@blamejs/exceptd-skills 0.18.26 → 0.18.28

package/lib/currency-severity.js

@@ -0,0 +1,60 @@
+"use strict";
+
+/**
+ * lib/currency-severity.js
+ *
+ * Pure function used by the `exceptd doctor` verb to turn a currency report
+ * into a health verdict.
+ *
+ * The scoring model in orchestrator/pipeline.js grades every skill on four
+ * labels — current (score >= 90), acceptable (70-89), stale (50-69),
+ * critical_stale (< 50) — and raises `action_required` only below 70. The
+ * pre-extraction predicate in the doctor ignored that ladder and failed on
+ * `currency_label !== "current"`, which folded the acceptable tier in with
+ * genuine staleness.
+ *
+ * That made the health check a scheduled failure rather than a signal: a
+ * skill's score drops from 90 to 80 the day it crosses 90 days since
+ * `last_threat_review`, so any skill will turn `doctor` red on a fixed
+ * cadence with no code change and nothing actually wrong.
+ *
+ * The tiers now map to severity the way the model defines them:
+ *
+ *   current                     → healthy, no entry in either bucket
+ *   acceptable (drifting)       → severity:"warn", ok:true, exit 0
+ *   stale / critical_stale      → ok:false (error), exit 1
+ *
+ * `stale_skills` keeps its original meaning — every skill that is not
+ * `current` — so an existing consumer reading it still sees the full picture.
+ * `drifting_skills` and `action_required_skills` split that list along the
+ * boundary the exit code now respects.
+ */
+
+/**
+ * @param {object[]} report        currency_report rows from currencyCheck()
+ * @param {boolean}  actionRequired the report-level action_required flag
+ * @returns {{ok: boolean, severity: string|null, stale: object[], drifting: object[], actionable: object[], critical: object[]}}
+ */
+function classifyCurrency(report, actionRequired) {
+  const rows = Array.isArray(report) ? report.filter(r => r && typeof r === "object") : [];
+
+  const stale = rows.filter(s => s.action_required || s.currency_label !== "current");
+  const drifting = rows.filter(s => !s.action_required && s.currency_label !== "current");
+  const actionable = rows.filter(s => s.action_required);
+  const critical = rows.filter(s => s.currency_score !== undefined && s.currency_score < 50);
+
+  // The report-level flag is honored even when no row carries action_required,
+  // so an upstream that raises the flag some other way still fails closed.
+  const ok = actionable.length === 0 && !actionRequired;
+
+  return {
+    ok,
+    severity: ok && drifting.length > 0 ? "warn" : null,
+    stale,
+    drifting,
+    actionable,
+    critical,
+  };
+}
+
+module.exports = { classifyCurrency };

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.18.26",
+  "version": "0.18.28",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-07-23T05:37:43.146Z",
+      "signed_at": "2026-08-06T01:22:51.525Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -133,7 +133,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "dbRdAJTIpiZSAjWFIWVhWRu3qgaM55Ny0zS3GUIXQmOMtpC1lZuGn5LEamgeC/SSm74wSfKpK4/kdwdx4BIMAA==",
-      "signed_at": "2026-07-23T05:37:43.147Z",
+      "signed_at": "2026-08-06T01:22:51.526Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -215,7 +215,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "wREB+mZgthecczhafoQfp/Wu8n46J32vh35NtW4t5ZiY5mw9817koZTateEsGz1mEHi/97o3cGfZ+H5pFpHsDA==",
-      "signed_at": "2026-07-23T05:37:43.147Z",
+      "signed_at": "2026-08-06T01:22:51.527Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -269,7 +269,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "XEKGT1cf1DN2+hWFvUPafEELu2YwcAGAr9tenXS4Gxr3R1sXYcHd1thidl2mpkTS9crr/nK/GjXcuvlUezXKBA==",
-      "signed_at": "2026-07-23T05:37:43.148Z"
+      "signed_at": "2026-08-06T01:22:51.527Z"
     },
     {
       "name": "compliance-theater",
@@ -301,7 +301,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "URNMHfqGBDdGthW22sGLq/x9sVwYgvKRO9zEOFPcTLbk4LkPqJXF3My4DxELtmqOuWjDLAJCt8Tku9mQWpPeAw==",
-      "signed_at": "2026-07-23T05:37:43.148Z"
+      "signed_at": "2026-08-06T01:22:51.527Z"
     },
     {
       "name": "exploit-scoring",
@@ -332,7 +332,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "ZOQ/MWqQQXZs2xR/NiILzkS2vdCaf6P5Rqb0cmKeiCCTlXDPnNN5z5xPmKXtAACDtTJEpbgBAO6v3nkw0lVgDQ==",
-      "signed_at": "2026-07-23T05:37:43.148Z"
+      "signed_at": "2026-08-06T01:22:51.528Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -374,7 +374,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "YRWSEG//Fmphj33NthT8fhvu9Oz1fhYlYAwqeIvx2ikUlqjESDdF0fTiVwW747uBZW/lPXFHNjl4JafMrcy2Dg==",
-      "signed_at": "2026-07-23T05:37:43.149Z",
+      "signed_at": "2026-08-06T01:22:51.528Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -441,7 +441,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "zBEmuGZrhaLW7hgc6aDkHABw4iuu0+7pwtsb7aCj7K9T40xAIkVnSyv92G9btmsX2vuc65Vlav3fi9QAYEvGDQ==",
-      "signed_at": "2026-07-23T05:37:43.149Z",
+      "signed_at": "2026-08-06T01:22:51.528Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -482,7 +482,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "cttcHeZekjEzbbcfinlU8SDTJAhqoAePL/CSf+zTBmMy+YWE0Lzi9Cv9CSi0g51BHrimVm8iSP+BagXC0C/dDQ==",
-      "signed_at": "2026-07-23T05:37:43.149Z",
+      "signed_at": "2026-08-06T01:22:51.528Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -517,7 +517,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "o9JHAYXEU1PZBqSSu7nyy7PWY1ML9y51gEb73N/eaCLBSw6CuGdpyxGwWRYb9kS1o7Px+p3HsXt2Iu3xa+CACQ==",
-      "signed_at": "2026-07-23T05:37:43.150Z",
+      "signed_at": "2026-08-06T01:22:51.529Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -550,14 +550,30 @@
         "global-frameworks.json",
         "framework-control-gaps.json",
         "atlas-ttps.json",
-        "exploit-availability.json"
+        "exploit-availability.json",
+        "d3fend-catalog.json"
       ],
       "atlas_refs": [],
       "attack_refs": [],
       "framework_gaps": [],
-      "last_threat_review": "2026-05-01",
-      "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-07-23T05:37:43.150Z"
+      "last_threat_review": "2026-08-05",
+      "signature": "Eu2AnT4xyZH9n3OKjm5S9vaiHqUE+1N3oLAQbbt78OCp2HnAQMvqBkUn9rgl4Il7Il7yZW8N7c8hq3mkst+EAA==",
+      "signed_at": "2026-08-06T01:22:51.529Z",
+      "d3fend_refs": [
+        "D3-EAL",
+        "D3-EFA",
+        "D3-FAPA",
+        "D3-FE",
+        "D3-IOPR",
+        "D3-KBPI",
+        "D3-MENCR",
+        "D3-MFA",
+        "D3-NI",
+        "D3-NTA",
+        "D3-OTF",
+        "D3-SCA",
+        "D3-CSPP"
+      ]
     },
     {
       "name": "zeroday-gap-learn",
@@ -584,7 +600,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "agl+LgS9xwvNt1fl6nJbVH83viNa36KlxQF9x6w1YJ9rDJztsPn4BzbVIgZOMf77DW+N9sR8hH0Zu1OEmah8Dg==",
-      "signed_at": "2026-07-23T05:37:43.151Z",
+      "signed_at": "2026-08-06T01:22:51.530Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -635,7 +651,8 @@
         "RFC-9420",
         "RFC-9794",
         "RFC-8032",
-        "RFC-9106"
+        "RFC-9106",
+        "RFC-9954"
       ],
       "forward_watch": [
         "NIST FIPS 206 (HQC — backup KEM)",
@@ -650,9 +667,9 @@
         "HSM/TPM vendor PQC firmware support timelines",
         "New CRQC timeline estimates from academic cryptanalysis"
       ],
-      "last_threat_review": "2026-06-10",
-      "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
-      "signed_at": "2026-07-23T05:37:43.151Z",
+      "last_threat_review": "2026-08-05",
+      "signature": "6KeXiUxE1hd6oQslSAXaMerPn+Z+mG/w/Wch5j6hCjfWJYt0tTwthl695bywswR2NnqJvpK3Kn3iVwdy2Pv8AQ==",
+      "signed_at": "2026-08-06T01:22:51.530Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -702,7 +719,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "8W0alFz9LpOQqTYN7YXVPEmgI1eT3bsBlda+FH9fT7fmysWVVQAFA5y0teqUH0jRMCbTPbh3WYQv8wLO7nJgBw==",
-      "signed_at": "2026-07-23T05:37:43.151Z"
+      "signed_at": "2026-08-06T01:22:51.530Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -727,7 +744,9 @@
         "cve-catalog.json",
         "framework-control-gaps.json",
         "global-frameworks.json",
-        "atlas-ttps.json"
+        "atlas-ttps.json",
+        "d3fend-catalog.json",
+        "rfc-references.json"
       ],
       "atlas_refs": [],
       "attack_refs": [],
@@ -738,11 +757,29 @@
         "New tooling that makes higher tiers more accessible",
         "PQC tooling maturity shifting overkill to practical"
       ],
-      "last_threat_review": "2026-05-01",
-      "signature": "Dzw2woUGYArKvAcX2KKzLWd1crA/OjMiyMoDfVvDnFZqdCfbrCpaRnw3i21DN30B6lqu6/0PauMFfS73f+ukBg==",
-      "signed_at": "2026-07-23T05:37:43.152Z",
+      "last_threat_review": "2026-08-05",
+      "signature": "jVPmV3GovoD3lkbyamm+bcf0vn8PBgn9gWoYwbV4UKIWbyNSlwnxS/BV2EMujPyfX8bU9yplbUPORKikDoX6BQ==",
+      "signed_at": "2026-08-06T01:22:51.531Z",
       "cwe_refs": [
         "CWE-1188"
+      ],
+      "rfc_refs": [
+        "RFC-9954"
+      ],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-EAL",
+        "D3-EFA",
+        "D3-FAPA",
+        "D3-IOPR",
+        "D3-ITF",
+        "D3-KBPI",
+        "D3-MENCR",
+        "D3-MFA",
+        "D3-NI",
+        "D3-NTA",
+        "D3-OTF",
+        "D3-SCA"
       ]
     },
     {
@@ -776,7 +813,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-07-23T05:37:43.152Z"
+      "signed_at": "2026-08-06T01:22:51.531Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -852,7 +889,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "IPf8oR/blIXjsRHEc+2BNbjIYtgikabF/c+6Xfs5vilFf0mBgJTKAqmJNfrSNPQuCSmuA+Ltbv6eCgJlLBLyDw==",
-      "signed_at": "2026-07-23T05:37:43.152Z"
+      "signed_at": "2026-08-06T01:22:51.531Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -913,7 +950,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "sl+sYiVwJIEkkPVM/bz+OTILrFfMLc2QDrpA8c19dF9Qc8P30bOXjI3SO6uZin/aWSDfmM5IdFOleREazdMTAA==",
-      "signed_at": "2026-07-23T05:37:43.153Z"
+      "signed_at": "2026-08-06T01:22:51.531Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -991,7 +1028,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "OVAUEww37jlj+90k52kQs7O+IX/wZGM/dFUuPQzKEs9ja0Czm2DXpmRjYqVv7PlDvOL22Ew0yV9LKQfldmGkBA==",
-      "signed_at": "2026-07-23T05:37:43.153Z"
+      "signed_at": "2026-08-06T01:22:51.532Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1075,7 +1112,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "c8TcF8E5Fyufm6Gn3ceIhJfGnGEbmzl+W0DqmdF+IHW07KB4Wo11ctkp2IFSsmQIFoxhIjkMyUHaC7UV4MlMCA==",
-      "signed_at": "2026-07-23T05:37:43.153Z"
+      "signed_at": "2026-08-06T01:22:51.532Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1132,7 +1169,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-07-23T05:37:43.153Z"
+      "signed_at": "2026-08-06T01:22:51.532Z"
     },
     {
       "name": "identity-assurance",
@@ -1206,7 +1243,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-07-23T05:37:43.154Z"
+      "signed_at": "2026-08-06T01:22:51.533Z"
     },
     {
       "name": "ot-ics-security",
@@ -1265,7 +1302,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "5H2gSx4XzIg0/y/zCiB4pusEmLMsK8WDwPP3/R8OM1TDULKDZyEbWfvaWaLMobU17KbVVr6fc80royegGx4qAQ==",
-      "signed_at": "2026-07-23T05:37:43.154Z"
+      "signed_at": "2026-08-06T01:22:51.533Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1325,7 +1362,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "AaTylp+zWRfJF5vAcJlImdnAxNeMFboe4tZ9N+V7eDF40BKDC7TX2Lb7u69X4Ry5zxBAqx0tOEpesni1DNOzDA==",
-      "signed_at": "2026-07-23T05:37:43.154Z"
+      "signed_at": "2026-08-06T01:22:51.533Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1379,7 +1416,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "q/F/WUeakWNZOJ542rRsMgtM0Ium2AkkDBLOju3vG0+m8PtO/yuBhffhPrL/U6IvGDH6xaoYP+zvqTkaTcB7CQ==",
-      "signed_at": "2026-07-23T05:37:43.155Z"
+      "signed_at": "2026-08-06T01:22:51.534Z"
     },
     {
       "name": "webapp-security",
@@ -1462,7 +1499,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "giKG4Spsb/a9y6GD1k6rKCYWLl3rMRYGt9RxBsb8WknNGSYi/Hz4PB+UnztgsN9JYl07PjL+DE3iAHbgh3GZAQ==",
-      "signed_at": "2026-07-23T05:37:43.155Z",
+      "signed_at": "2026-08-06T01:22:51.534Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1522,7 +1559,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-07-23T05:37:43.155Z"
+      "signed_at": "2026-08-06T01:22:51.534Z"
     },
     {
       "name": "sector-healthcare",
@@ -1589,7 +1626,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "0HQkFkUf8EMaPetY4lFsy/11V96wk+YeMSEyY5CWrjC9hQ3vZ0fPsPLWe8EzBxOhgxrt55RXDrBGArmB2i4cAw==",
-      "signed_at": "2026-07-23T05:37:43.156Z"
+      "signed_at": "2026-08-06T01:22:51.534Z"
     },
     {
       "name": "sector-financial",
@@ -1678,7 +1715,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "zgUqH1eeQlUSB99dWskBa0vBqC9PR7zhIYkBjB/aksWlc0uvqGMXOfusT3kObX+TB1pgTgIyTWUfZqjWyBrSAg==",
-      "signed_at": "2026-07-23T05:37:43.156Z"
+      "signed_at": "2026-08-06T01:22:51.535Z"
     },
     {
       "name": "sector-federal-government",
@@ -1755,7 +1792,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "3xBhtZe9UrcdmfmnQPqnu+5m8MrvT1rT/zlpbQhNuCdJZXwv2ovJCxQUPULP0WVvSrJHfvvmkaTbPUtA1C5MDw==",
-      "signed_at": "2026-07-23T05:37:43.156Z"
+      "signed_at": "2026-08-06T01:22:51.535Z"
     },
     {
       "name": "sector-energy",
@@ -1829,7 +1866,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "Bwycwk/pJ19YtZpifD2/MKbs8KkzfpUzYNVswjOfqEBPUiZKhMPTY1TdEyPnNyQvgB1BVHW/z+WpQ9CW9P9cBQ==",
-      "signed_at": "2026-07-23T05:37:43.157Z"
+      "signed_at": "2026-08-06T01:22:51.536Z"
     },
     {
       "name": "sector-telecom",
@@ -1915,7 +1952,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-07-23T05:37:43.158Z"
+      "signed_at": "2026-08-06T01:22:51.536Z"
     },
     {
       "name": "api-security",
@@ -1994,7 +2031,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "JAIe0jXjIIKUC8kYNCN9ZBMhoSSdbNskIg7/lKKAXzACf/uFpjlhaOY8Sm4j8ivAtgHdqyrsIeRy7P8SWm8yBw==",
-      "signed_at": "2026-07-23T05:37:43.158Z",
+      "signed_at": "2026-08-06T01:22:51.536Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2089,7 +2126,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "L1DVbQq61lkUrAz/DkV/Je9u653qhyUoTfGrUEgbHrc/rX4UWYOnWObR0P3EsPPq5t9GS8YKsMkZH0WJevAxAQ==",
-      "signed_at": "2026-07-23T05:37:43.158Z"
+      "signed_at": "2026-08-06T01:22:51.537Z"
     },
     {
       "name": "container-runtime-security",
@@ -2161,7 +2198,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "s4kKyXP0UVCE4IAo2ogL7Vb9YygYZxvWgx5azGfehLQKwBZ4RinUBdlqC/OhRdzi/ZpCGAViEGusGHexKmNXAA==",
-      "signed_at": "2026-07-23T05:37:43.158Z",
+      "signed_at": "2026-08-06T01:22:51.537Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2242,7 +2279,7 @@
         "MITRE ATLAS v2026.06 (released June 2026) is additive over v2026.05 — it adds AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) and refreshes AML.T0054 (LLM Jailbreak), with no technique-ID removals. Earlier releases shipped the AML.T0010 sub-technique expansion and agentic-AI techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\") this forecast tracked. Forward watch: subsequent monthly ATLAS releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "Lksu8f3T2mlR1mzDVLFPNknjR7gi9ZyQkCTx5z3Pp7Wb2BYB4tixL1DkWQiX0TO5ay9n6OrlG724tELESAUGBw==",
-      "signed_at": "2026-07-23T05:37:43.159Z"
+      "signed_at": "2026-08-06T01:22:51.537Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2316,7 +2353,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "YseIGVsCqWXjavUPbmbgeTRKDOhFPgVqm453+n0z7haj4DNeKobnNVK8ZCYj+YDJ1A5c5Sg/EF4/UUYpD5qIDw==",
-      "signed_at": "2026-07-23T05:37:43.159Z"
+      "signed_at": "2026-08-06T01:22:51.538Z"
     },
     {
       "name": "ransomware-response",
@@ -2396,7 +2433,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "aKpZzYGkstC1E3FPjf0gpwObUoCOzztBFjfa8/e5alOfcqYX1oryKo8A/j8QpVwSOTJ5nab+2DMHtvyrXq5hAQ==",
-      "signed_at": "2026-07-23T05:37:43.159Z"
+      "signed_at": "2026-08-06T01:22:51.538Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2464,7 +2501,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-07-23T05:37:43.160Z"
+      "signed_at": "2026-08-06T01:22:51.538Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2539,7 +2576,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "Bk+pigkDpy/jexcfQBZLPZR0+CnO7XW5gF4UCMf10ZWPB43iOR89UC+MYr7VUDybgaH20LPIZPCHuy+LFq9+Dw==",
-      "signed_at": "2026-07-23T05:37:43.160Z"
+      "signed_at": "2026-08-06T01:22:51.539Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2619,7 +2656,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-07-23T05:37:43.160Z",
+      "signed_at": "2026-08-06T01:22:51.539Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2713,7 +2750,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-07-23T05:37:43.161Z",
+      "signed_at": "2026-08-06T01:22:51.539Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2785,7 +2822,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-07-23T05:37:43.161Z"
+      "signed_at": "2026-08-06T01:22:51.539Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2844,7 +2881,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-07-23T05:37:43.161Z"
+      "signed_at": "2026-08-06T01:22:51.540Z"
     },
     {
       "name": "network-trust",
@@ -2900,7 +2937,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-07-23T05:37:43.161Z"
+      "signed_at": "2026-08-06T01:22:51.540Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2955,7 +2992,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-07-23T05:37:43.161Z"
+      "signed_at": "2026-08-06T01:22:51.540Z"
     },
     {
       "name": "self-update-integrity",
@@ -3009,7 +3046,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-07-23T05:37:43.161Z"
+      "signed_at": "2026-08-06T01:22:51.540Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3067,7 +3104,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-07-23T05:37:43.162Z"
+      "signed_at": "2026-08-06T01:22:51.540Z"
     },
     {
       "name": "decompression-dos",
@@ -3125,7 +3162,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-07-23T05:37:43.162Z"
+      "signed_at": "2026-08-06T01:22:51.541Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3180,7 +3217,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-07-23T05:37:43.162Z"
+      "signed_at": "2026-08-06T01:22:51.541Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3235,11 +3272,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-07-23T05:37:43.162Z"
+      "signed_at": "2026-08-06T01:22:51.541Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "FW9xL0DnlZTCFRsw/kjaj84U33OOVq4rKVHp2rYh+dy7j5Vdl3bI22P7hjQQp5wmqwlpIaqRGNLI3v2Nv89XDw=="
+    "signature_base64": "CGwVEARUHNMrIqRS3aBQhxyKZ0CrOf9OjPbgCGn3xl8hKunkQZpbLmdI/IjIdfe48ef75dvccglvxbwWAsbABg=="
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.26",
-  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (823 CVEs / 218 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+  "version": "0.18.28",
+  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (923 CVEs / 220 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
     "ai-skills",