@blamejs/exceptd-skills 0.16.15 → 0.16.17

package/data/_indexes/section-offsets.json

@@ -4722,6 +4722,176 @@
           "h3_count": 0
         }
       ]
+    },
+    "multitenancy-isolation": {
+      "path": "skills/multitenancy-isolation/skill.md",
+      "total_bytes": 7794,
+      "total_lines": 84,
+      "frontmatter": {
+        "line_start": 1,
+        "line_end": 49,
+        "byte_start": 0,
+        "byte_end": 1201
+      },
+      "sections": [
+        {
+          "name": "Threat Context (mid-2026)",
+          "normalized_name": "threat-context",
+          "line": 53,
+          "byte_start": 1270,
+          "byte_end": 2091,
+          "bytes": 821,
+          "h3_count": 0
+        },
+        {
+          "name": "Framework Lag Declaration",
+          "normalized_name": "framework-lag-declaration",
+          "line": 57,
+          "byte_start": 2091,
+          "byte_end": 2910,
+          "bytes": 819,
+          "h3_count": 0
+        },
+        {
+          "name": "TTP Mapping",
+          "normalized_name": "ttp-mapping",
+          "line": 61,
+          "byte_start": 2910,
+          "byte_end": 3713,
+          "bytes": 803,
+          "h3_count": 0
+        },
+        {
+          "name": "Exploit Availability Matrix",
+          "normalized_name": "exploit-availability-matrix",
+          "line": 65,
+          "byte_start": 3713,
+          "byte_end": 4438,
+          "bytes": 725,
+          "h3_count": 0
+        },
+        {
+          "name": "Analysis Procedure",
+          "normalized_name": "analysis-procedure",
+          "line": 69,
+          "byte_start": 4438,
+          "byte_end": 5337,
+          "bytes": 899,
+          "h3_count": 0
+        },
+        {
+          "name": "Output Format",
+          "normalized_name": "output-format",
+          "line": 73,
+          "byte_start": 5337,
+          "byte_end": 6219,
+          "bytes": 882,
+          "h3_count": 0
+        },
+        {
+          "name": "Compliance Theater Check",
+          "normalized_name": "compliance-theater-check",
+          "line": 77,
+          "byte_start": 6219,
+          "byte_end": 6970,
+          "bytes": 751,
+          "h3_count": 0
+        },
+        {
+          "name": "Defensive Countermeasure Mapping",
+          "normalized_name": "defensive-countermeasure-mapping",
+          "line": 81,
+          "byte_start": 6970,
+          "byte_end": 7794,
+          "bytes": 824,
+          "h3_count": 0
+        }
+      ]
+    },
+    "decompression-dos": {
+      "path": "skills/decompression-dos/skill.md",
+      "total_bytes": 7711,
+      "total_lines": 84,
+      "frontmatter": {
+        "line_start": 1,
+        "line_end": 49,
+        "byte_start": 0,
+        "byte_end": 1186
+      },
+      "sections": [
+        {
+          "name": "Threat Context (mid-2026)",
+          "normalized_name": "threat-context",
+          "line": 53,
+          "byte_start": 1241,
+          "byte_end": 2037,
+          "bytes": 796,
+          "h3_count": 0
+        },
+        {
+          "name": "Framework Lag Declaration",
+          "normalized_name": "framework-lag-declaration",
+          "line": 57,
+          "byte_start": 2037,
+          "byte_end": 2868,
+          "bytes": 831,
+          "h3_count": 0
+        },
+        {
+          "name": "TTP Mapping",
+          "normalized_name": "ttp-mapping",
+          "line": 61,
+          "byte_start": 2868,
+          "byte_end": 3698,
+          "bytes": 830,
+          "h3_count": 0
+        },
+        {
+          "name": "Exploit Availability Matrix",
+          "normalized_name": "exploit-availability-matrix",
+          "line": 65,
+          "byte_start": 3698,
+          "byte_end": 4388,
+          "bytes": 690,
+          "h3_count": 0
+        },
+        {
+          "name": "Analysis Procedure",
+          "normalized_name": "analysis-procedure",
+          "line": 69,
+          "byte_start": 4388,
+          "byte_end": 5310,
+          "bytes": 922,
+          "h3_count": 0
+        },
+        {
+          "name": "Output Format",
+          "normalized_name": "output-format",
+          "line": 73,
+          "byte_start": 5310,
+          "byte_end": 6198,
+          "bytes": 888,
+          "h3_count": 0
+        },
+        {
+          "name": "Compliance Theater Check",
+          "normalized_name": "compliance-theater-check",
+          "line": 77,
+          "byte_start": 6198,
+          "byte_end": 6868,
+          "bytes": 670,
+          "h3_count": 0
+        },
+        {
+          "name": "Defensive Countermeasure Mapping",
+          "normalized_name": "defensive-countermeasure-mapping",
+          "line": 81,
+          "byte_start": 6868,
+          "byte_end": 7711,
+          "bytes": 843,
+          "h3_count": 0
+        }
+      ]
     }
   }
 }

package/data/_indexes/stale-content.json

@@ -15,7 +15,7 @@
       "severity": "medium",
       "category": "researcher_claim_drift",
       "artifact": "skills/researcher/skill.md",
-      "detail": "claims 41 specialized skills downstream; live count is 46"
+      "detail": "claims 41 specialized skills downstream; live count is 48"
     }
   ]
 }

package/data/_indexes/summary-cards.json

@@ -2176,6 +2176,87 @@
       "last_threat_review": "2026-06-02",
       "path": "skills/self-update-integrity/skill.md",
       "handoff_targets": []
+    },
+    "multitenancy-isolation": {
+      "description": "Application multitenancy isolation and availability/DoS resilience for mid-2026 — principal-bound tenant identity, data-layer row-level-security under a non-bypass role, cross-tenant cache/queue namespacing, per-tenant rate/byte quotas, HTTP/2 Rapid Reset caps, bounded allocation, distributed-lock fencing, and circuit breakers",
+      "threat_context_excerpt": "Shared multitenant infrastructure has two linked failure classes. Isolation: if the tenant identifier is trusted from a client-controlled header/parameter/claim, or the tenant filter lives in per-query application discipline rather than the data layer, a single authenticated user of one tenant reads or writes another tenant's data — broken object-level authorization (CWE-639), the most common and highest-impact SaaS vulnerability class. Cache, pub/sub, and queue keys leak the same way when not tenant-namespaced. Availability: asymmetric denial of service — HTTP/2 Rapid Reset (CVE-2023-44487), ...",
+      "produces": "Report per surface, marking each isolation and availability control enforced / missing / inconclusive (visibility gap). For every missing control, state whether a single authenticated user could read another tenant's data or a single client could deny service to all tenants. Distinguish a control enforced at a lower layer (data-layer RLS, CDN/WAF quotas) from an absent one, and a dedicated single-tenant deployment (cross-tenant indicators not applicable) from a shared one. Provide the prioritised remediation (bind tenant to principal + data-layer RLS under a non-bypass role, namespace shared k ...",
+      "key_xrefs": {
+        "cwe_refs": [
+          "CWE-639",
+          "CWE-770",
+          "CWE-863",
+          "CWE-668",
+          "CWE-400"
+        ],
+        "d3fend_refs": [],
+        "framework_gaps": [
+          "NIST-800-53-AC-3",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-ISM-1556"
+        ],
+        "atlas_refs": [],
+        "attack_refs": [
+          "T1078",
+          "T1499",
+          "T1499.001",
+          "T1530"
+        ],
+        "rfc_refs": [],
+        "dlp_refs": []
+      },
+      "trigger_count": 17,
+      "atlas_count": 0,
+      "attack_count": 4,
+      "framework_gap_count": 4,
+      "cwe_count": 5,
+      "d3fend_count": 0,
+      "rfc_count": 0,
+      "last_threat_review": "2026-06-02",
+      "path": "skills/multitenancy-isolation/skill.md",
+      "handoff_targets": []
+    },
+    "decompression-dos": {
+      "description": "Decompression-bomb, parser-DoS, and ReDoS resistance for mid-2026 — decompression size/ratio caps, Zip Slip path confinement, XML entity-expansion disabling, linear-time regex on untrusted input, parse-depth limits, and length-field allocation bounds against single-input amplification denial of service",
+      "threat_context_excerpt": "Amplification denial of service turns a tiny, structurally-valid input into ruinous server work. A 42 KB zip bomb expands to petabytes; a few lines of nested XML entities expand to gigabytes (the billion-laughs attack); a crafted string pins a CPU core for seconds-to-minutes on a backtracking regular expression (ReDoS); a binary parser that reads a declared 2 GB length field allocates a 2 GB buffer from a 10-byte message. A Zip Slip archive entry named `../../x` escapes the extraction directory to overwrite a binary on the execution path. Input-format validation passes all of these because ...",
+      "produces": "Report per parser/decompression path, marking each resource bound enforced / missing / inconclusive (visibility gap). For every missing bound, state whether the ingest is internet-facing and whether a single crafted input could exhaust the instance (or, for Zip Slip, write outside the target). Distinguish a bound enforced at a lower layer (streaming runtime, RE2 engine, size-limited proxy) from an absent one, and a path that ingests only trusted fixed-size input from one that ingests attacker input. Provide the prioritised remediation (cap decompression size/ratio/nesting, confine extraction p ...",
+      "key_xrefs": {
+        "cwe_refs": [
+          "CWE-409",
+          "CWE-1333",
+          "CWE-400",
+          "CWE-776",
+          "CWE-22",
+          "CWE-834",
+          "CWE-770"
+        ],
+        "d3fend_refs": [],
+        "framework_gaps": [
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-network-security",
+          "UK-CAF-B4",
+          "AU-ISM-1556"
+        ],
+        "atlas_refs": [],
+        "attack_refs": [
+          "T1499",
+          "T1499.001",
+          "T1059"
+        ],
+        "rfc_refs": [],
+        "dlp_refs": []
+      },
+      "trigger_count": 16,
+      "atlas_count": 0,
+      "attack_count": 3,
+      "framework_gap_count": 4,
+      "cwe_count": 7,
+      "d3fend_count": 0,
+      "rfc_count": 0,
+      "last_threat_review": "2026-06-02",
+      "path": "skills/decompression-dos/skill.md",
+      "handoff_targets": []
     }
   }
 }

package/data/_indexes/token-budget.json

@@ -3,9 +3,9 @@
     "schema_version": "1.0.0",
     "tokenizer_note": "Character-density approximation: 1 token ≈ 4 chars. This is the canonical rule-of-thumb for OpenAI tokenizers on English+technical text. Claude's tokenizer is typically more efficient on prose; treat this as an upper-bound budget for both. Consumers with stricter precision needs should re-tokenize with their own tokenizer.",
     "approx_chars_per_token": 4,
-    "total_chars": 1712869,
-    "total_approx_tokens": 428220,
-    "skill_count": 47
+    "total_chars": 1728352,
+    "total_approx_tokens": 432091,
+    "skill_count": 49
   },
   "skills": {
     "kernel-lpe-triage": {
@@ -2752,6 +2752,106 @@
           "approx_tokens": 221
         }
       }
+    },
+    "multitenancy-isolation": {
+      "path": "skills/multitenancy-isolation/skill.md",
+      "bytes": 7794,
+      "chars": 7780,
+      "lines": 84,
+      "approx_tokens": 1945,
+      "approx_chars_per_token": 4,
+      "sections": {
+        "threat-context": {
+          "bytes": 821,
+          "chars": 815,
+          "approx_tokens": 204
+        },
+        "framework-lag-declaration": {
+          "bytes": 819,
+          "chars": 819,
+          "approx_tokens": 205
+        },
+        "ttp-mapping": {
+          "bytes": 803,
+          "chars": 801,
+          "approx_tokens": 200
+        },
+        "exploit-availability-matrix": {
+          "bytes": 725,
+          "chars": 721,
+          "approx_tokens": 180
+        },
+        "analysis-procedure": {
+          "bytes": 899,
+          "chars": 899,
+          "approx_tokens": 225
+        },
+        "output-format": {
+          "bytes": 882,
+          "chars": 882,
+          "approx_tokens": 221
+        },
+        "compliance-theater-check": {
+          "bytes": 751,
+          "chars": 751,
+          "approx_tokens": 188
+        },
+        "defensive-countermeasure-mapping": {
+          "bytes": 824,
+          "chars": 824,
+          "approx_tokens": 206
+        }
+      }
+    },
+    "decompression-dos": {
+      "path": "skills/decompression-dos/skill.md",
+      "bytes": 7711,
+      "chars": 7703,
+      "lines": 84,
+      "approx_tokens": 1926,
+      "approx_chars_per_token": 4,
+      "sections": {
+        "threat-context": {
+          "bytes": 796,
+          "chars": 794,
+          "approx_tokens": 199
+        },
+        "framework-lag-declaration": {
+          "bytes": 831,
+          "chars": 831,
+          "approx_tokens": 208
+        },
+        "ttp-mapping": {
+          "bytes": 830,
+          "chars": 828,
+          "approx_tokens": 207
+        },
+        "exploit-availability-matrix": {
+          "bytes": 690,
+          "chars": 688,
+          "approx_tokens": 172
+        },
+        "analysis-procedure": {
+          "bytes": 922,
+          "chars": 922,
+          "approx_tokens": 231
+        },
+        "output-format": {
+          "bytes": 888,
+          "chars": 888,
+          "approx_tokens": 222
+        },
+        "compliance-theater-check": {
+          "bytes": 670,
+          "chars": 670,
+          "approx_tokens": 168
+        },
+        "defensive-countermeasure-mapping": {
+          "bytes": 843,
+          "chars": 843,
+          "approx_tokens": 211
+        }
+      }
     }
   }
 }

package/data/_indexes/trigger-table.json

@@ -1119,7 +1119,8 @@
     "api-security"
   ],
   "bola": [
-    "api-security"
+    "api-security",
+    "multitenancy-isolation"
   ],
   "bfla": [
     "api-security"
@@ -1881,5 +1882,99 @@
   ],
   "update channel": [
     "self-update-integrity"
+  ],
+  "multitenancy isolation": [
+    "multitenancy-isolation"
+  ],
+  "multi tenant": [
+    "multitenancy-isolation"
+  ],
+  "cross tenant": [
+    "multitenancy-isolation"
+  ],
+  "tenant isolation": [
+    "multitenancy-isolation"
+  ],
+  "row level security": [
+    "multitenancy-isolation"
+  ],
+  "rls": [
+    "multitenancy-isolation"
+  ],
+  "broken object level authorization": [
+    "multitenancy-isolation"
+  ],
+  "idor": [
+    "multitenancy-isolation"
+  ],
+  "noisy neighbour": [
+    "multitenancy-isolation"
+  ],
+  "rapid reset": [
+    "multitenancy-isolation"
+  ],
+  "rate limit": [
+    "multitenancy-isolation"
+  ],
+  "per tenant quota": [
+    "multitenancy-isolation"
+  ],
+  "circuit breaker": [
+    "multitenancy-isolation"
+  ],
+  "distributed lock fencing": [
+    "multitenancy-isolation"
+  ],
+  "resource exhaustion": [
+    "decompression-dos",
+    "multitenancy-isolation"
+  ],
+  "denial of service": [
+    "multitenancy-isolation"
+  ],
+  "decompression bomb": [
+    "decompression-dos"
+  ],
+  "zip bomb": [
+    "decompression-dos"
+  ],
+  "zip slip": [
+    "decompression-dos"
+  ],
+  "redos": [
+    "decompression-dos"
+  ],
+  "regular expression denial of service": [
+    "decompression-dos"
+  ],
+  "catastrophic backtracking": [
+    "decompression-dos"
+  ],
+  "billion laughs": [
+    "decompression-dos"
+  ],
+  "xml entity expansion": [
+    "decompression-dos"
+  ],
+  "xxe": [
+    "decompression-dos"
+  ],
+  "parser dos": [
+    "decompression-dos"
+  ],
+  "amplification attack": [
+    "decompression-dos"
+  ],
+  "nested archive": [
+    "decompression-dos"
+  ],
+  "recursion depth": [
+    "decompression-dos"
+  ],
+  "length field allocation": [
+    "decompression-dos"
+  ],
+  "input amplification": [
+    "decompression-dos"
   ]
 }

package/data/_indexes/xref.json

@@ -42,6 +42,7 @@
     "CWE-22": [
       "api-security",
       "attack-surface-pentest",
+      "decompression-dos",
       "mail-server-hardening",
       "mcp-agent-trust",
       "webapp-security"
@@ -204,6 +205,7 @@
       "identity-assurance",
       "idp-incident-response",
       "mail-server-hardening",
+      "multitenancy-isolation",
       "sector-financial",
       "vc-wallet-trust",
       "webapp-security"
@@ -237,13 +239,37 @@
       "mail-server-hardening"
     ],
     "CWE-400": [
-      "mail-server-hardening"
+      "decompression-dos",
+      "mail-server-hardening",
+      "multitenancy-isolation"
     ],
     "CWE-778": [
       "audit-log-integrity"
     ],
     "CWE-353": [
       "self-update-integrity"
+    ],
+    "CWE-639": [
+      "multitenancy-isolation"
+    ],
+    "CWE-770": [
+      "decompression-dos",
+      "multitenancy-isolation"
+    ],
+    "CWE-668": [
+      "multitenancy-isolation"
+    ],
+    "CWE-409": [
+      "decompression-dos"
+    ],
+    "CWE-1333": [
+      "decompression-dos"
+    ],
+    "CWE-776": [
+      "decompression-dos"
+    ],
+    "CWE-834": [
+      "decompression-dos"
     ]
   },
   "d3fend_refs": {
@@ -367,6 +393,7 @@
   "framework_gaps": {
     "NIST-800-53-SI-2": [
       "audit-log-integrity",
+      "decompression-dos",
       "kernel-lpe-triage",
       "mail-server-hardening"
     ],
@@ -612,6 +639,8 @@
       "sector-telecom"
     ],
     "AU-ISM-1556": [
+      "decompression-dos",
+      "multitenancy-isolation",
       "sector-telecom",
       "self-update-integrity"
     ],
@@ -698,7 +727,9 @@
     ],
     "NIS2-Art21-network-security": [
       "audit-log-integrity",
+      "decompression-dos",
       "mail-server-hardening",
+      "multitenancy-isolation",
       "network-trust",
       "self-update-integrity"
     ],
@@ -706,6 +737,8 @@
       "network-trust"
     ],
     "UK-CAF-B4": [
+      "decompression-dos",
+      "multitenancy-isolation",
       "network-trust",
       "self-update-integrity"
     ],
@@ -714,6 +747,9 @@
     ],
     "NIST-800-53-SR-11": [
       "self-update-integrity"
+    ],
+    "NIST-800-53-AC-3": [
+      "multitenancy-isolation"
     ]
   },
   "atlas_refs": {
@@ -805,6 +841,7 @@
     "T1059": [
       "ai-attack-surface",
       "attack-surface-pentest",
+      "decompression-dos",
       "mcp-agent-trust",
       "ransomware-response",
       "webapp-security"
@@ -857,6 +894,7 @@
       "email-security-anti-phishing",
       "identity-assurance",
       "incident-response-playbook",
+      "multitenancy-isolation",
       "ransomware-response",
       "sector-energy",
       "sector-financial",
@@ -875,6 +913,7 @@
     "T1530": [
       "cloud-security",
       "dlp-gap-analysis",
+      "multitenancy-isolation",
       "sector-healthcare"
     ],
     "T1213": [
@@ -992,6 +1031,14 @@
     ],
     "T1574": [
       "self-update-integrity"
+    ],
+    "T1499": [
+      "decompression-dos",
+      "multitenancy-isolation"
+    ],
+    "T1499.001": [
+      "decompression-dos",
+      "multitenancy-isolation"
     ]
   },
   "rfc_refs": {