@blamejs/exceptd-skills 0.18.20 → 0.18.21

package/data/_indexes/frequency.json

@@ -3207,6 +3207,7 @@
       "CWE-384",
       "CWE-385",
       "CWE-399",
+      "CWE-404",
       "CWE-420",
       "CWE-424",
       "CWE-426",
@@ -3234,12 +3235,14 @@
       "CWE-59",
       "CWE-601",
       "CWE-61",
+      "CWE-610",
       "CWE-613",
       "CWE-614",
       "CWE-640",
       "CWE-641",
       "CWE-642",
       "CWE-643",
+      "CWE-647",
       "CWE-648",
       "CWE-653",
       "CWE-667",
@@ -3248,6 +3251,7 @@
       "CWE-693",
       "CWE-697",
       "CWE-706",
+      "CWE-707",
       "CWE-73",
       "CWE-74",
       "CWE-749",

package/data/_indexes/recipes.json

@@ -19,7 +19,7 @@
       "steps": [
         {
           "skill": "ai-attack-surface",
-          "why": "Comprehensive attack-surface inventory mapped to ATLAS v2026.05 with gap flags."
+          "why": "Comprehensive attack-surface inventory mapped to ATLAS v2026.06 with gap flags."
         },
         {
           "skill": "ai-c2-detection",

package/data/_indexes/section-offsets.json

@@ -150,7 +150,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06)",
           "normalized_name": "ttp-mapping",
           "line": 173,
           "byte_start": 17188,
@@ -338,7 +338,7 @@
           "h3_count": 1
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 and ATT&CK)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 and ATT&CK)",
           "normalized_name": "ttp-mapping",
           "line": 74,
           "byte_start": 6584,
@@ -450,7 +450,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 and ATT&CK)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 and ATT&CK)",
           "normalized_name": "ttp-mapping",
           "line": 81,
           "byte_start": 12106,
@@ -710,7 +710,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06)",
           "normalized_name": "ttp-mapping",
           "line": 185,
           "byte_start": 12544,
@@ -831,7 +831,7 @@
           "h3_count": 2
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 + MITRE ATT&CK)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 + MITRE ATT&CK)",
           "normalized_name": "ttp-mapping",
           "line": 333,
           "byte_start": 17125,
@@ -934,7 +934,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 and ATT&CK)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 and ATT&CK)",
           "normalized_name": "ttp-mapping",
           "line": 91,
           "byte_start": 9601,
@@ -1000,7 +1000,7 @@
     },
     "threat-model-currency": {
       "path": "skills/threat-model-currency/skill.md",
-      "total_bytes": 33295,
+      "total_bytes": 33297,
       "total_lines": 448,
       "frontmatter": {
         "line_start": 1,
@@ -1032,16 +1032,16 @@
           "normalized_name": "the-14-threat-class-checklist",
           "line": 43,
           "byte_start": 2180,
-          "byte_end": 13298,
-          "bytes": 11118,
+          "byte_end": 13300,
+          "bytes": 11120,
           "h3_count": 14
         },
         {
           "name": "Threat Context",
           "normalized_name": "threat-context",
           "line": 228,
-          "byte_start": 13298,
-          "byte_end": 15129,
+          "byte_start": 13300,
+          "byte_end": 15131,
           "bytes": 1831,
           "h3_count": 0
         },
@@ -1049,8 +1049,8 @@
           "name": "Framework Lag Declaration",
           "normalized_name": "framework-lag-declaration",
           "line": 242,
-          "byte_start": 15129,
-          "byte_end": 17717,
+          "byte_start": 15131,
+          "byte_end": 17719,
           "bytes": 2588,
           "h3_count": 0
         },
@@ -1058,8 +1058,8 @@
           "name": "TTP Mapping",
           "normalized_name": "ttp-mapping",
           "line": 264,
-          "byte_start": 17717,
-          "byte_end": 20816,
+          "byte_start": 17719,
+          "byte_end": 20818,
           "bytes": 3099,
           "h3_count": 0
         },
@@ -1067,8 +1067,8 @@
           "name": "Exploit Availability Matrix",
           "normalized_name": "exploit-availability-matrix",
           "line": 289,
-          "byte_start": 20816,
-          "byte_end": 23169,
+          "byte_start": 20818,
+          "byte_end": 23171,
           "bytes": 2353,
           "h3_count": 0
         },
@@ -1076,8 +1076,8 @@
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 308,
-          "byte_start": 23169,
-          "byte_end": 24737,
+          "byte_start": 23171,
+          "byte_end": 24739,
           "bytes": 1568,
           "h3_count": 0
         },
@@ -1085,8 +1085,8 @@
           "name": "Scoring",
           "normalized_name": "scoring",
           "line": 324,
-          "byte_start": 24737,
-          "byte_end": 25279,
+          "byte_start": 24739,
+          "byte_end": 25281,
           "bytes": 542,
           "h3_count": 0
         },
@@ -1094,8 +1094,8 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 343,
-          "byte_start": 25279,
-          "byte_end": 26209,
+          "byte_start": 25281,
+          "byte_end": 26211,
           "bytes": 930,
           "h3_count": 4
         },
@@ -1103,8 +1103,8 @@
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 375,
-          "byte_start": 26209,
-          "byte_end": 28195,
+          "byte_start": 26211,
+          "byte_end": 28197,
           "bytes": 1986,
           "h3_count": 0
         },
@@ -1112,8 +1112,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 417,
-          "byte_start": 28195,
-          "byte_end": 33295,
+          "byte_start": 28197,
+          "byte_end": 33297,
           "bytes": 5100,
           "h3_count": 0
         }
@@ -1893,7 +1893,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 + MITRE ATT&CK v19.1)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 + MITRE ATT&CK v19.1)",
           "normalized_name": "ttp-mapping",
           "line": 124,
           "byte_start": 10955,
@@ -1978,7 +1978,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 + MITRE ATT&CK Enterprise)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 + MITRE ATT&CK Enterprise)",
           "normalized_name": "ttp-mapping",
           "line": 90,
           "byte_start": 9884,
@@ -2063,7 +2063,7 @@
           "h3_count": 1
         },
         {
-          "name": "TTP Mapping (MITRE ATLAS v2026.05 + MITRE ATT&CK)",
+          "name": "TTP Mapping (MITRE ATLAS v2026.06 + MITRE ATT&CK)",
           "normalized_name": "ttp-mapping",
           "line": 127,
           "byte_start": 14990,
@@ -2721,7 +2721,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATT&CK Enterprise + ATLAS v2026.05)",
+          "name": "TTP Mapping (MITRE ATT&CK Enterprise + ATLAS v2026.06)",
           "normalized_name": "ttp-mapping",
           "line": 108,
           "byte_start": 8717,
@@ -3388,7 +3388,7 @@
           "h3_count": 0
         },
         {
-          "name": "TTP Mapping (MITRE ATT&CK Enterprise + ATLAS v2026.05)",
+          "name": "TTP Mapping (MITRE ATT&CK Enterprise + ATLAS v2026.06)",
           "normalized_name": "ttp-mapping",
           "line": 129,
           "byte_start": 12457,
@@ -3642,21 +3642,21 @@
     },
     "mlops-security": {
       "path": "skills/mlops-security/skill.md",
-      "total_bytes": 46558,
+      "total_bytes": 46778,
       "total_lines": 332,
       "frontmatter": {
         "line_start": 1,
         "line_end": 66,
         "byte_start": 0,
-        "byte_end": 2558
+        "byte_end": 2778
       },
       "sections": [
         {
           "name": "Threat Context (mid-2026)",
           "normalized_name": "threat-context",
           "line": 70,
-          "byte_start": 2597,
-          "byte_end": 8427,
+          "byte_start": 2817,
+          "byte_end": 8647,
           "bytes": 5830,
           "h3_count": 0
         },
@@ -3664,8 +3664,8 @@
           "name": "Framework Lag Declaration",
           "normalized_name": "framework-lag-declaration",
           "line": 88,
-          "byte_start": 8427,
-          "byte_end": 14209,
+          "byte_start": 8647,
+          "byte_end": 14429,
           "bytes": 5782,
           "h3_count": 0
         },
@@ -3673,8 +3673,8 @@
           "name": "TTP Mapping",
           "normalized_name": "ttp-mapping",
           "line": 112,
-          "byte_start": 14209,
-          "byte_end": 18587,
+          "byte_start": 14429,
+          "byte_end": 18807,
           "bytes": 4378,
           "h3_count": 0
         },
@@ -3682,8 +3682,8 @@
           "name": "Exploit Availability Matrix",
           "normalized_name": "exploit-availability-matrix",
           "line": 137,
-          "byte_start": 18587,
-          "byte_end": 24142,
+          "byte_start": 18807,
+          "byte_end": 24362,
           "bytes": 5555,
           "h3_count": 0
         },
@@ -3691,8 +3691,8 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 163,
-          "byte_start": 24142,
-          "byte_end": 33211,
+          "byte_start": 24362,
+          "byte_end": 33431,
           "bytes": 9069,
           "h3_count": 4
         },
@@ -3700,8 +3700,8 @@
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 228,
-          "byte_start": 33211,
-          "byte_end": 36633,
+          "byte_start": 33431,
+          "byte_end": 36853,
           "bytes": 3422,
           "h3_count": 0
         },
@@ -3709,8 +3709,8 @@
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 283,
-          "byte_start": 36633,
-          "byte_end": 39564,
+          "byte_start": 36853,
+          "byte_end": 39784,
           "bytes": 2931,
           "h3_count": 0
         },
@@ -3718,8 +3718,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 299,
-          "byte_start": 39564,
-          "byte_end": 43604,
+          "byte_start": 39784,
+          "byte_end": 43824,
           "bytes": 4040,
           "h3_count": 0
         },
@@ -3727,8 +3727,8 @@
           "name": "Hand-Off / Related Skills",
           "normalized_name": "hand-off",
           "line": 319,
-          "byte_start": 43604,
-          "byte_end": 46558,
+          "byte_start": 43824,
+          "byte_end": 46778,
           "bytes": 2954,
           "h3_count": 0
         }
@@ -3736,7 +3736,7 @@
     },
     "incident-response-playbook": {
       "path": "skills/incident-response-playbook/skill.md",
-      "total_bytes": 63030,
+      "total_bytes": 63031,
       "total_lines": 549,
       "frontmatter": {
         "line_start": 1,
@@ -3768,16 +3768,16 @@
           "normalized_name": "ttp-mapping",
           "line": 117,
           "byte_start": 18687,
-          "byte_end": 23638,
-          "bytes": 4951,
+          "byte_end": 23639,
+          "bytes": 4952,
           "h3_count": 0
         },
         {
           "name": "Exploit Availability Matrix",
           "normalized_name": "exploit-availability-matrix",
           "line": 135,
-          "byte_start": 23638,
-          "byte_end": 27449,
+          "byte_start": 23639,
+          "byte_end": 27450,
           "bytes": 3811,
           "h3_count": 0
         },
@@ -3785,8 +3785,8 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 159,
-          "byte_start": 27449,
-          "byte_end": 41847,
+          "byte_start": 27450,
+          "byte_end": 41848,
           "bytes": 14398,
           "h3_count": 10
         },
@@ -3794,8 +3794,8 @@
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 279,
-          "byte_start": 41847,
-          "byte_end": 50974,
+          "byte_start": 41848,
+          "byte_end": 50975,
           "bytes": 9127,
           "h3_count": 7
         },
@@ -3803,8 +3803,8 @@
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 495,
-          "byte_start": 50974,
-          "byte_end": 54871,
+          "byte_start": 50975,
+          "byte_end": 54872,
           "bytes": 3897,
           "h3_count": 0
         },
@@ -3812,8 +3812,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 511,
-          "byte_start": 54871,
-          "byte_end": 59853,
+          "byte_start": 54872,
+          "byte_end": 59854,
           "bytes": 4982,
           "h3_count": 0
         },
@@ -3821,8 +3821,8 @@
           "name": "Hand-Off / Related Skills",
           "normalized_name": "hand-off",
           "line": 530,
-          "byte_start": 59853,
-          "byte_end": 63030,
+          "byte_start": 59854,
+          "byte_end": 63031,
           "bytes": 3177,
           "h3_count": 0
         }
@@ -3830,7 +3830,7 @@
     },
     "ransomware-response": {
       "path": "skills/ransomware-response/skill.md",
-      "total_bytes": 48433,
+      "total_bytes": 48434,
       "total_lines": 371,
       "frontmatter": {
         "line_start": 1,
@@ -3862,16 +3862,16 @@
           "normalized_name": "ttp-mapping",
           "line": 121,
           "byte_start": 16933,
-          "byte_end": 19169,
-          "bytes": 2236,
+          "byte_end": 19170,
+          "bytes": 2237,
           "h3_count": 0
         },
         {
           "name": "Exploit Availability Matrix",
           "normalized_name": "exploit-availability-matrix",
           "line": 136,
-          "byte_start": 19169,
-          "byte_end": 21761,
+          "byte_start": 19170,
+          "byte_end": 21762,
           "bytes": 2592,
           "h3_count": 0
         },
@@ -3879,8 +3879,8 @@
           "name": "Analysis Procedure",
           "normalized_name": "analysis-procedure",
           "line": 156,
-          "byte_start": 21761,
-          "byte_end": 33318,
+          "byte_start": 21762,
+          "byte_end": 33319,
           "bytes": 11557,
           "h3_count": 10
         },
@@ -3888,8 +3888,8 @@
           "name": "Output Format",
           "normalized_name": "output-format",
           "line": 218,
-          "byte_start": 33318,
-          "byte_end": 37129,
+          "byte_start": 33319,
+          "byte_end": 37130,
           "bytes": 3811,
           "h3_count": 6
         },
@@ -3897,8 +3897,8 @@
           "name": "Compliance Theater Check",
           "normalized_name": "compliance-theater-check",
           "line": 321,
-          "byte_start": 37129,
-          "byte_end": 40916,
+          "byte_start": 37130,
+          "byte_end": 40917,
           "bytes": 3787,
           "h3_count": 0
         },
@@ -3906,8 +3906,8 @@
           "name": "Defensive Countermeasure Mapping",
           "normalized_name": "defensive-countermeasure-mapping",
           "line": 337,
-          "byte_start": 40916,
-          "byte_end": 44583,
+          "byte_start": 40917,
+          "byte_end": 44584,
           "bytes": 3667,
           "h3_count": 0
         },
@@ -3915,8 +3915,8 @@
           "name": "Hand-Off / Related Skills",
           "normalized_name": "hand-off",
           "line": 356,
-          "byte_start": 44583,
-          "byte_end": 48433,
+          "byte_start": 44584,
+          "byte_end": 48434,
           "bytes": 3850,
           "h3_count": 0
         }

package/data/_indexes/summary-cards.json

@@ -64,7 +64,7 @@
       ]
     },
     "ai-attack-surface": {
-      "description": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.05 with explicit framework gap flags",
+      "description": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.06 with explicit framework gap flags",
       "threat_context_excerpt": "The AI attack surface is not speculative. It is actively exploited. The following are confirmed, documented threats as of mid-2026.",
       "produces": "The assessment produces a structured AI Attack Surface Assessment report. The shape below is consumed downstream by `mcp-agent-trust` (which converts the MCP Trust Assessment section into per-server policy), by `rag-pipeline-security` (which picks up any RAG-pipeline entries from the Surface Inventory), and by `incident-response-playbook` (which scopes IR against the prompt-injection and AI-C2 exposure bands). CSAF-style auditor evidence bundles consume the Framework Gaps and ATLAS TTP Coverage Gaps sections verbatim — preserve the framework-control IDs as cited.\n\n```\n## AI Attack Surface Asse ...",
       "key_xrefs": {

package/data/_indexes/token-budget.json

@@ -3,8 +3,8 @@
     "schema_version": "1.0.0",
     "tokenizer_note": "Character-density approximation: 1 token ≈ 4 chars. This is the canonical rule-of-thumb for OpenAI tokenizers on English+technical text. Claude's tokenizer is typically more efficient on prose; treat this as an upper-bound budget for both. Consumers with stricter precision needs should re-tokenize with their own tokenizer.",
     "approx_chars_per_token": 4,
-    "total_chars": 1743930,
-    "total_approx_tokens": 435989,
+    "total_chars": 1744152,
+    "total_approx_tokens": 436045,
     "skill_count": 51
   },
   "skills": {
@@ -580,10 +580,10 @@
     },
     "threat-model-currency": {
       "path": "skills/threat-model-currency/skill.md",
-      "bytes": 33295,
-      "chars": 33109,
+      "bytes": 33297,
+      "chars": 33111,
       "lines": 448,
-      "approx_tokens": 8277,
+      "approx_tokens": 8278,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -597,9 +597,9 @@
           "approx_tokens": 135
         },
         "the-14-threat-class-checklist": {
-          "bytes": 11118,
-          "chars": 11104,
-          "approx_tokens": 2776
+          "bytes": 11120,
+          "chars": 11106,
+          "approx_tokens": 2777
         },
         "threat-context": {
           "bytes": 1831,
@@ -2120,10 +2120,10 @@
     },
     "mlops-security": {
       "path": "skills/mlops-security/skill.md",
-      "bytes": 46558,
-      "chars": 46264,
+      "bytes": 46778,
+      "chars": 46482,
       "lines": 332,
-      "approx_tokens": 11566,
+      "approx_tokens": 11621,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -2175,8 +2175,8 @@
     },
     "incident-response-playbook": {
       "path": "skills/incident-response-playbook/skill.md",
-      "bytes": 63030,
-      "chars": 62778,
+      "bytes": 63031,
+      "chars": 62779,
       "lines": 549,
       "approx_tokens": 15695,
       "approx_chars_per_token": 4,
@@ -2192,8 +2192,8 @@
           "approx_tokens": 2541
         },
         "ttp-mapping": {
-          "bytes": 4951,
-          "chars": 4943,
+          "bytes": 4952,
+          "chars": 4944,
           "approx_tokens": 1236
         },
         "exploit-availability-matrix": {
@@ -2230,8 +2230,8 @@
     },
     "ransomware-response": {
       "path": "skills/ransomware-response/skill.md",
-      "bytes": 48433,
-      "chars": 48251,
+      "bytes": 48434,
+      "chars": 48252,
       "lines": 371,
       "approx_tokens": 12063,
       "approx_chars_per_token": 4,
@@ -2247,8 +2247,8 @@
           "approx_tokens": 1692
         },
         "ttp-mapping": {
-          "bytes": 2236,
-          "chars": 2234,
+          "bytes": 2237,
+          "chars": 2235,
           "approx_tokens": 559
         },
         "exploit-availability-matrix": {

package/data/atlas-ttps.json

@@ -1,14 +1,14 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "atlas_version": "2026.05",
-    "atlas_release_date": "2026-05-27",
+    "atlas_version": "2026.06",
+    "atlas_release_date": "2026-06-30",
     "secure_ai_v2_release_date": "2026-05-06",
     "secure_ai_v2_source": "https://ctid.mitre.org/blog/2026/05/06/secure-ai-v2-release",
-    "last_updated": "2026-06-10",
-    "last_threat_review": "2026-06-10",
+    "last_updated": "2026-07-03",
+    "last_threat_review": "2026-07-03",
     "source": "https://atlas.mitre.org",
-    "note": "AI-relevant ATLAS v2026.05 TTPs with framework_gap field. ATLAS content now follows a YYYY.MM calendar-versioning scheme; v2026.05 adds platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) to every technique, with no technique-ID removals or renames. framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
+    "note": "AI-relevant ATLAS TTPs with framework_gap field, curated as a subset of the full ATLAS matrix and pinned to v2026.06. ATLAS content follows a YYYY.MM calendar-versioning scheme; the CalVer scheme and the per-technique platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) were introduced in v2026.05. The v2026.05 → v2026.06 audit (AGENTS.md Hard Rule #12) confirmed the release is additive with NO technique-ID removals or renames, so every AML.T* id curated in this file remains valid. Upstream v2026.06 additionally published three new techniques — AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) — refreshed AML.T0054 (LLM Jailbreak), and shipped new case studies (EchoLeak zero-click prompt injection, AI-in-the-Middle C2 relays, Semantic Kernel RCE); these newly-published techniques are not yet ingested into this curated subset and are tracked as future-curation candidates (the subset intentionally trails the full matrix, e.g. 170 curated of the full ATLAS technique set). framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
     "tlp": "CLEAR",
     "source_confidence": {
       "scheme": "Admiralty (A-F + 1-6)",
@@ -21,7 +21,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "bulk_intake_note": " v0.13.18: +137 AML.* techniques from MITRE ATLAS STIX bundle (atlas-navigator-data dist/stix-atlas.json). Now tracking ATLAS v2026.05 (May 2026 release). Auto-imported entries flagged _auto_imported:true + _intake_method:v0.13.18-bulk-mitre-atlas-stix for downstream curation."
+    "bulk_intake_note": " v0.13.18: +137 AML.* techniques from MITRE ATLAS STIX bundle (atlas-navigator-data dist/stix-atlas.json). Now tracking ATLAS v2026.06 (June 2026 release). Auto-imported entries flagged _auto_imported:true + _intake_method:v0.13.18-bulk-mitre-atlas-stix for downstream curation."
   },
   "AML.T0001": {
     "id": "AML.T0001",
@@ -536,7 +536,7 @@
       "Multiple production AI assistant prompt injection incidents 2025-2026"
     ],
     "framework_gap": true,
-    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v2026.05 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
+    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v2026.06 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
     "controls_that_partially_help": [
       "NIST-800-53-AC-2",
       "ISO-27001-2022-A.8.28"