@blamejs/exceptd-skills 0.14.21 → 0.14.23

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.14.23 — 2026-05-27
+
+`crypto-codebase` collector accuracy:
+- `hardcoded-key-material` now fires on private-key blocks only. A public key or certificate embedded in source (a pinned release-signing public key, a BIMI trust anchor, an autoupdate verification key) is published by design and is no longer flagged as leaked key material — it was inflating crypto risk on repositories handling keys correctly.
+- `vendored-pqc-no-provenance` now recognizes `MANIFEST.json` (the common vendor-tree provenance record holding upstream version, source, and license) as provenance, alongside the existing markers. A vendored post-quantum tree documented this way no longer reports as provenance-less.
+
+`containers` collector now resolves `ARG`-interpolated base references. A digest pinned through an ARG default (`ARG BASE=image@sha256:…` then `FROM ${BASE}`) is recognized as digest-pinned, and a base reference whose interpolation can't be resolved from an in-file `ARG` default no longer raises `dockerfile-from-latest` — an unknown reference can't be proven to float on `:latest`. A resolved-but-undigested tag still fires `dockerfile-no-digest-pin`, and a literal unpinned or `:latest` image still fires.
+
+## 0.14.22 — 2026-05-27
+
+The `containers` collector no longer false-flags multi-stage build-stage references. A `FROM <stage>` line that refers to an earlier `FROM <image> AS <stage>` is an internal build-stage reference, not a registry image, so it needs no tag or digest — but it was raising `dockerfile-from-latest` and `dockerfile-no-digest-pin` on every normal multi-stage Dockerfile. Stage references are now exempt; real registry images (unpinned or `:latest`) still fire.
+
 ## 0.14.21 — 2026-05-27
 
 The survey/meta skills `framework-gap-analysis`, `threat-modeling-methodology`, and `global-grc` now document why their `atlas_refs` / `attack_refs` are intentionally empty (they correlate or teach across other skills' technique mappings rather than owning a native TTP set), matching the "Frontmatter Scope" note the other meta skills already carry. A reader inspecting the frontmatter alone no longer sees zero technique coverage and assumes the skill maps to nothing.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-28T04:10:43.581Z",
+  "generated_at": "2026-05-28T06:42:55.839Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "238a94feb0967eb74eedd99084ecf49ee6a20cbf04e9f704a6a3526fdddb6363",
+    "manifest.json": "05121fbd70037a8d62a64593344b0b4dd750ca2c6f8dcce238de00cd0b7a513e",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
     "data/cve-catalog.json": "03d8071c7ae244ccda7611c3bc66a5581c21e790d158c2948c3001f55aa5aac9",

package/lib/collectors/containers.js

@@ -120,30 +120,80 @@ function scanDockerfile(content, rel) {
 
   let sawNonRootUser = false;
   let sawAnyUser = false;
+  // Build-stage aliases declared via `FROM <image> AS <alias>`. A later
+  // `FROM <alias> AS <next>` is an INTERNAL multi-stage reference, not a
+  // registry image — it needs no tag/digest. Without tracking these, every
+  // `FROM build-stage` in a normal multi-stage Dockerfile false-fired
+  // from-latest / no-digest-pin.
+  const stageAliases = new Set();
+  // ARG defaults declared earlier in the file, used to resolve interpolated
+  // base references like `FROM node:${NODE_VERSION}` or `FROM ${BASE_IMAGE}`.
+  // A digest pinned through an ARG default (`ARG BASE=img@sha256:...` then
+  // `FROM ${BASE}`) is a legitimate pinning pattern that was invisible to the
+  // raw-text check; and an unresolvable interpolation can't be proven to be
+  // `:latest`, so flagging it from-latest was a false positive.
+  const argDefaults = new Map();
+  const resolveArgs = (s) => {
+    let interpolatedUnresolved = false;
+    const out = s.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (m, a, b) => {
+      const name = a || b;
+      const val = argDefaults.get(name);
+      if (val !== undefined && val !== null) return val;
+      interpolatedUnresolved = true;
+      return m;
+    });
+    return { resolved: out, interpolatedUnresolved };
+  };
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
 
+    // Track `ARG NAME=default` (and bare `ARG NAME`) so a later FROM that
+    // interpolates the name can resolve it. Quotes around the default are
+    // stripped so `ARG BASE="img@sha256:..."` resolves cleanly.
+    const argMatch = trimmed.match(/^ARG\s+([A-Za-z_][A-Za-z0-9_]*)(?:=(.*))?\s*$/i);
+    if (argMatch) {
+      const name = argMatch[1];
+      if (argMatch[2] !== undefined) {
+        argDefaults.set(name, argMatch[2].trim().replace(/^["']|["']$/g, ""));
+      } else if (!argDefaults.has(name)) {
+        argDefaults.set(name, undefined);
+      }
+      continue;
+    }
+
     // FROM <image>:latest  OR  FROM <image>  (no tag)  → from-latest
     // FROM <image>:<tag>  (no @sha256:digest)         → no-digest-pin
-    const fromMatch = trimmed.match(/^FROM\s+(\S+)(?:\s+AS\s+\S+)?/i);
+    const fromMatch = trimmed.match(/^FROM\s+(\S+)(?:\s+AS\s+(\S+))?/i);
     if (fromMatch) {
-      const ref = fromMatch[1];
-      // scratch is a special base; skip both checks.
-      if (ref !== "scratch") {
+      const rawRef = fromMatch[1];
+      const alias = fromMatch[2];
+      const { resolved: ref, interpolatedUnresolved } = resolveArgs(rawRef);
+      // Skip `scratch` (special base) AND references to a previously-declared
+      // build stage (internal multi-stage reference — not a registry image, so
+      // a tag/digest is neither present nor required).
+      if (ref !== "scratch" && !stageAliases.has(ref.toLowerCase())) {
         const hasDigest = /@sha256:[0-9a-f]{64}/i.test(ref);
-        if (!hasDigest) {
+        // When an interpolation could not be resolved, the actual image
+        // reference is unknown — it may carry a digest supplied via
+        // `--build-arg` at build time. Suppress both signals rather than
+        // emit a guess; a resolvable ARG default still produces a precise
+        // verdict below.
+        if (!hasDigest && !interpolatedUnresolved) {
           hits["dockerfile-no-digest-pin"].push({ file: rel, line: i + 1, snippet: trimmed.slice(0, 120) });
         }
         // latest tag check: either explicit :latest OR no tag at all
         // (Docker defaults to :latest when omitted).
         const tagMatch = ref.match(/:([^@]+)(?:@|$)/);
         const tag = tagMatch ? tagMatch[1] : null;
-        if (tag === "latest" || tag === null) {
+        if (!interpolatedUnresolved && (tag === "latest" || tag === null)) {
           hits["dockerfile-from-latest"].push({ file: rel, line: i + 1, snippet: trimmed.slice(0, 120) });
         }
       }
+      // Record this stage's alias so later `FROM <alias>` lines are recognized
+      // as internal references.
+      if (alias) stageAliases.add(alias.toLowerCase());
       continue;
     }
 

package/lib/collectors/crypto-codebase.js

@@ -120,7 +120,12 @@ const BCRYPT_BLOCK_GLOBAL_RE = /\b(?:bcrypt\.(?:hash|hashSync|gen_salt|genSalt|g
 // by either end-of-block or whitespace, not a closing paren.
 const BCRYPT_COST_RE = /(?:cost|rounds)\s*[:=]\s*(\d+)|,\s*(\d+)\s*$/;
 
-const PEM_RE = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?(?:PRIVATE|PUBLIC) KEY-----|-----BEGIN CERTIFICATE-----/;
+// `hardcoded-key-material` is a SECRET-leak signal, so it must match only
+// private-key blocks. Public keys and certificates are published by design
+// (BIMI trust anchors, release-signing public keys, autoupdate pubkeys); a
+// repo that ships them is doing crypto correctly, so matching `BEGIN PUBLIC
+// KEY` / `BEGIN CERTIFICATE` here only inflates RWEP on well-behaved repos.
+const PEM_PRIVATE_RE = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/;
 
 const TLS_OLD_PROTO_RE = /(?:secureProtocol\s*:\s*['"](?:TLSv1_method|TLSv1_1_method|SSLv23_method|SSLv3_method)['"]|minVersion\s*:\s*['"]TLSv1(?:\.0|\.1)?['"]|ssl_version\s*=\s*ssl\.PROTOCOL_TLSv1(?:_1)?|MinTlsVersion::TLSv1\b)/i;
 
@@ -280,7 +285,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
       const bHits = scanBcrypt(content);
       for (const h of bHits) hits["bcrypt-cost-low"].push({ file: f.rel, offset: h.offset, line: lineFromOffset(content, h.offset), cost: h.cost });
 
-      if (PEM_RE.test(content)) {
+      if (PEM_PRIVATE_RE.test(content)) {
         hits["hardcoded-key-material"].push({ file: f.rel });
       }
       if (TLS_OLD_PROTO_RE.test(content)) {
@@ -319,7 +324,13 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const vendoredPqcFiles = files.filter(f => isVendored(f.rel) && VENDORED_PQC_NAMES_RE.test(f.rel));
   let vendoredPqcNoProvenance = "miss";
   if (vendoredPqcFiles.length > 0) {
-    const provenanceMarkers = new Set(["_PROVENANCE.json", "UPSTREAM", "ORIGIN", ".upstream-commit", "PROVENANCE.md"]);
+    // `MANIFEST.json` / `vendor/MANIFEST.json` is the common provenance
+    // record for a vendored dependency tree (records upstream version,
+    // source URL, license, copied-at commit). This walk only runs for
+    // files already classified as vendored, so a MANIFEST.json found while
+    // climbing the vendor tree is a genuine provenance marker, not a stray
+    // app/package manifest at the repo root.
+    const provenanceMarkers = new Set(["_PROVENANCE.json", "UPSTREAM", "ORIGIN", ".upstream-commit", "PROVENANCE.md", "MANIFEST.json"]);
     // Walk from the file's directory up to the repo root, checking
     // each ancestor for a provenance marker. The marker can live at
     // the immediate sibling (`vendor/kyber/_PROVENANCE.json`), at

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.14.21",
+  "version": "0.14.23",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-28T04:09:16.149Z",
+      "signed_at": "2026-05-28T06:39:14.382Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "ztSKk/zFMFbT12qRcEeBKpydBn7fTT86KxMmor0DTCoKQWk5fJ0fSInfP1XMSB6rFk4/SuSjKVxQRMKVJ5a+Cg==",
-      "signed_at": "2026-05-28T04:09:16.151Z",
+      "signed_at": "2026-05-28T06:39:14.384Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "K6QdPHNK5c4K5QFjrW0QsUhjp71D7SOisSoulwPNSvKRdi2rY+yg0kdckijBMkLMsVPyUvcC9giu93mKJ1OZDg==",
-      "signed_at": "2026-05-28T04:09:16.151Z",
+      "signed_at": "2026-05-28T06:39:14.384Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "zbr8CbOe2rIPuxj2bCl8mVc3YgLsRHnx3/UU7MmyMLNg4c13q6LEBglC1A7cjhfblfHsX/1rxNLaukDzc65lAw==",
-      "signed_at": "2026-05-28T04:09:16.152Z"
+      "signed_at": "2026-05-28T06:39:14.385Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "F2Shxae0ua0gPtvwzTRVzzHaIgJcFDRT3/akLUAZ4aaMQhkleKkcTaTpkjp+pTVEdPfLeLGNCeAOMs+whVYOBg==",
-      "signed_at": "2026-05-28T04:09:16.152Z"
+      "signed_at": "2026-05-28T06:39:14.385Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-28T04:09:16.153Z"
+      "signed_at": "2026-05-28T06:39:14.386Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "W3pS8lnaCP96TQzsJpG5d5yv5IwgaQyS4Z2Ctcz5BOJf6LbajSIgeDgTZ4f4Bhr5m4E7KsgWGjZS4x7Fwd33BQ==",
-      "signed_at": "2026-05-28T04:09:16.153Z",
+      "signed_at": "2026-05-28T06:39:14.386Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "/WDGygh1Ck4yWlBWDGtEUVCqKB8d+UaJXoAoBXujtt+GAl8JbMNpaN1TvI0WkEltQ9dTxaAzSn20/eVDqv8iDQ==",
-      "signed_at": "2026-05-28T04:09:16.154Z",
+      "signed_at": "2026-05-28T06:39:14.386Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "za1NKBpy9LC91F/ESO/qhUfmvVr8GNItQOjR5OJLeHm+2dQ9HHiFWQK2eo53V/n/0uhubuggURA3yS6kJuWwBg==",
-      "signed_at": "2026-05-28T04:09:16.154Z",
+      "signed_at": "2026-05-28T06:39:14.387Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "1853tUUOO35GCXP4vn4qYdBDCdGJu2/WXCNOShhEt69G6BUoq9C3gYGjKWwEPxRKjwjyMtb2nmsL2BZFHRIADw==",
-      "signed_at": "2026-05-28T04:09:16.154Z",
+      "signed_at": "2026-05-28T06:39:14.387Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ZoFh0msOLToS9Xntp9e6zAcg8mE5TOsm7Tq9EYybKL7midjQ5z+aue1Uhp4+xjMRRqVtj8F2W0PvIBTYkYlyAg==",
-      "signed_at": "2026-05-28T04:09:16.155Z"
+      "signed_at": "2026-05-28T06:39:14.387Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-28T04:09:16.155Z",
+      "signed_at": "2026-05-28T06:39:14.388Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "XJFnPtu9tG23qlHGUJulQ0/Vu/p41qFrQng0fE3+GpCPD35+oipdlDXvf9zFo6A6i4OVj601qNuXKh9/kfcHDw==",
-      "signed_at": "2026-05-28T04:09:16.155Z",
+      "signed_at": "2026-05-28T06:39:14.388Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "QuOVaQ4E2Sl39TClbhZ7HA9XrYAyRrDL44HY3RTE7aWLue0hV2cxaBt40ALGmHS++631QGFDlZTLZI77Tr6nAA==",
-      "signed_at": "2026-05-28T04:09:16.156Z"
+      "signed_at": "2026-05-28T06:39:14.388Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-28T04:09:16.156Z",
+      "signed_at": "2026-05-28T06:39:14.389Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "urRcataVWg6/utyEkSiOWoNxTL8sABRjPR7ShyDfZGnAozFph/yDktSoaPVxQDXwu9EfJE+qhUW5OYR/yJECBQ==",
-      "signed_at": "2026-05-28T04:09:16.156Z"
+      "signed_at": "2026-05-28T06:39:14.389Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "C7lv65/Ecm8JJgSKxrX5lxx0YFzKWtrIQSKp+vy50I5e8945s1JmifGUUrnQwRQhq/Pkv7EmfiH5XSO8h75bDg==",
-      "signed_at": "2026-05-28T04:09:16.157Z"
+      "signed_at": "2026-05-28T06:39:14.389Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-28T04:09:16.157Z"
+      "signed_at": "2026-05-28T06:39:14.390Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "IgEnpHOhCftAyfUNdKsjbrd169T9pJkk/rRM2ZEna+H18y7p5x48+1kME2sJMZjJuyAdQFBJi8PJXZFwLGI+DQ==",
-      "signed_at": "2026-05-28T04:09:16.157Z"
+      "signed_at": "2026-05-28T06:39:14.390Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-28T04:09:16.157Z"
+      "signed_at": "2026-05-28T06:39:14.390Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "G5q5elh7Q7eu2xcwTVQJGDTGfvZR0OGQaLSLJPb2wjzCHFF8PWuZfCHZdjjqisiRzRWPyLlzgfHeMJqOdy7cBw==",
-      "signed_at": "2026-05-28T04:09:16.158Z"
+      "signed_at": "2026-05-28T06:39:14.391Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-28T04:09:16.158Z"
+      "signed_at": "2026-05-28T06:39:14.391Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-28T04:09:16.158Z"
+      "signed_at": "2026-05-28T06:39:14.391Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-28T04:09:16.159Z"
+      "signed_at": "2026-05-28T06:39:14.392Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "t6IgW+ciQMuY5uvLD0HDDB/U1TjZmgAy76bvH0526QcqPMCz27CWX3cdyJ6nxpg3rYrx93xAawu0opw/ZZckCw==",
-      "signed_at": "2026-05-28T04:09:16.159Z"
+      "signed_at": "2026-05-28T06:39:14.392Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-28T04:09:16.159Z",
+      "signed_at": "2026-05-28T06:39:14.392Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-28T04:09:16.160Z"
+      "signed_at": "2026-05-28T06:39:14.393Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-28T04:09:16.160Z"
+      "signed_at": "2026-05-28T06:39:14.393Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-28T04:09:16.161Z"
+      "signed_at": "2026-05-28T06:39:14.393Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-28T04:09:16.161Z"
+      "signed_at": "2026-05-28T06:39:14.394Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-28T04:09:16.161Z"
+      "signed_at": "2026-05-28T06:39:14.394Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "QpfWU8d2FFbo/Kt0Be2jcyDM9JPhKOiwKSi+RWmtPa2SrBVzFNYdC3T23fQXxHDEC2iyApEbXnwk8KN4d6PuBQ==",
-      "signed_at": "2026-05-28T04:09:16.162Z"
+      "signed_at": "2026-05-28T06:39:14.394Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-28T04:09:16.162Z",
+      "signed_at": "2026-05-28T06:39:14.395Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-28T04:09:16.162Z"
+      "signed_at": "2026-05-28T06:39:14.395Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-28T04:09:16.163Z",
+      "signed_at": "2026-05-28T06:39:14.395Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IL+DlRCDJN/p08iiJCFkasKcoyjcB0uWrJ6ORLjQcS1HrUa5Xt62QxVjYPHzaevlm5y36ZdmfESqsZJmzK3lCg==",
-      "signed_at": "2026-05-28T04:09:16.163Z"
+      "signed_at": "2026-05-28T06:39:14.396Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "MmjLjlmOMLjhJJ4ZfR8MYlHam+ZB+eSqfh6Nv+DecaG4O5zeo9DBP/iL3cbyDVZxmhnhivgJild2ccYeWTeZAg==",
-      "signed_at": "2026-05-28T04:09:16.163Z"
+      "signed_at": "2026-05-28T06:39:14.396Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "ssueL03g9fWlhXpTe+IiY5l7RqQkunN4DTN5QETKE+VOX+qggdjAR8PONxk77ol4xWYmHrM/VcH8CNtXUEvgBA==",
-      "signed_at": "2026-05-28T04:09:16.164Z"
+      "signed_at": "2026-05-28T06:39:14.397Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "oAFeZmci6BN7Xlu0oOThrazZNBQBIWeCQnoZDqjXo9cs1hIe/6ZijSEr3R3hFQSXH3c1KAbhPw+InR9Gc0HIBQ==",
-      "signed_at": "2026-05-28T04:09:16.164Z"
+      "signed_at": "2026-05-28T06:39:14.397Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "Rgho5TOFUL1txOzcVR0kASCNdovSU4yt99JlGilJlJRyg0A+BdeeQYrZrhPF6Vx2reUAVG0BeHfcZtSbi+cwCg==",
-      "signed_at": "2026-05-28T04:09:16.164Z"
+      "signed_at": "2026-05-28T06:39:14.397Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-28T04:09:16.165Z",
+      "signed_at": "2026-05-28T06:39:14.398Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-28T04:09:16.165Z",
+      "signed_at": "2026-05-28T06:39:14.398Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "W7kT6heP1mvpfgQFFeCdpGOGbCZpbIVT9cW+cqlB5ZXqhSbXOHpweL3UfArgFYl8vQGsdk18P0kNJrTGlIwNAw=="
+    "signature_base64": "tbLFtO6OmwPP+RKY4FrAk40nKyk3eAYpXRDIF6+hqreFGDOe3kJcP85clpGBpXH9beSLn2dNFj7ncRLj+pJCAg=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.14.21",
+  "version": "0.14.23",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:f146b015-d9dd-4d2f-838c-622d665d3777",
+  "serialNumber": "urn:uuid:82ac7ebe-fe55-43ba-b4ce-7f98e43018c7",
   "version": 1,
   "metadata": {
-    "timestamp": "2154-04-11T04:14:13.000Z",
+    "timestamp": "2095-06-22T08:05:18.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.14.21"
+        "version": "0.14.23"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.21",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.23",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.14.21",
+      "version": "0.14.23",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.21",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.23",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1bc1d2d5014d8a83b8f499cf898b342920cc38777e20b96d9aa0a4809c5e3446"
+          "content": "dcd2dc3508aa70b410a878f95f43c1025a784b40a02486e87d573c48b00e8a86"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.21"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.23"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e5b92405b978dea5757ad66959b0cc39a1007261f83ffd793d318d2a187df1e0"
+          "content": "e0a7f63b094c8915e3c1da67399c686ae7d6437a67e5be88b6b9becae729df6b"
         },
         {
           "alg": "SHA3-512",
-          "content": "8d872587150b13cefadfdccdb74b2954b129e6fe82177dad98ac3eae5e9bc02efcc75ab1b54c05b66ab24e0d1641cf7e488ef416ac35c318f6b864784907ba6d"
+          "content": "5ff5ae0bade1d6ad68c2188ab700ca1ba8f4ee4b759d964a6cb630407075cb9b6c58ea26d98fc681dc2c5f44de6a1f5e63b4ee52ddce606361fea0b113fd3297"
         }
       ]
     },
@@ -956,11 +956,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "93be4afb6c08035210b4c67a223ff8dba68ad031d8cc11c9191bc4dc60f9184f"
+          "content": "9dfd98e244a279226c3cabd3661f76156a63de5532473ea664489ae4b4b38998"
         },
         {
           "alg": "SHA3-512",
-          "content": "2d1f0b4b959cb78746e47eeffb71af1f323fdb3c521f60d341b4878feffcc458527ea48b9cda545302e0d41427d1c286524d45239195d4d299a912aca4ddf695"
+          "content": "a4155985b5b840bec630ccaf89a1516602569b821c5723d9b50c75a9e7dd987145c013caeef2fd87c90272c304271bf8d94c0a447b3a6e79fcfb3c016678f1da"
         }
       ]
     },
@@ -986,11 +986,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fbf7e5ded16143dea47d9fb1862a8b2367f32429e2c51a7d01e66846d264f211"
+          "content": "03ae837a5143973a4691693d0cca1d668d59d7faff06d5209b354cf1f6f95cbb"
         },
         {
           "alg": "SHA3-512",
-          "content": "c588a0e877b19974033ef5c3bc98dcb4723497b0916979fa31dda2faf2b74d99d8fedfda3a911e60ce50bf4b0eaa0b9df794e9b088cfdb04e258c7c8c1ff3727"
+          "content": "ac9efe26a2fa11c88ca5e4271c5035ef45c7f4a9e80191db58b9b2acf76861bb36582c056b09bf7b959d6cdf66af828dbaf15c3bd52d2e541cd5783d78a31a62"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "238a94feb0967eb74eedd99084ecf49ee6a20cbf04e9f704a6a3526fdddb6363"
+          "content": "05121fbd70037a8d62a64593344b0b4dd750ca2c6f8dcce238de00cd0b7a513e"
         },
         {
           "alg": "SHA3-512",
-          "content": "c531fde98b619b4f5438f4aeea5e046b2fc405d6267609e2de0f7430a6a408d3d5a287efe63d78399c8d1dd46ce27079ad6e31d8f5f6cf98fefd4b5e7af85873"
+          "content": "e221c4e2f2d64bb9c9bc468635f543487d02ce28e59cdd76016028af4902bf515ed98e6789ec9b2f0cbfab35e9041e54f24d69198a25ac8690db0d793bb6fd17"
         }
       ]
     },