approx_tokens": 7273,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
-          "bytes": 4430,
-          "chars": 4414,
-          "approx_tokens": 1104
+          "bytes": 4405,
+          "chars": 4389,
+          "approx_tokens": 1097
         },
         "framework-lag-declaration": {
           "bytes": 4082,