@blamejs/exceptd-skills 0.15.0 → 0.15.2

package/data/_indexes/summary-cards.json

@@ -185,7 +185,7 @@
     "framework-gap-analysis": {
       "description": "Feed a framework control ID and threat scenario — receive the gap between what the control covers and what current TTPs require",
       "threat_context_excerpt": "Compliance frameworks lag the threat environment by years. Most active controls in NIST 800-53, ISO 27001:2022, SOC 2, PCI DSS 4.0, NIS2, and DORA were drafted against assumptions (human-speed exploit development, persistent inventoriable assets, human-controlled accounts) that current attacker TTPs no longer respect. Three concrete mid-2026 instances anchor the lag:",
-      "produces": "Every framework gap analysis this skill produces uses the following literal template. Sections are mandatory; empty sections fail Hard Rule #11 (no-MVP ban).\n\n```\n## Framework Lag Declaration\n\n**Control:** [Control ID] — [Control name]\n**Framework:** [Framework name, version, and section reference]\n**Threat:** [CVE ID / ATLAS TTP ID / ATT&CK TTP ID / threat scenario description]\n\n### 1. What the control was designed for\n[Plain-language statement of the control's original intent and the era/threat model\nit was drafted against. Cite the control text verbatim where possible.]\n\n### 2. What current ...",
+      "produces": "Every framework gap analysis this skill produces uses the following literal template. Sections are mandatory; empty sections are not acceptable — every section must be populated.\n\n```\n## Framework Lag Declaration\n\n**Control:** [Control ID] — [Control name]\n**Framework:** [Framework name, version, and section reference]\n**Threat:** [CVE ID / ATLAS TTP ID / ATT&CK TTP ID / threat scenario description]\n\n### 1. What the control was designed for\n[Plain-language statement of the control's original intent and the era/threat model\nit was drafted against. Cite the control text verbatim where possible.] ...",
       "key_xrefs": {
         "cwe_refs": [],
         "d3fend_refs": [],
@@ -209,7 +209,7 @@
     "compliance-theater": {
       "description": "Detect where an organization passes an audit but remains exposed — seven documented compliance theater patterns",
       "threat_context_excerpt": "The defining mid-2026 reality is that an organization can pass a clean ISO 27001:2022, SOC 2 Type II, or PCI DSS 4.0 audit while remaining exposed to KEV-listed deterministic LPEs and zero-interaction RCEs. The contrast cases drive every theater pattern below:",
-      "produces": "The skill produces a structured Compliance Theater Assessment that scores each of the seven theater patterns and surfaces the auditor-facing remediation language for any flagged pattern. The shape below is consumed downstream by `policy-exception-gen` (which converts theater flags into defensible exceptions with concrete compensating controls), by `framework-gap-analysis` (which escalates any newly discovered theater pattern into a Framework Lag Declaration), and by `global-grc` (which rolls up theater findings across EU/UK/AU/ISO jurisdictions per Hard Rule #5). Auditor-facing remediation lan ...",
+      "produces": "The skill produces a structured Compliance Theater Assessment that scores each of the seven theater patterns and surfaces the auditor-facing remediation language for any flagged pattern. The shape below is consumed downstream by `policy-exception-gen` (which converts theater flags into defensible exceptions with concrete compensating controls), by `framework-gap-analysis` (which escalates any newly discovered theater pattern into a Framework Lag Declaration), and by `global-grc` (which rolls up theater findings across EU/UK/AU/ISO jurisdictions). Auditor-facing remediation language is the load ...",
       "key_xrefs": {
         "cwe_refs": [],
         "d3fend_refs": [],
@@ -397,7 +397,7 @@
     "threat-model-currency": {
       "description": "Score how current an org's threat model is against 2026 reality — 14-item checklist, currency percentage, prioritized update roadmap",
       "threat_context_excerpt": "Most organizational threat models in circulation today are 2022–2024 vintage. They were written before the operational reality of mid-2026:",
-      "produces": "The skill produces a structured Threat Model Currency Assessment that scores the threat model against each of the 14 threat classes, computes a currency percentage, and emits a priority update roadmap. The shape below is consumed downstream by `framework-gap-analysis` (which converts per-class gaps into Framework Lag Declarations), by `policy-exception-gen` (which generates defensible exceptions for any class the operator cannot remediate immediately), and by `global-grc` (which rolls up the currency score across EU/UK/AU/ISO jurisdictions per Hard Rule #5). Preserve the per-class scoring rows ...",
+      "produces": "The skill produces a structured Threat Model Currency Assessment that scores the threat model against each of the 14 threat classes, computes a currency percentage, and emits a priority update roadmap. The shape below is consumed downstream by `framework-gap-analysis` (which converts per-class gaps into Framework Lag Declarations), by `policy-exception-gen` (which generates defensible exceptions for any class the operator cannot remediate immediately), and by `global-grc` (which rolls up the currency score across EU/UK/AU/ISO jurisdictions for global-first coverage). Preserve the per-class sco ...",
       "key_xrefs": {
         "cwe_refs": [],
         "d3fend_refs": [],