@blamejs/exceptd-skills 0.18.19 → 0.18.20

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.18.19",
+  "version": "0.18.20",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-27T05:26:06.258Z",
+      "signed_at": "2026-06-28T07:37:13.583Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -133,7 +133,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "WfqxU2x/feWgatYrCeO9PD3dIY0FAfs4nkVdQRac4fg5BDQPG/vhzhvYVN6Mg11oITACghbPOtZXvS37sACsCA==",
-      "signed_at": "2026-06-27T05:26:06.259Z",
+      "signed_at": "2026-06-28T07:37:13.585Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -215,7 +215,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "9bNOW4MzmUlFgkXH5tIZkq8YpzhMM+r8YVcNEM39kdEZwfRNG4Bj+Dgr7v4Qgp9D4q7hGNFpK0ywX+dPd3VWAg==",
-      "signed_at": "2026-06-27T05:26:06.260Z",
+      "signed_at": "2026-06-28T07:37:13.586Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -269,7 +269,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "5A08+nAu5jwNQ1+vGbFgFAJA/kYD3oiaevhCxT4/2FeW++F070Pm4MD1+oXdv8R2DbtYr+7yXnCGM7UbUPR2AA==",
-      "signed_at": "2026-06-27T05:26:06.260Z"
+      "signed_at": "2026-06-28T07:37:13.587Z"
     },
     {
       "name": "compliance-theater",
@@ -301,7 +301,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "RCgbI0sMNTKAscXUtrVU25u7OuE64uQvO5JKsB8vIJFWguvT6nZyD7euKuIxIzYhLTyHBiD7Rhp70btlK+JkCg==",
-      "signed_at": "2026-06-27T05:26:06.261Z"
+      "signed_at": "2026-06-28T07:37:13.587Z"
     },
     {
       "name": "exploit-scoring",
@@ -332,7 +332,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "JJrs+B22/hYxvdYs+abmoire5PbQXPb2uVYyjInZ3UbT8gEjs/5SyfGKx7z86jbtvB3ItApQVAx1AuseIgdyAQ==",
-      "signed_at": "2026-06-27T05:26:06.261Z"
+      "signed_at": "2026-06-28T07:37:13.588Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -374,7 +374,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Z6WbTqG98bQVRd6+kXDb6xIEe0ZryAeGxVSuKKxdK1PoZqew7NJcMsa6sJVSq+0r7KMsFwfTEdKorp6UDdhpCA==",
-      "signed_at": "2026-06-27T05:26:06.261Z",
+      "signed_at": "2026-06-28T07:37:13.589Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -441,7 +441,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "DLKcrgon+MZrqmivlFLBH4vlzZbJSW1531RsYDm9/KdW2CgcUUHwNMSzAfU1mAsFwFkAHjy/a8e1FbS9msTvDA==",
-      "signed_at": "2026-06-27T05:26:06.262Z",
+      "signed_at": "2026-06-28T07:37:13.589Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -482,7 +482,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "eWCOD+mR1c6B8vKDBot8y8UkQrKPCIEBHU3JRQET9xZnYGx8hrOyeRUElcKqCO5aG/2LISs9Atg1H+ehWDNbCw==",
-      "signed_at": "2026-06-27T05:26:06.262Z",
+      "signed_at": "2026-06-28T07:37:13.590Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -517,7 +517,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "kZca725/+BFr1mpxL29+cGzjqsiYhChWScf7VjU6vCTBZrmCps6W9gYYjf4lVORXaM4DAg3UVBOXyhpTst0rAw==",
-      "signed_at": "2026-06-27T05:26:06.262Z",
+      "signed_at": "2026-06-28T07:37:13.591Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -557,7 +557,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-27T05:26:06.263Z"
+      "signed_at": "2026-06-28T07:37:13.591Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -584,7 +584,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "NVBY4I5a+v2/nUeCYcy3LLVKk3Tg9gmz+sCKyvnf8t2fXMNSIGtoy+P8K4Gfos1rGzRRMaU01V7L4kh/IQ8UBQ==",
-      "signed_at": "2026-06-27T05:26:06.263Z",
+      "signed_at": "2026-06-28T07:37:13.592Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
-      "signed_at": "2026-06-27T05:26:06.264Z",
+      "signed_at": "2026-06-28T07:37:13.593Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -702,7 +702,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "QsJMwvnUJXHwoBPJ4BiUx3FO9giXfos/sMbx5tyO83AJ2JxdVskeC6g/WDfO+rVkWNXRgWi4h1eSYz6T8/tpAg==",
-      "signed_at": "2026-06-27T05:26:06.264Z"
+      "signed_at": "2026-06-28T07:37:13.593Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -740,7 +740,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8KbLVVPI1QgYa+HAnEYvKf1cXnxQ3zsncqTGrAOrBP4rwUeZsxJm8KyFCwI0XytnZG35PZ830BFlG/okPW3sBQ==",
-      "signed_at": "2026-06-27T05:26:06.265Z",
+      "signed_at": "2026-06-28T07:37:13.594Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -776,7 +776,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-27T05:26:06.265Z"
+      "signed_at": "2026-06-28T07:37:13.595Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -852,7 +852,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "ZnFi+Rk4CWrjFEVU4hC6Q66UbDmndNL/ICLWQNA1TQYFGSTnng+nboM4tfi6h0yMbbDj7dOXYqqeHNK+M5ZiBA==",
-      "signed_at": "2026-06-27T05:26:06.265Z"
+      "signed_at": "2026-06-28T07:37:13.595Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -913,7 +913,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "45ICz7vcnmHYE1+RIDv8wQjScKj6p8hqJQ5m6I0tDdKVnGdMXCYIgZnYqFJgHBDXYAXlGx7D7UxhFz6WOCDqAQ==",
-      "signed_at": "2026-06-27T05:26:06.265Z"
+      "signed_at": "2026-06-28T07:37:13.596Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -991,7 +991,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "k6A7QcFEzgGXYWftt/elhQe7kU4F67c0ol3a8DZfj1XW4UrH99SLhPHr6ih3R3EYCl/Ey/zXt/x3a9fDT3RmAw==",
-      "signed_at": "2026-06-27T05:26:06.266Z"
+      "signed_at": "2026-06-28T07:37:13.596Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1075,7 +1075,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "5shKqNcLC8Obt0EdvKnck8OwWIuRMgZuuZd12pvWqJIltsYMyTrw2M+lgbQfqg3x2KO6qsJljGAhTew5jM58DQ==",
-      "signed_at": "2026-06-27T05:26:06.266Z"
+      "signed_at": "2026-06-28T07:37:13.597Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1132,7 +1132,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-06-27T05:26:06.266Z"
+      "signed_at": "2026-06-28T07:37:13.598Z"
     },
     {
       "name": "identity-assurance",
@@ -1206,7 +1206,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-27T05:26:06.267Z"
+      "signed_at": "2026-06-28T07:37:13.598Z"
     },
     {
       "name": "ot-ics-security",
@@ -1265,7 +1265,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "afJ00EDXgARQJrbRqN6xe1+E/kbHF7O2fxQFVvrLLXdrKfK86RK/oJU1AwpxX6mclX9f+5ivy6FvFIuRMA4dBQ==",
-      "signed_at": "2026-06-27T05:26:06.267Z"
+      "signed_at": "2026-06-28T07:37:13.599Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1325,7 +1325,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "VzivMW82mRrG9+07ZX8sj4j9O9YjE/m07m1UHgSwEgex+FLaVPvIj3y1Vk6qeFOvDURmtVaztWlpSlk7iSn0DA==",
-      "signed_at": "2026-06-27T05:26:06.267Z"
+      "signed_at": "2026-06-28T07:37:13.599Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1379,7 +1379,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Fk5LzzeS/bH5SQJNySgZqSdeQf1udwdRs3FVLwig5kuqyyKkuIJcF4HW+xHF/1e66HR+gjgRUoqWZGsv58lLAg==",
-      "signed_at": "2026-06-27T05:26:06.268Z"
+      "signed_at": "2026-06-28T07:37:13.600Z"
     },
     {
       "name": "webapp-security",
@@ -1462,7 +1462,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "1skHJsPPOIXLQdU5MGHirP/Q07aCYTirtDmfWDO7ZNuto58NlCttW5ZjCpyh37vASlMljIZx0/R+PIl2PfwTBw==",
-      "signed_at": "2026-06-27T05:26:06.268Z",
+      "signed_at": "2026-06-28T07:37:13.601Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1522,7 +1522,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-27T05:26:06.268Z"
+      "signed_at": "2026-06-28T07:37:13.601Z"
     },
     {
       "name": "sector-healthcare",
@@ -1589,7 +1589,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "yyAGG3nUC6/XWQGRF2ufzILfiJitMFczqWNY83lZShCgYSxfFCul0UsICClOc7Xjw76052uydm8kLH9gIzhsAg==",
-      "signed_at": "2026-06-27T05:26:06.269Z"
+      "signed_at": "2026-06-28T07:37:13.602Z"
     },
     {
       "name": "sector-financial",
@@ -1678,7 +1678,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "/+df91Qhl1TIxEAqzgqB7+YJ6mneX6Dif+h6RaCbxOLGE6KRTFst1Q/Fu5SStt8Zx5JI62bkQ2BBrNOKfUlPBg==",
-      "signed_at": "2026-06-27T05:26:06.269Z"
+      "signed_at": "2026-06-28T07:37:13.602Z"
     },
     {
       "name": "sector-federal-government",
@@ -1755,7 +1755,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "k6MAPS8HJivu0DNwC1azPvyKeig2xLGz/hcqYd8T+s5GvIypPGfkeYRRKmdqMgHUe24f7bQeRZ7AxcQ9Bi6SCg==",
-      "signed_at": "2026-06-27T05:26:06.269Z"
+      "signed_at": "2026-06-28T07:37:13.603Z"
     },
     {
       "name": "sector-energy",
@@ -1829,7 +1829,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "IYKXn009jfhpKdQKiGB4xb7VgxsJXa6PZawoguP42khU6S/TTemp/YsK1YQCUyabE+2biElL/PP1Hi8zCkSSBw==",
-      "signed_at": "2026-06-27T05:26:06.270Z"
+      "signed_at": "2026-06-28T07:37:13.604Z"
     },
     {
       "name": "sector-telecom",
@@ -1915,7 +1915,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-27T05:26:06.270Z"
+      "signed_at": "2026-06-28T07:37:13.604Z"
     },
     {
       "name": "api-security",
@@ -1994,7 +1994,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "HUjhPGpZeZeVi1nzBIsEAYh18x5ltlIXnt1yQ5YKz+jC2Dvxw7vV/Clx1/1gDBLAuBvRW9wcNtDr4c0RxhfGDQ==",
-      "signed_at": "2026-06-27T05:26:06.271Z",
+      "signed_at": "2026-06-28T07:37:13.605Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2089,7 +2089,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "xa1kr/92/0fBds7LVtRy9aCM2tQRWAfNSFoC6ygbOU7QjamUo8Wt2h2n9W+nZT34STN3woYhXqtfmm8NSjXdBQ==",
-      "signed_at": "2026-06-27T05:26:06.271Z"
+      "signed_at": "2026-06-28T07:37:13.606Z"
     },
     {
       "name": "container-runtime-security",
@@ -2161,7 +2161,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "60hyXAiYfY9lI+EpHG3iFFxa+oF5n71c0tTMa6iXFLNjBJKPevTsdNgQlQsBEnmRJ+dWtOjb/GNBW1KiBx4XAQ==",
-      "signed_at": "2026-06-27T05:26:06.272Z",
+      "signed_at": "2026-06-28T07:37:13.606Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2242,7 +2242,7 @@
         "MITRE ATLAS v2026.05 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IEECw5lO6ZdpkE/j7Hv6/3Jg2vj9fpXlozY+h85Hrn9QYOJuI0gfBjHoBEchJ2GUTmPwUKoiBoI72PBAQw9RCQ==",
-      "signed_at": "2026-06-27T05:26:06.272Z"
+      "signed_at": "2026-06-28T07:37:13.607Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2316,7 +2316,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "pN1Qa5NRyNJ6h0pmbbqpy3xWdkMANDMUbBst5SKR5fmmqMFopmyrzwIGagiiNgqxjjCunj9J9Wbzs1sL48sMCQ==",
-      "signed_at": "2026-06-27T05:26:06.272Z"
+      "signed_at": "2026-06-28T07:37:13.608Z"
     },
     {
       "name": "ransomware-response",
@@ -2396,7 +2396,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "sXPA1lvWvZpf5sHxZXRkO0Kcs6gnXiYq0mWA53y1HeBwQGJ+viSPMt5IMobkjd5qLFYchg0CpW/nBUIvUE6/DA==",
-      "signed_at": "2026-06-27T05:26:06.273Z"
+      "signed_at": "2026-06-28T07:37:13.608Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2464,7 +2464,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-27T05:26:06.273Z"
+      "signed_at": "2026-06-28T07:37:13.609Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2539,7 +2539,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "7Wdii9uwYmDrzQohoWRWDa5A4aDRKOmdLPq5Jsql86O0Gm7pQANnj9tX+cHpQcQ/Ui8VLuNVP8UFdKxxHeDnBg==",
-      "signed_at": "2026-06-27T05:26:06.273Z"
+      "signed_at": "2026-06-28T07:37:13.609Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2619,7 +2619,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-27T05:26:06.274Z",
+      "signed_at": "2026-06-28T07:37:13.610Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2713,7 +2713,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-27T05:26:06.274Z",
+      "signed_at": "2026-06-28T07:37:13.610Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2785,7 +2785,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-27T05:26:06.274Z"
+      "signed_at": "2026-06-28T07:37:13.611Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2844,7 +2844,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-27T05:26:06.274Z"
+      "signed_at": "2026-06-28T07:37:13.611Z"
     },
     {
       "name": "network-trust",
@@ -2900,7 +2900,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-06-28T07:37:13.612Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2955,7 +2955,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-06-28T07:37:13.612Z"
     },
     {
       "name": "self-update-integrity",
@@ -3009,7 +3009,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-06-28T07:37:13.613Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3067,7 +3067,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-06-28T07:37:13.613Z"
     },
     {
       "name": "decompression-dos",
@@ -3125,7 +3125,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-27T05:26:06.276Z"
+      "signed_at": "2026-06-28T07:37:13.614Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3180,7 +3180,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-27T05:26:06.276Z"
+      "signed_at": "2026-06-28T07:37:13.614Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3235,11 +3235,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-27T05:26:06.276Z"
+      "signed_at": "2026-06-28T07:37:13.615Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "To6LYYL7ErcbxNqxdMRaczlvYHq9W1vNj62d5Xdekpi5rVsXqoXJHisVRIq+F2XPYNdiX7IIJu7NucGY8Rv2Bw=="
+    "signature_base64": "6dyKxjU6LR8Bj0sbE3ksmV6YpTS+UtigKwwJz1h7H0JWk3F3zt5Ffwf+v0iCgKeED6HuJzSF0RXhWV08t9vpBQ=="
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.19",
-  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (479 CVEs / 184 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+  "version": "0.18.20",
+  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (499 CVEs / 189 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
     "ai-skills",

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:3c072c27-4812-4cca-8484-6ca40a08156b",
+  "serialNumber": "urn:uuid:15f1e4be-4b53-4847-894f-90efb77b2541",
   "version": 1,
   "metadata": {
-    "timestamp": "2057-11-30T06:50:15.000Z",
+    "timestamp": "2037-09-01T06:37:50.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.18.19"
+        "version": "0.18.20"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.19",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.20",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.18.19",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (479 CVEs / 184 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.18.20",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (499 CVEs / 189 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.19",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4ff63a1b0657d70f88cf26e4ca2163c24f55459248978ced2ad03bea57ca776b"
+          "content": "c5ce42d328757d7a3923b1a4af6d23d31810a0e66812700ad3ca83ddfe20fcd0"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.19"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.20"
         },
         {
           "type": "vcs",
@@ -101,11 +101,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6bb66fff0a9344dbaa02a3041f0ebeadea13fffe61c8ce108f86ee0a6db8193b"
+          "content": "9ea14882ac657dd2845938a0408384794fd6b54098d1b1bb8098cac5f30f21f9"
         },
         {
           "alg": "SHA3-512",
-          "content": "093f066831002a1341fc21458a2675a456e48184e1c004fa5b65a818377769373a6eb0f7304c5b2b4ae42b472407d097805eaaac507810a1e82471622568ec20"
+          "content": "88e7de8b595f6536609c4f72a97afec9f08ac03d02f022e8aa173f94931c97fbcc4c8f3e689654e983b2639ddc9fa1eb1e903bd92a770e785c7491665b438dd4"
         }
       ]
     },
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0995e1e9c3b84003b415a33ecbda923dcaa3c13f249e4cffbb2042ecb400ce6f"
+          "content": "b083bd5d9061cfdc102a2d49b798e3316eb70ae8a574b3562771caca84def752"
         },
         {
           "alg": "SHA3-512",
-          "content": "a96195eaeca957dee3787ead51a90004603286aeedc5d714d09ec11d9fb2e0dbae75518c6c2af842106dcd540a4147a19de36a317e75d8709d0ff757d97bb67d"
+          "content": "cd4005e1519d696fe2ef021bc58fb2e022f3fd4c9aa9b0f1703992603c98bb755c0dafb5e9337c24e508e75d09c15464874969b445d404c71a6b2c57cedb3e37"
         }
       ]
     },
@@ -311,11 +311,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "35db05bc62be7a2db3d87bac4be67cbed3a9828779ff24e08cec8d43cc07feac"
+          "content": "9766ea6eb2b7abd96f4a028d535d01aca176b084dc1d6d854c9bac42263d7a24"
         },
         {
           "alg": "SHA3-512",
-          "content": "05ce3a11cd67a89af76c35ed9e801c7e5df7b8ebc70eb18d0df792e423c04002ca0696a1d19fce13ba6e3b331ca885f7d86f569179b915b9343968fcfb9a240b"
+          "content": "3fe3259d914c8c1632bcefbdc142030c25687e6ad1737948ed3f67fb91dff87522e2e1fef54b6ac9c5bb8320a57f8b0748dc9a8be58f36c03f9febde689be48e"
         }
       ]
     },
@@ -326,11 +326,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "42d66a59039b964e6ed1b2c8d589de570901ff013e92d77a4e0804339b606ff6"
+          "content": "8f115499a1a554ad2fa19ed7c69afd758d6eeb8903e7b49f06b35068574eda4c"
         },
         {
           "alg": "SHA3-512",
-          "content": "04ceb03240ed6cebe5f4b6184937e0402d3e46f6a81cceed8dd19f6349c815a2c0a66fa42b1f2e797c1d401667a640ac3b9b327b880a1bdcc327693bf46e3392"
+          "content": "ea9b04c2815b8d11068411202f786a564c3e90eaf9b7ec69dab47a4924565b06548d19ec569274b9b368e760024c63e0d0ff8aca618e693ad874e207bb143113"
         }
       ]
     },
@@ -341,11 +341,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "30a3b08ccf35d68554a480675151aa101ac7956ec018aa987926871754905be7"
+          "content": "0a63829b2e7baa5bb0d099f473d27b1dd08bdc1dfb1fe69f3a4f38bb8578607d"
         },
         {
           "alg": "SHA3-512",
-          "content": "9c215d9ba95cecaedf4b29016740985866ae4bc1fc3f1ed31f5d740af640b63287da913395342f0fd56c9719f2de53156b18742f1c3aa5a521df2a9141177b26"
+          "content": "b309fee4669db720399e6b6efe42c6ae08ba19f8fc7dee388274be2b9defe3aef7ddea8e0518620e17fa89e6440fd236daaae25cda019ab4ac1e86392c7f914b"
         }
       ]
     },
@@ -401,11 +401,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "98715e3b7172b378064a0168349beb6104fd43ec55278e7611be69a3b4989271"
+          "content": "39c5b141a3cea0b2264614ccb67eec5ea36feaa3c94b9090eb6e83a0c9ff671c"
         },
         {
           "alg": "SHA3-512",
-          "content": "09be30f90df9721e9c25088046cce698ef4910ca5c37304f54e896fc3e49a548c7be34a8dacdb386597657ecfc9d4224381b1e0cbffc195f9432c258a1fcd53c"
+          "content": "4e6b4a8de61063b25bece5561e45f15cab74079d0b3a8c35656bace74f00034f10bd9c4d175f5e5592e2c101dec235f42ac15bc39eeb696130fc314b3d4fef84"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7ece7fa98582658713dc88b24fb9fc65d72148adfae7238b31e9356f1be9e711"
+          "content": "1cafe8b3774c928fdcd0a1c0e00b55330e8846c115c582719034ec420d850a57"
         },
         {
           "alg": "SHA3-512",
-          "content": "063bcf0c9684a18654cc00283efc47239db36cd82e71a9ad324bae3556260d900b49c6b1e220ab383482aca31b29d63d16a677b42595233c1d2360136628a582"
+          "content": "548e3860c862494bac711d2a396f82692ab5ae21b3592fec31007a12eeb7568cdfb1086b361ce91d5fd0519bf99a329f9e7e014f4253fe7b646fcf332e311d46"
         }
       ]
     },
@@ -1901,11 +1901,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "13d587cacfda30ec0b15d8e0901397e21daacdd31af95e86210f372e41c1d44d"
+          "content": "c7b75dd1cd77b282f6653b474f9f85b7dbf2fdc53fde76ea18ef35280505eeda"
         },
         {
           "alg": "SHA3-512",
-          "content": "9709ec9502df3f33cb07d2e50a00360f33670748861f8c20ce1fca3556869b7be3b12de0376c171342a3e9af88f8266ca916e31514509e7c737177aa88b080ca"
+          "content": "e1d2825543ddbb5c4db47cece49857e7428085ce3d16547f3ca937d58a872f97fb2c8fad6f53e1234cb09fb09c9f58a83e5073bea59ce5904d7c456879cbe25d"
         }
       ]
     },