@blamejs/exceptd-skills 0.18.16 → 0.18.18

package/ARCHITECTURE.md

@@ -176,7 +176,7 @@ Tracks PoC status, weaponization stage, and AI-assist factor per CVE. Updated wh
 
 ### `data/cwe-catalog.json`
 
-181 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
+184 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
 
 `_meta.cwe_version` pins the version; on a CWE release, audit IDs for renames or deprecations, bump `last_threat_review` on affected skills, and update `_meta`.
 

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.18.18 — 2026-06-26
+
+Twenty CISA-KEV-listed, actively-exploited CVEs are now in the catalog (459 → 479). Each is curated to the full bar: verified NVD CVSS and CWE, MITRE ATT&CK technique mapping, behavioral indicators of compromise, global-first framework-control-gap analysis (NIST 800-53, ISO 27001:2022, EU NIS2, UK CAF, AU Essential Eight), an RWEP score, and a paired zero-day lesson.
+
+The additions cover current edge- and enterprise-exploitation activity: the Apple CoreAudio and pointer-authentication-bypass zero-days from the mid-2025 targeted-spyware chain (CVE-2025-31200, CVE-2025-31201); the Windows NTLM hash-disclosure flaw (CVE-2025-24054); the Commvault Command Center and Web Server RCEs (CVE-2025-34028, CVE-2025-3928); the SonicWall SMA100 command injection (CVE-2023-44221); the Apache HTTP Server mod_rewrite output-escaping flaw (CVE-2024-38475); the Yii framework alternate-path RCE (CVE-2024-58136); the Cisco Unified CM SSRF-to-root and Catalyst SD-WAN Manager traversal (CVE-2026-20230, CVE-2026-20262); the Splunk Enterprise missing-authentication RCE (CVE-2026-20253); the Ubiquiti UniFi OS access-control, path-traversal, and command-injection chain behind the azsxd botnet (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910); and the Lantronix EDS5000 OT device-server, Broadcom Brocade Fabric OS, Qualitia Active! Mail, Joomla Content Editor, LiteSpeed cPanel plugin, and PTC Windchill/FlexPLM flaws.
+
+## 0.18.17 — 2026-06-24
+
+A correctness pass across the upstream-refresh pipeline, the credential and MCP collectors, scoring and framework analysis, attestation hashing, and the release gates.
+
+The scheduled data refresh no longer fails on transient upstream throttling. The cache-warm step now separates retryable errors the upstream is asking us to back off on — a rate-limit (HTTP 429), a timeout, a 5xx — from hard data errors like a 404 or a parse failure. Only hard errors count toward the failure budget; transient throttling is surfaced in the run summary and retried on the next run. Previously a burst of NVD rate-limits failed the entire refresh and skipped the automated update PR. A feed that returns nothing at all still fails. The exported `prefetch()` API also honors `EXCEPTD_AIR_GAP=1` now, so a programmatic call from an air-gapped host no longer reaches the network.
+
+Cleartext-credential detection covers more of what it claims. An Azure, Google, or Cohere API key found in a shell dotfile now surfaces as a confirmed finding instead of being downgraded to inconclusive. An AWS profile that carries a static access key alongside a `role_arn` — the assume-role bootstrap shape — is flagged as a static-key exposure rather than treated as fully federated. On Windows, the POSIX-permission posture checks (world-writable env files, SSH key modes) report inconclusive rather than a false "clean" for a check that cannot run there.
+
+MCP integrity detection catches single-token launch commands. A server started with a whole pip invocation in one argument — `sh -c "pip install pkg==1.2.3"` — is now flagged as pinned-without-integrity; previously only the split-argument form was caught.
+
+"Rejected or disputed CVE" citations no longer false-positive. The check fired on any note that mentioned a dispute — including a CVSS *scoring* dispute, a disclosure-coordination dispute, or a different CVE the note merely referenced. It now fires only when the cited CVE's own record is rejected or disputed, and no longer attaches a false attestation that suppressed the downgrade for a valid, often actively-exploited citation.
+
+The runtime collector's `collect | run` pipe reaches analysis. The collector now attests the read-only-inventory precondition the runner cannot resolve mechanically, so `collect runtime | run runtime` no longer halts at preflight despite valid evidence.
+
+The RWEP-vs-CVSS explanation lists every factor it counts. Suspected and unknown active-exploitation (contributing +10 and +5) and the blast-radius contribution were omitted from the "driving factors" sentence, so a divergence driven by them showed a higher score with an understated — sometimes empty — reason. Both the driving and mitigating sides now enumerate the real contributions and name the structural cause when no single factor dominates.
+
+Framework gap analysis resolves frameworks whose catalog label differs from their formal name. The Australian Government ISM — and any framework in the same situation — reported zero control gaps and null metadata because its catalog labels did not match its registered name; a data-driven alias map now resolves both, and a framework that resolves to zero gaps is flagged instead of silently empty.
+
+EPSS and NVD scores are matched to the requested CVE by id. The cache-diff and KEV auto-import paths fell back to the first row or record in a payload, which could attribute one CVE's EPSS or CVSS to another when a cache entry held a different CVE's response. They now match by id and skip on a mismatch.
+
+Attestation and reattestation no longer report false drift from a relabeled observation. The evidence hash, and the deterministic session id derived from it, re-key evidence by the stable indicator it targets, so identical evidence submitted under a different observation label produces the same hash; a changed evidence value still changes it.
+
+The GHSA and OSV regression watch stops flagging editorial fields. Curated-only fields — AI-discovery, PoC availability, active-exploitation — were treated as upstream-sourced and flagged as "dropped" on every re-import; the watch now covers only fields the feed actually populates, and the diff summary counts new entries and field regressions separately rather than labeling both as new.
+
+Release gates fail closed on absent input. The version-cadence, test-subject, and code-pattern checks each had a path that passed without checking anything — an unreadable changelog, an empty playbook or module set, an empty scan universe. Each now fails rather than reporting clean when it has nothing to check.
+
 ## 0.18.16 — 2026-06-22
 
 A correctness pass on the evidence-output and attestation surfaces.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T17:11:04.498Z",
+  "generated_at": "2026-06-27T01:18:25.795Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "c8376cbda42a9657b6a5d50f75d8c08a0bcab7c8456340042be7998133922ecb",
+    "manifest.json": "bc640c35c7a0edd249a986c657c816ce2aec5cbc52b237d59f64cbc7e3dfd8d6",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
-    "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",
-    "data/cve-catalog.json": "06ca53e69071dfe94867c10717f3ff2962c50341defcaf050f1a96236b5be51c",
-    "data/cwe-catalog.json": "359263361fa52069e2856cc352d8f1c757d614ea840db6ef3ff5e696185ca220",
+    "data/attack-techniques.json": "35db05bc62be7a2db3d87bac4be67cbed3a9828779ff24e08cec8d43cc07feac",
+    "data/cve-catalog.json": "42d66a59039b964e6ed1b2c8d589de570901ff013e92d77a4e0804339b606ff6",
+    "data/cwe-catalog.json": "30a3b08ccf35d68554a480675151aa101ac7956ec018aa987926871754905be7",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "760c2275803c6da3665ce538c5176bde6f041b68cc3d4808b8de961dfcdee6b8",
-    "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
+    "data/framework-control-gaps.json": "98715e3b7172b378064a0168349beb6104fd43ec55278e7611be69a3b4989271",
+    "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "8c69eec9103eeea236ceb1a157d62b35bafcf8a5de86502e25e4587cc5931247",
+    "data/zeroday-lessons.json": "7ece7fa98582658713dc88b24fb9fc65d72148adfae7238b31e9356f1be9e711",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "6eefa7772f1faf9c8ed971f2a827cd48398a12ab3b691b258c7c8364a5deb39c",
     "skills/mcp-agent-trust/skill.md": "bda6842bfa3b8bfd5edb3ef37751c493ff32a3ca80f771c3d988ede4176f0803",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 446,
-    "chains_cwe_entries": 181,
+    "chains_cve_entries": 466,
+    "chains_cwe_entries": 184,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -314,7 +314,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 459
+      "entry_count": 479
     },
     {
       "date": "2026-06-01",
@@ -322,7 +322,7 @@
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 181
+      "entry_count": 184
     },
     {
       "date": "2026-06-01",
@@ -330,7 +330,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 459
+      "entry_count": 479
     },
     {
       "date": "2026-05-27",

package/data/_indexes/catalog-summaries.json

@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 459,
+      "entry_count": 479,
       "sample_keys": [
         "CVE-2022-23812",
         "MAL-2026-TRAPDOOR-CROSS-ECOSYSTEM",
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 181,
+      "entry_count": 184,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 459,
+      "entry_count": 479,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",