@blamejs/exceptd-skills 0.16.16 → 0.16.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (32) hide show
  1. package/AGENTS.md +3 -1
  2. package/CHANGELOG.md +8 -0
  3. package/README.md +5 -5
  4. package/bin/exceptd.js +3 -0
  5. package/data/_indexes/_meta.json +16 -14
  6. package/data/_indexes/activity-feed.json +17 -3
  7. package/data/_indexes/catalog-summaries.json +1 -1
  8. package/data/_indexes/chains.json +26271 -1538
  9. package/data/_indexes/currency.json +19 -1
  10. package/data/_indexes/frequency.json +154 -92
  11. package/data/_indexes/handoff-dag.json +9 -1
  12. package/data/_indexes/jurisdiction-map.json +9 -3
  13. package/data/_indexes/section-offsets.json +170 -0
  14. package/data/_indexes/stale-content.json +1 -1
  15. package/data/_indexes/summary-cards.json +80 -0
  16. package/data/_indexes/token-budget.json +103 -3
  17. package/data/_indexes/trigger-table.json +91 -0
  18. package/data/_indexes/xref.json +41 -3
  19. package/data/cwe-catalog.json +75 -3
  20. package/data/playbooks/audit-log-integrity.json +3 -0
  21. package/data/playbooks/crypto-codebase.json +31 -8
  22. package/data/playbooks/decompression-dos.json +626 -0
  23. package/data/playbooks/framework.json +2 -0
  24. package/data/playbooks/log-injection-telemetry.json +619 -0
  25. package/data/playbooks/secrets.json +1 -0
  26. package/manifest-snapshot.json +107 -2
  27. package/manifest-snapshot.sha256 +1 -1
  28. package/manifest.json +163 -50
  29. package/package.json +2 -2
  30. package/sbom.cdx.json +94 -34
  31. package/skills/decompression-dos/skill.md +83 -0
  32. package/skills/log-injection-telemetry/skill.md +80 -0
package/manifest-snapshot.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
3
- "_generated_at": "2026-06-02T18:34:40.366Z",
3
+ "_generated_at": "2026-06-02T19:26:24.947Z",
4
4
  "atlas_version": "5.6.0",
5
- "skill_count": 48,
5
+ "skill_count": 50,
6
6
  "skills": [
7
7
  {
8
8
  "name": "age-gates-child-safety",
@@ -655,6 +655,60 @@
655
655
  "d3fend_refs": [],
656
656
  "dlp_refs": []
657
657
  },
658
+ {
659
+ "name": "decompression-dos",
660
+ "version": "1.0.0",
661
+ "triggers": [
662
+ "amplification attack",
663
+ "billion laughs",
664
+ "catastrophic backtracking",
665
+ "decompression bomb",
666
+ "input amplification",
667
+ "length field allocation",
668
+ "nested archive",
669
+ "parser dos",
670
+ "recursion depth",
671
+ "redos",
672
+ "regular expression denial of service",
673
+ "resource exhaustion",
674
+ "xml entity expansion",
675
+ "xxe",
676
+ "zip bomb",
677
+ "zip slip"
678
+ ],
679
+ "data_deps": [
680
+ "atlas-ttps.json",
681
+ "attack-techniques.json",
682
+ "cve-catalog.json",
683
+ "cwe-catalog.json",
684
+ "framework-control-gaps.json",
685
+ "rfc-references.json"
686
+ ],
687
+ "atlas_refs": [],
688
+ "attack_refs": [
689
+ "T1059",
690
+ "T1499",
691
+ "T1499.001"
692
+ ],
693
+ "framework_gaps": [
694
+ "AU-ISM-1556",
695
+ "NIS2-Art21-network-security",
696
+ "NIST-800-53-SI-2",
697
+ "UK-CAF-B4"
698
+ ],
699
+ "rfc_refs": [],
700
+ "cwe_refs": [
701
+ "CWE-1333",
702
+ "CWE-22",
703
+ "CWE-400",
704
+ "CWE-409",
705
+ "CWE-770",
706
+ "CWE-776",
707
+ "CWE-834"
708
+ ],
709
+ "d3fend_refs": [],
710
+ "dlp_refs": []
711
+ },
658
712
  {
659
713
  "name": "defensive-countermeasure-mapping",
660
714
  "version": "1.0.0",
@@ -1197,6 +1251,57 @@
1197
1251
  ],
1198
1252
  "dlp_refs": []
1199
1253
  },
1254
+ {
1255
+ "name": "log-injection-telemetry",
1256
+ "version": "1.0.0",
1257
+ "triggers": [
1258
+ "cloudwatch",
1259
+ "crlf injection",
1260
+ "exporter ssrf",
1261
+ "log forging",
1262
+ "log injection",
1263
+ "log redaction",
1264
+ "log sink",
1265
+ "metrics endpoint exposure",
1266
+ "observability security",
1267
+ "otlp exporter",
1268
+ "prometheus exposure",
1269
+ "secrets in logs",
1270
+ "telemetry exfiltration",
1271
+ "telemetry integrity",
1272
+ "webhook sink"
1273
+ ],
1274
+ "data_deps": [
1275
+ "atlas-ttps.json",
1276
+ "attack-techniques.json",
1277
+ "cve-catalog.json",
1278
+ "cwe-catalog.json",
1279
+ "framework-control-gaps.json",
1280
+ "rfc-references.json"
1281
+ ],
1282
+ "atlas_refs": [],
1283
+ "attack_refs": [
1284
+ "T1213",
1285
+ "T1530",
1286
+ "T1565.001"
1287
+ ],
1288
+ "framework_gaps": [
1289
+ "AU-ISM-1556",
1290
+ "ISO-27001-2022-A.8.15",
1291
+ "NIS2-Art21-network-security",
1292
+ "NIST-800-53-SI-2",
1293
+ "UK-CAF-B4"
1294
+ ],
1295
+ "rfc_refs": [],
1296
+ "cwe_refs": [
1297
+ "CWE-117",
1298
+ "CWE-200",
1299
+ "CWE-532",
1300
+ "CWE-918"
1301
+ ],
1302
+ "d3fend_refs": [],
1303
+ "dlp_refs": []
1304
+ },
1200
1305
  {
1201
1306
  "name": "mail-server-hardening",
1202
1307
  "version": "1.0.0",
package/manifest-snapshot.sha256 CHANGED
@@ -1 +1 @@
1
- 58d5adcb2f75841236338793c49b71adbd5662743fbd444b16c349dd26edbd21 manifest-snapshot.json
1
+ 0a7aeedea3de4627ed5e602ad12f7ca954c29dffed57a4d7ba57f0af72410fba manifest-snapshot.json