@blamejs/exceptd-skills 0.18.19 → 0.18.21

package/lib/schemas/skill-frontmatter.schema.json

@@ -52,7 +52,7 @@
         "type": "string",
         "pattern": "^AML\\.T[0-9]{4}(\\.[0-9]{3})?$"
       },
-      "description": "MITRE ATLAS TTP IDs at the pinned version (currently v2026.05)."
+      "description": "MITRE ATLAS TTP IDs at the pinned version (currently v2026.06)."
     },
     "attack_refs": {
       "type": "array",

package/lib/version-pins.js

@@ -30,7 +30,7 @@
  * operator must read.
  *
  * API:
- *   getAtlasVersion() → "2026.05"
+ *   getAtlasVersion() → "2026.06"
  *   getAttackVersion() → "19.1"
  *   getAtlasReleaseDate() → "2026-05-27"
  *   getAllPins() → { atlas_version, atlas_release_date, attack_version, ... }

package/manifest-snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-06-14T15:49:34.233Z",
-  "atlas_version": "2026.05",
+  "_generated_at": "2026-07-03T23:19:50.905Z",
+  "atlas_version": "2026.06",
   "skill_count": 51,
   "skills": [
     {

package/manifest-snapshot.sha256

@@ -1 +1 @@
-3298b773823c834dde46c771fc14baa0ec84f6c7059b52ad568d519305fde144  manifest-snapshot.json
+40e7936868a38317067bbb0fef5ec1d7b3b09b7bbbdf0af236fffb95bcf1d3fd  manifest-snapshot.json

package/manifest.json

@@ -1,11 +1,11 @@
 {
   "name": "exceptd-security",
-  "version": "0.18.19",
+  "version": "0.18.21",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
-  "atlas_version": "2026.05",
-  "atlas_version_date": "2026-05-27",
+  "atlas_version": "2026.06",
+  "atlas_version_date": "2026-06-30",
   "attack_version": "19.1",
   "attack_version_date": "2026-05-12",
   "threat_review_date": "2026-05-15",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-27T05:26:06.258Z",
+      "signed_at": "2026-07-03T23:19:41.666Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -84,7 +84,7 @@
       "name": "ai-attack-surface",
       "version": "1.0.0",
       "path": "skills/ai-attack-surface/skill.md",
-      "description": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.05 with gap flags",
+      "description": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.06 with gap flags",
       "triggers": [
         "ai attack surface",
         "prompt injection",
@@ -132,8 +132,8 @@
         "AU-Essential-8-App-Hardening"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "WfqxU2x/feWgatYrCeO9PD3dIY0FAfs4nkVdQRac4fg5BDQPG/vhzhvYVN6Mg11oITACghbPOtZXvS37sACsCA==",
-      "signed_at": "2026-06-27T05:26:06.259Z",
+      "signature": "dbRdAJTIpiZSAjWFIWVhWRu3qgaM55Ny0zS3GUIXQmOMtpC1lZuGn5LEamgeC/SSm74wSfKpK4/kdwdx4BIMAA==",
+      "signed_at": "2026-07-03T23:19:41.668Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -214,8 +214,8 @@
         "RFC-9700"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "9bNOW4MzmUlFgkXH5tIZkq8YpzhMM+r8YVcNEM39kdEZwfRNG4Bj+Dgr7v4Qgp9D4q7hGNFpK0ywX+dPd3VWAg==",
-      "signed_at": "2026-06-27T05:26:06.260Z",
+      "signature": "wREB+mZgthecczhafoQfp/Wu8n46J32vh35NtW4t5ZiY5mw9817koZTateEsGz1mEHi/97o3cGfZ+H5pFpHsDA==",
+      "signed_at": "2026-07-03T23:19:41.668Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -268,8 +268,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "5A08+nAu5jwNQ1+vGbFgFAJA/kYD3oiaevhCxT4/2FeW++F070Pm4MD1+oXdv8R2DbtYr+7yXnCGM7UbUPR2AA==",
-      "signed_at": "2026-06-27T05:26:06.260Z"
+      "signature": "XEKGT1cf1DN2+hWFvUPafEELu2YwcAGAr9tenXS4Gxr3R1sXYcHd1thidl2mpkTS9crr/nK/GjXcuvlUezXKBA==",
+      "signed_at": "2026-07-03T23:19:41.668Z"
     },
     {
       "name": "compliance-theater",
@@ -300,8 +300,8 @@
         "CMMC-2.0-Level-2"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "RCgbI0sMNTKAscXUtrVU25u7OuE64uQvO5JKsB8vIJFWguvT6nZyD7euKuIxIzYhLTyHBiD7Rhp70btlK+JkCg==",
-      "signed_at": "2026-06-27T05:26:06.261Z"
+      "signature": "URNMHfqGBDdGthW22sGLq/x9sVwYgvKRO9zEOFPcTLbk4LkPqJXF3My4DxELtmqOuWjDLAJCt8Tku9mQWpPeAw==",
+      "signed_at": "2026-07-03T23:19:41.669Z"
     },
     {
       "name": "exploit-scoring",
@@ -331,8 +331,8 @@
         "CIS-Controls-v8-Control7"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "JJrs+B22/hYxvdYs+abmoire5PbQXPb2uVYyjInZ3UbT8gEjs/5SyfGKx7z86jbtvB3ItApQVAx1AuseIgdyAQ==",
-      "signed_at": "2026-06-27T05:26:06.261Z"
+      "signature": "ZOQ/MWqQQXZs2xR/NiILzkS2vdCaf6P5Rqb0cmKeiCCTlXDPnNN5z5xPmKXtAACDtTJEpbgBAO6v3nkw0lVgDQ==",
+      "signed_at": "2026-07-03T23:19:41.669Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -373,8 +373,8 @@
         "AU-Essential-8-App-Hardening"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "Z6WbTqG98bQVRd6+kXDb6xIEe0ZryAeGxVSuKKxdK1PoZqew7NJcMsa6sJVSq+0r7KMsFwfTEdKorp6UDdhpCA==",
-      "signed_at": "2026-06-27T05:26:06.261Z",
+      "signature": "YRWSEG//Fmphj33NthT8fhvu9Oz1fhYlYAwqeIvx2ikUlqjESDdF0fTiVwW747uBZW/lPXFHNjl4JafMrcy2Dg==",
+      "signed_at": "2026-07-03T23:19:41.669Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -440,8 +440,8 @@
         "RFC-9000"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "DLKcrgon+MZrqmivlFLBH4vlzZbJSW1531RsYDm9/KdW2CgcUUHwNMSzAfU1mAsFwFkAHjy/a8e1FbS9msTvDA==",
-      "signed_at": "2026-06-27T05:26:06.262Z",
+      "signature": "zBEmuGZrhaLW7hgc6aDkHABw4iuu0+7pwtsb7aCj7K9T40xAIkVnSyv92G9btmsX2vuc65Vlav3fi9QAYEvGDQ==",
+      "signed_at": "2026-07-03T23:19:41.670Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -481,8 +481,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "eWCOD+mR1c6B8vKDBot8y8UkQrKPCIEBHU3JRQET9xZnYGx8hrOyeRUElcKqCO5aG/2LISs9Atg1H+ehWDNbCw==",
-      "signed_at": "2026-06-27T05:26:06.262Z",
+      "signature": "cttcHeZekjEzbbcfinlU8SDTJAhqoAePL/CSf+zTBmMy+YWE0Lzi9Cv9CSi0g51BHrimVm8iSP+BagXC0C/dDQ==",
+      "signed_at": "2026-07-03T23:19:41.670Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -516,8 +516,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "kZca725/+BFr1mpxL29+cGzjqsiYhChWScf7VjU6vCTBZrmCps6W9gYYjf4lVORXaM4DAg3UVBOXyhpTst0rAw==",
-      "signed_at": "2026-06-27T05:26:06.262Z",
+      "signature": "o9JHAYXEU1PZBqSSu7nyy7PWY1ML9y51gEb73N/eaCLBSw6CuGdpyxGwWRYb9kS1o7Px+p3HsXt2Iu3xa+CACQ==",
+      "signed_at": "2026-07-03T23:19:41.670Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -557,7 +557,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-27T05:26:06.263Z"
+      "signed_at": "2026-07-03T23:19:41.671Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -583,8 +583,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "NVBY4I5a+v2/nUeCYcy3LLVKk3Tg9gmz+sCKyvnf8t2fXMNSIGtoy+P8K4Gfos1rGzRRMaU01V7L4kh/IQ8UBQ==",
-      "signed_at": "2026-06-27T05:26:06.263Z",
+      "signature": "agl+LgS9xwvNt1fl6nJbVH83viNa36KlxQF9x6w1YJ9rDJztsPn4BzbVIgZOMf77DW+N9sR8hH0Zu1OEmah8Dg==",
+      "signed_at": "2026-07-03T23:19:41.671Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
-      "signed_at": "2026-06-27T05:26:06.264Z",
+      "signed_at": "2026-07-03T23:19:41.672Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -701,8 +701,8 @@
         "IETF RFC publications and draft status changes (datatracker.ietf.org, rfc-editor.org); run `npm run validate-rfcs` quarterly"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "QsJMwvnUJXHwoBPJ4BiUx3FO9giXfos/sMbx5tyO83AJ2JxdVskeC6g/WDfO+rVkWNXRgWi4h1eSYz6T8/tpAg==",
-      "signed_at": "2026-06-27T05:26:06.264Z"
+      "signature": "8W0alFz9LpOQqTYN7YXVPEmgI1eT3bsBlda+FH9fT7fmysWVVQAFA5y0teqUH0jRMCbTPbh3WYQv8wLO7nJgBw==",
+      "signed_at": "2026-07-03T23:19:41.673Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -739,8 +739,8 @@
         "PQC tooling maturity shifting overkill to practical"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "8KbLVVPI1QgYa+HAnEYvKf1cXnxQ3zsncqTGrAOrBP4rwUeZsxJm8KyFCwI0XytnZG35PZ830BFlG/okPW3sBQ==",
-      "signed_at": "2026-06-27T05:26:06.265Z",
+      "signature": "Dzw2woUGYArKvAcX2KKzLWd1crA/OjMiyMoDfVvDnFZqdCfbrCpaRnw3i21DN30B6lqu6/0PauMFfS73f+ukBg==",
+      "signed_at": "2026-07-03T23:19:41.673Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -776,7 +776,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-27T05:26:06.265Z"
+      "signed_at": "2026-07-03T23:19:41.674Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -851,8 +851,8 @@
         "PTES revision incorporating AI-surface enumeration",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
-      "signature": "ZnFi+Rk4CWrjFEVU4hC6Q66UbDmndNL/ICLWQNA1TQYFGSTnng+nboM4tfi6h0yMbbDj7dOXYqqeHNK+M5ZiBA==",
-      "signed_at": "2026-06-27T05:26:06.265Z"
+      "signature": "IPf8oR/blIXjsRHEc+2BNbjIYtgikabF/c+6Xfs5vilFf0mBgJTKAqmJNfrSNPQuCSmuA+Ltbv6eCgJlLBLyDw==",
+      "signed_at": "2026-07-03T23:19:41.674Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -912,8 +912,8 @@
         "syzkaller eBPF and io_uring surface expansion as new kernel attack surfaces ship",
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
-      "signature": "45ICz7vcnmHYE1+RIDv8wQjScKj6p8hqJQ5m6I0tDdKVnGdMXCYIgZnYqFJgHBDXYAXlGx7D7UxhFz6WOCDqAQ==",
-      "signed_at": "2026-06-27T05:26:06.265Z"
+      "signature": "sl+sYiVwJIEkkPVM/bz+OTILrFfMLc2QDrpA8c19dF9Qc8P30bOXjI3SO6uZin/aWSDfmM5IdFOleREazdMTAA==",
+      "signed_at": "2026-07-03T23:19:41.674Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -990,8 +990,8 @@
         "MCP gateway / proxy standardisation (Anthropic enterprise MCP gateway, Portkey MCP) — tool-call argument inspection is the missing primary control",
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
-      "signature": "k6A7QcFEzgGXYWftt/elhQe7kU4F67c0ol3a8DZfj1XW4UrH99SLhPHr6ih3R3EYCl/Ey/zXt/x3a9fDT3RmAw==",
-      "signed_at": "2026-06-27T05:26:06.266Z"
+      "signature": "OVAUEww37jlj+90k52kQs7O+IX/wZGM/dFUuPQzKEs9ja0Czm2DXpmRjYqVv7PlDvOL22Ew0yV9LKQfldmGkBA==",
+      "signed_at": "2026-07-03T23:19:41.675Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1074,8 +1074,8 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge overly permissive allowed list by Satoki Tsuji; AI training-stack supply-chain exposure; track patch and SBOM-attestation impact",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
-      "signature": "5shKqNcLC8Obt0EdvKnck8OwWIuRMgZuuZd12pvWqJIltsYMyTrw2M+lgbQfqg3x2KO6qsJljGAhTew5jM58DQ==",
-      "signed_at": "2026-06-27T05:26:06.266Z"
+      "signature": "c8TcF8E5Fyufm6Gn3ceIhJfGnGEbmzl+W0DqmdF+IHW07KB4Wo11ctkp2IFSsmQIFoxhIjkMyUHaC7UV4MlMCA==",
+      "signed_at": "2026-07-03T23:19:41.675Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1132,7 +1132,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-06-27T05:26:06.266Z"
+      "signed_at": "2026-07-03T23:19:41.676Z"
     },
     {
       "name": "identity-assurance",
@@ -1206,7 +1206,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-27T05:26:06.267Z"
+      "signed_at": "2026-07-03T23:19:41.676Z"
     },
     {
       "name": "ot-ics-security",
@@ -1264,8 +1264,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
-      "signature": "afJ00EDXgARQJrbRqN6xe1+E/kbHF7O2fxQFVvrLLXdrKfK86RK/oJU1AwpxX6mclX9f+5ivy6FvFIuRMA4dBQ==",
-      "signed_at": "2026-06-27T05:26:06.267Z"
+      "signature": "5H2gSx4XzIg0/y/zCiB4pusEmLMsK8WDwPP3/R8OM1TDULKDZyEbWfvaWaLMobU17KbVVr6fc80royegGx4qAQ==",
+      "signed_at": "2026-07-03T23:19:41.676Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1324,8 +1324,8 @@
         "UK NCSC Vulnerability Disclosure Toolkit revisions and AU ISM CVD guidance updates",
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
-      "signature": "VzivMW82mRrG9+07ZX8sj4j9O9YjE/m07m1UHgSwEgex+FLaVPvIj3y1Vk6qeFOvDURmtVaztWlpSlk7iSn0DA==",
-      "signed_at": "2026-06-27T05:26:06.267Z"
+      "signature": "AaTylp+zWRfJF5vAcJlImdnAxNeMFboe4tZ9N+V7eDF40BKDC7TX2Lb7u69X4Ry5zxBAqx0tOEpesni1DNOzDA==",
+      "signed_at": "2026-07-03T23:19:41.677Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1378,8 +1378,8 @@
         "LINDDUN-GO and LINDDUN-PRO updates incorporating LLM privacy threats",
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
-      "signature": "Fk5LzzeS/bH5SQJNySgZqSdeQf1udwdRs3FVLwig5kuqyyKkuIJcF4HW+xHF/1e66HR+gjgRUoqWZGsv58lLAg==",
-      "signed_at": "2026-06-27T05:26:06.268Z"
+      "signature": "q/F/WUeakWNZOJ542rRsMgtM0Ium2AkkDBLOju3vG0+m8PtO/yuBhffhPrL/U6IvGDH6xaoYP+zvqTkaTcB7CQ==",
+      "signed_at": "2026-07-03T23:19:41.677Z"
     },
     {
       "name": "webapp-security",
@@ -1461,8 +1461,8 @@
         "D3-MFA"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "1skHJsPPOIXLQdU5MGHirP/Q07aCYTirtDmfWDO7ZNuto58NlCttW5ZjCpyh37vASlMljIZx0/R+PIl2PfwTBw==",
-      "signed_at": "2026-06-27T05:26:06.268Z",
+      "signature": "giKG4Spsb/a9y6GD1k6rKCYWLl3rMRYGt9RxBsb8WknNGSYi/Hz4PB+UnztgsN9JYl07PjL+DE3iAHbgh3GZAQ==",
+      "signed_at": "2026-07-03T23:19:41.677Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1522,7 +1522,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-27T05:26:06.268Z"
+      "signed_at": "2026-07-03T23:19:41.678Z"
     },
     {
       "name": "sector-healthcare",
@@ -1588,8 +1588,8 @@
         "D3-MFA"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "yyAGG3nUC6/XWQGRF2ufzILfiJitMFczqWNY83lZShCgYSxfFCul0UsICClOc7Xjw76052uydm8kLH9gIzhsAg==",
-      "signed_at": "2026-06-27T05:26:06.269Z"
+      "signature": "0HQkFkUf8EMaPetY4lFsy/11V96wk+YeMSEyY5CWrjC9hQ3vZ0fPsPLWe8EzBxOhgxrt55RXDrBGArmB2i4cAw==",
+      "signed_at": "2026-07-03T23:19:41.678Z"
     },
     {
       "name": "sector-financial",
@@ -1677,8 +1677,8 @@
         "OSFI B-13 (Technology and Cyber Risk Management) post-2024 examination findings",
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
-      "signature": "/+df91Qhl1TIxEAqzgqB7+YJ6mneX6Dif+h6RaCbxOLGE6KRTFst1Q/Fu5SStt8Zx5JI62bkQ2BBrNOKfUlPBg==",
-      "signed_at": "2026-06-27T05:26:06.269Z"
+      "signature": "zgUqH1eeQlUSB99dWskBa0vBqC9PR7zhIYkBjB/aksWlc0uvqGMXOfusT3kObX+TB1pgTgIyTWUfZqjWyBrSAg==",
+      "signed_at": "2026-07-03T23:19:41.679Z"
     },
     {
       "name": "sector-federal-government",
@@ -1754,8 +1754,8 @@
         "EU Cybersecurity Certification Scheme on Common Criteria (EUCC) operational — first certificates issued 2024; high-assurance level for government use cases ramping",
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
-      "signature": "k6MAPS8HJivu0DNwC1azPvyKeig2xLGz/hcqYd8T+s5GvIypPGfkeYRRKmdqMgHUe24f7bQeRZ7AxcQ9Bi6SCg==",
-      "signed_at": "2026-06-27T05:26:06.269Z"
+      "signature": "3xBhtZe9UrcdmfmnQPqnu+5m8MrvT1rT/zlpbQhNuCdJZXwv2ovJCxQUPULP0WVvSrJHfvvmkaTbPUtA1C5MDw==",
+      "signed_at": "2026-07-03T23:19:41.679Z"
     },
     {
       "name": "sector-energy",
@@ -1828,8 +1828,8 @@
         "MadIoT-class research on consumer-IoT-driven grid frequency manipulation moving from proof-of-concept to attributed campaigns",
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
-      "signature": "IYKXn009jfhpKdQKiGB4xb7VgxsJXa6PZawoguP42khU6S/TTemp/YsK1YQCUyabE+2biElL/PP1Hi8zCkSSBw==",
-      "signed_at": "2026-06-27T05:26:06.270Z"
+      "signature": "Bwycwk/pJ19YtZpifD2/MKbs8KkzfpUzYNVswjOfqEBPUiZKhMPTY1TdEyPnNyQvgB1BVHW/z+WpQ9CW9P9cBQ==",
+      "signed_at": "2026-07-03T23:19:41.680Z"
     },
     {
       "name": "sector-telecom",
@@ -1915,7 +1915,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-27T05:26:06.270Z"
+      "signed_at": "2026-07-03T23:19:41.680Z"
     },
     {
       "name": "api-security",
@@ -1993,8 +1993,8 @@
         "D3-CBAN"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "HUjhPGpZeZeVi1nzBIsEAYh18x5ltlIXnt1yQ5YKz+jC2Dvxw7vV/Clx1/1gDBLAuBvRW9wcNtDr4c0RxhfGDQ==",
-      "signed_at": "2026-06-27T05:26:06.271Z",
+      "signature": "JAIe0jXjIIKUC8kYNCN9ZBMhoSSdbNskIg7/lKKAXzACf/uFpjlhaOY8Sm4j8ivAtgHdqyrsIeRy7P8SWm8yBw==",
+      "signed_at": "2026-07-03T23:19:41.681Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2088,8 +2088,8 @@
         "eBPF-based runtime detection coverage of confidential-computing enclaves (AWS Nitro Enclaves, Azure Confidential VMs, GCP Confidential Space) — partial visibility is a tracked detection gap",
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
-      "signature": "xa1kr/92/0fBds7LVtRy9aCM2tQRWAfNSFoC6ygbOU7QjamUo8Wt2h2n9W+nZT34STN3woYhXqtfmm8NSjXdBQ==",
-      "signed_at": "2026-06-27T05:26:06.271Z"
+      "signature": "L1DVbQq61lkUrAz/DkV/Je9u653qhyUoTfGrUEgbHrc/rX4UWYOnWObR0P3EsPPq5t9GS8YKsMkZH0WJevAxAQ==",
+      "signed_at": "2026-07-03T23:19:41.681Z"
     },
     {
       "name": "container-runtime-security",
@@ -2160,8 +2160,8 @@
         "D3-IOPR"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "60hyXAiYfY9lI+EpHG3iFFxa+oF5n71c0tTMa6iXFLNjBJKPevTsdNgQlQsBEnmRJ+dWtOjb/GNBW1KiBx4XAQ==",
-      "signed_at": "2026-06-27T05:26:06.272Z",
+      "signature": "s4kKyXP0UVCE4IAo2ogL7Vb9YygYZxvWgx5azGfehLQKwBZ4RinUBdlqC/OhRdzi/ZpCGAViEGusGHexKmNXAA==",
+      "signed_at": "2026-07-03T23:19:41.682Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2239,10 +2239,10 @@
         "OpenSSF model-signing emergence to v1.0 — Sigstore-based model-weight signing; track for production adoption and admission-control integration",
         "SLSA v1.1 ML profile (draft) — model-provenance extension for training-run attestation chains; track ID and section changes",
         "EU AI Act high-risk technical-file implementing acts (2026-2027) — operational requirements for Article 10 / 13 / 15 documentation may pin ML-BOM or model-signing",
-        "MITRE ATLAS v2026.05 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
+        "MITRE ATLAS v2026.06 (released June 2026) is additive over v2026.05 — it adds AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) and refreshes AML.T0054 (LLM Jailbreak), with no technique-ID removals. Earlier releases shipped the AML.T0010 sub-technique expansion and agentic-AI techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\") this forecast tracked. Forward watch: subsequent monthly ATLAS releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
-      "signature": "IEECw5lO6ZdpkE/j7Hv6/3Jg2vj9fpXlozY+h85Hrn9QYOJuI0gfBjHoBEchJ2GUTmPwUKoiBoI72PBAQw9RCQ==",
-      "signed_at": "2026-06-27T05:26:06.272Z"
+      "signature": "Lksu8f3T2mlR1mzDVLFPNknjR7gi9ZyQkCTx5z3Pp7Wb2BYB4tixL1DkWQiX0TO5ay9n6OrlG724tELESAUGBw==",
+      "signed_at": "2026-07-03T23:19:41.682Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2315,8 +2315,8 @@
         "IL INCD Incident Response Process v4 (slated for 2026-2027) consolidating AI-incident sub-class",
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
-      "signature": "pN1Qa5NRyNJ6h0pmbbqpy3xWdkMANDMUbBst5SKR5fmmqMFopmyrzwIGagiiNgqxjjCunj9J9Wbzs1sL48sMCQ==",
-      "signed_at": "2026-06-27T05:26:06.272Z"
+      "signature": "YseIGVsCqWXjavUPbmbgeTRKDOhFPgVqm453+n0z7haj4DNeKobnNVK8ZCYj+YDJ1A5c5Sg/EF4/UUYpD5qIDw==",
+      "signed_at": "2026-07-03T23:19:41.682Z"
     },
     {
       "name": "ransomware-response",
@@ -2395,8 +2395,8 @@
         "SCOTUS or circuit-court rulings on ransomware payment, sanctions liability, and insurance-policy enforcement"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "sXPA1lvWvZpf5sHxZXRkO0Kcs6gnXiYq0mWA53y1HeBwQGJ+viSPMt5IMobkjd5qLFYchg0CpW/nBUIvUE6/DA==",
-      "signed_at": "2026-06-27T05:26:06.273Z"
+      "signature": "aKpZzYGkstC1E3FPjf0gpwObUoCOzztBFjfa8/e5alOfcqYX1oryKo8A/j8QpVwSOTJ5nab+2DMHtvyrXq5hAQ==",
+      "signed_at": "2026-07-03T23:19:41.683Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2464,7 +2464,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-27T05:26:06.273Z"
+      "signed_at": "2026-07-03T23:19:41.683Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2538,8 +2538,8 @@
         "France SREN (Securing and Regulating the Digital Space) Act 2024 — ARCOM age-verification referential for adult content services; double-anonymity model under deployment",
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
-      "signature": "7Wdii9uwYmDrzQohoWRWDa5A4aDRKOmdLPq5Jsql86O0Gm7pQANnj9tX+cHpQcQ/Ui8VLuNVP8UFdKxxHeDnBg==",
-      "signed_at": "2026-06-27T05:26:06.273Z"
+      "signature": "Bk+pigkDpy/jexcfQBZLPZR0+CnO7XW5gF4UCMf10ZWPB43iOR89UC+MYr7VUDybgaH20LPIZPCHuy+LFq9+Dw==",
+      "signed_at": "2026-07-03T23:19:41.683Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2619,7 +2619,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-27T05:26:06.274Z",
+      "signed_at": "2026-07-03T23:19:41.684Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2713,7 +2713,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-27T05:26:06.274Z",
+      "signed_at": "2026-07-03T23:19:41.684Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2785,7 +2785,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-27T05:26:06.274Z"
+      "signed_at": "2026-07-03T23:19:41.684Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2844,7 +2844,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-27T05:26:06.274Z"
+      "signed_at": "2026-07-03T23:19:41.685Z"
     },
     {
       "name": "network-trust",
@@ -2900,7 +2900,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-07-03T23:19:41.685Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2955,7 +2955,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-07-03T23:19:41.685Z"
     },
     {
       "name": "self-update-integrity",
@@ -3009,7 +3009,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-07-03T23:19:41.685Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3067,7 +3067,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-27T05:26:06.275Z"
+      "signed_at": "2026-07-03T23:19:41.685Z"
     },
     {
       "name": "decompression-dos",
@@ -3125,7 +3125,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-27T05:26:06.276Z"
+      "signed_at": "2026-07-03T23:19:41.685Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3180,7 +3180,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-27T05:26:06.276Z"
+      "signed_at": "2026-07-03T23:19:41.686Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3235,11 +3235,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-27T05:26:06.276Z"
+      "signed_at": "2026-07-03T23:19:41.686Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "To6LYYL7ErcbxNqxdMRaczlvYHq9W1vNj62d5Xdekpi5rVsXqoXJHisVRIq+F2XPYNdiX7IIJu7NucGY8Rv2Bw=="
+    "signature_base64": "X7e0FI7N1oIGVHA1DfTTcDMlLlv7LzgKUxPh5aVgcZukjo1yoItwbT8Y1m7beNDjRSSFTXkD/0GV7fyEqIr5Bw=="
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.19",
-  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (479 CVEs / 184 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+  "version": "0.18.21",
+  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (519 CVEs / 193 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
     "ai-skills",