@blamejs/exceptd-skills 0.16.10 → 0.16.12

package/data/cwe-catalog.json

@@ -88,6 +88,7 @@
     "skills_referencing": [
       "api-security",
       "attack-surface-pentest",
+      "mail-server-hardening",
       "mcp-agent-trust",
       "webapp-security"
     ],
@@ -148,6 +149,7 @@
     ],
     "skills_referencing": [
       "api-security",
+      "mail-server-hardening",
       "mcp-agent-trust",
       "webapp-security"
     ],
@@ -533,6 +535,7 @@
       "cloud-security",
       "dlp-gap-analysis",
       "sector-healthcare",
+      "vc-wallet-trust",
       "webapp-security"
     ],
     "evidence_cves": [
@@ -1527,7 +1530,8 @@
     ],
     "related_attack_patterns_capec": [],
     "skills_referencing": [
-      "kernel-lpe-triage"
+      "kernel-lpe-triage",
+      "vc-wallet-trust"
     ],
     "evidence_cves": [
       "CVE-2026-46300",
@@ -1832,7 +1836,9 @@
       "cloud-iam-incident",
       "identity-assurance",
       "idp-incident-response",
+      "mail-server-hardening",
       "sector-financial",
+      "vc-wallet-trust",
       "webapp-security"
     ],
     "evidence_cves": [
@@ -2565,7 +2571,10 @@
       "CVE-2025-59718"
     ],
     "last_verified": "2026-05-18",
-    "notes": "Added v0.13.17 KEV bulk-import."
+    "notes": "Added v0.13.17 KEV bulk-import.",
+    "skills_referencing": [
+      "vc-wallet-trust"
+    ]
   },
   "CWE-476": {
     "id": "CWE-476",
@@ -2624,7 +2633,10 @@
       "CVE-2025-58360"
     ],
     "last_verified": "2026-05-18",
-    "notes": "Added v0.13.17 KEV bulk-import."
+    "notes": "Added v0.13.17 KEV bulk-import.",
+    "skills_referencing": [
+      "mail-server-hardening"
+    ]
   },
   "CWE-648": {
     "id": "CWE-648",
@@ -2922,7 +2934,10 @@
       "CVE-2024-54085"
     ],
     "last_verified": "2026-05-18",
-    "notes": "Added v0.13.17 KEV bulk-import round 2."
+    "notes": "Added v0.13.17 KEV bulk-import round 2.",
+    "skills_referencing": [
+      "vc-wallet-trust"
+    ]
   },
   "CWE-399": {
     "id": "CWE-399",
@@ -3041,7 +3056,10 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "mail-server-hardening"
+    ]
   },
   "CWE-285": {
     "id": "CWE-285",
@@ -4502,7 +4520,9 @@
     "related_attack_patterns_capec": [
       "CAPEC-34"
     ],
-    "skills_referencing": [],
+    "skills_referencing": [
+      "mail-server-hardening"
+    ],
     "evidence_cves": [
       "CVE-2023-51764",
       "CVE-2023-51765",

package/data/playbooks/cred-stores.json

@@ -48,6 +48,7 @@
       "runtime",
       "secrets",
       "supply-chain-recovery",
+      "vc-wallet-trust",
       "webhook-callback-abuse"
     ]
   },
@@ -739,7 +740,9 @@
             "user_enrolled_in_sso == true"
           ],
           "priority": 1,
-          "for_signals": ["aws-static-key-present"],
+          "for_signals": [
+            "aws-static-key-present"
+          ],
           "compensating_controls": [
             "iam-key-deactivated",
             "cloudtrail-monitor-on-old-key-for-residual-use"
@@ -753,7 +756,9 @@
             "org_has_workforce_identity_pool == true OR user_has_authorized_user_credentials == true"
           ],
           "priority": 1,
-          "for_signals": ["gcp-service-account-json-adc"],
+          "for_signals": [
+            "gcp-service-account-json-adc"
+          ],
           "compensating_controls": [
             "gcp-key-deleted",
             "gcp-audit-log-monitor-on-old-key"
@@ -767,7 +772,9 @@
             "cluster_supports_oidc == true OR cluster_is_managed_cloud_k8s == true"
           ],
           "priority": 1,
-          "for_signals": ["kube-static-token"],
+          "for_signals": [
+            "kube-static-token"
+          ],
           "compensating_controls": [
             "kube-token-revoked",
             "k8s-audit-log-monitor-on-old-token"
@@ -781,7 +788,9 @@
             "target_registry_supports_cred_helper == true"
           ],
           "priority": 1,
-          "for_signals": ["docker-cleartext-auth"],
+          "for_signals": [
+            "docker-cleartext-auth"
+          ],
           "compensating_controls": [
             "docker-token-rotated"
           ],
@@ -794,7 +803,10 @@
             "org_authority_to_rotate == true"
           ],
           "priority": 2,
-          "for_signals": ["npm-pat-present","pypi-token-present"],
+          "for_signals": [
+            "npm-pat-present",
+            "pypi-token-present"
+          ],
           "compensating_controls": [
             "token-scope-tightened",
             "publish-mfa-required"
@@ -808,7 +820,9 @@
             "file_owner_is_current_user"
           ],
           "priority": 2,
-          "for_signals": ["credentials-file-bad-perms"],
+          "for_signals": [
+            "credentials-file-bad-perms"
+          ],
           "compensating_controls": [],
           "estimated_time_hours": 0.25
         },
@@ -819,7 +833,10 @@
             "all_authorized_hosts_known == true"
           ],
           "priority": 2,
-          "for_signals": ["ssh-key-rsa-short-bits","ssh-key-old"],
+          "for_signals": [
+            "ssh-key-rsa-short-bits",
+            "ssh-key-old"
+          ],
           "compensating_controls": [
             "ssh-key-inventory-updated"
           ],

package/data/playbooks/framework.json

@@ -58,11 +58,13 @@
       "kernel",
       "library-author",
       "llm-tool-use-exfil",
+      "mail-server-hardening",
       "mcp",
       "post-quantum-migration",
       "ransomware",
       "sbom",
       "supply-chain-recovery",
+      "vc-wallet-trust",
       "webhook-callback-abuse"
     ]
   },
@@ -723,7 +725,10 @@
             "upstream_findings_actionable == true"
           ],
           "priority": 1,
-          "for_signals": ["audit-clean-with-active-finding","compound-theater"],
+          "for_signals": [
+            "audit-clean-with-active-finding",
+            "compound-theater"
+          ],
           "compensating_controls": [],
           "estimated_time_hours": 16
         },
@@ -734,7 +739,9 @@
             "compensating_control_design_feasible == true"
           ],
           "priority": 2,
-          "for_signals": ["framework-lag-no-compensating-control"],
+          "for_signals": [
+            "framework-lag-no-compensating-control"
+          ],
           "compensating_controls": [
             "test_cadence_recorded_in_change_management"
           ],
@@ -747,7 +754,9 @@
             "exception_register_exists == true"
           ],
           "priority": 3,
-          "for_signals": ["exception-missing-expiry-or-owner"],
+          "for_signals": [
+            "exception-missing-expiry-or-owner"
+          ],
           "compensating_controls": [
             "exception_review_cadence_documented"
           ],
@@ -760,7 +769,9 @@
             "jurisdictional_footprint_documented == true"
           ],
           "priority": 4,
-          "for_signals": ["jurisdiction-without-framework"],
+          "for_signals": [
+            "jurisdiction-without-framework"
+          ],
           "compensating_controls": [
             "mapping_review_cadence_documented"
           ],
@@ -773,7 +784,9 @@
             "ai_in_production == true"
           ],
           "priority": 5,
-          "for_signals": ["ai-use-without-ai-controls"],
+          "for_signals": [
+            "ai-use-without-ai-controls"
+          ],
           "compensating_controls": [],
           "estimated_time_hours": 80
         },

package/data/playbooks/identity-sso-compromise.json

@@ -60,6 +60,9 @@
         "playbook_id": "framework",
         "condition": "analyze.compliance_theater_check.verdict == 'theater'"
       }
+    ],
+    "fed_by": [
+      "vc-wallet-trust"
     ]
   },
   "domain": {
@@ -672,7 +675,15 @@
             "rule_authoring_capacity_within_72h == true"
           ],
           "priority": 1,
-          "for_signals": ["out-of-window-global-admin-grant","high-impact-oauth-consent-grant","conditional-access-exclusion-membership-change","federation-signing-cert-added","refresh-token-hoarding-by-sp","prt-claim-anomaly","okta-class-support-session"],
+          "for_signals": [
+            "out-of-window-global-admin-grant",
+            "high-impact-oauth-consent-grant",
+            "conditional-access-exclusion-membership-change",
+            "federation-signing-cert-added",
+            "refresh-token-hoarding-by-sp",
+            "prt-claim-anomaly",
+            "okta-class-support-session"
+          ],
           "compensating_controls": [
             "rule_set_recorded_in_iac",
             "rule_test_suite_in_ci"
@@ -687,7 +698,9 @@
             "break_glass_inventory_complete == true"
           ],
           "priority": 2,
-          "for_signals": ["conditional-access-exclusion-membership-change"],
+          "for_signals": [
+            "conditional-access-exclusion-membership-change"
+          ],
           "compensating_controls": [
             "exclusion_group_membership_alert_active",
             "quarterly_attestation_recorded"
@@ -702,7 +715,9 @@
             "business_owner_engagement_secured == true"
           ],
           "priority": 2,
-          "for_signals": ["high-impact-oauth-consent-grant"],
+          "for_signals": [
+            "high-impact-oauth-consent-grant"
+          ],
           "compensating_controls": [
             "consent_revocation_recorded",
             "re_grant_requires_documented_justification"
@@ -717,7 +732,9 @@
             "downstream_dependent_apps_can_tolerate_rotation_window == true"
           ],
           "priority": 1,
-          "for_signals": ["federation-signing-cert-added"],
+          "for_signals": [
+            "federation-signing-cert-added"
+          ],
           "compensating_controls": [
             "rotation_recorded_in_change_management",
             "old_cert_signed_assertions_quarantined_for_review"