@blamejs/exceptd-skills 0.18.30 → 0.19.1

package/data/_indexes/summary-cards.json

@@ -64,7 +64,7 @@
       ]
     },
     "ai-attack-surface": {
-      "description": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.06 with explicit framework gap flags",
+      "description": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.07 with explicit framework gap flags",
       "threat_context_excerpt": "The AI attack surface is not speculative. It is actively exploited. The following are confirmed, documented threats as of mid-2026.",
       "produces": "The assessment produces a structured AI Attack Surface Assessment report. The shape below is consumed downstream by `mcp-agent-trust` (which converts the MCP Trust Assessment section into per-server policy), by `rag-pipeline-security` (which picks up any RAG-pipeline entries from the Surface Inventory), and by `incident-response-playbook` (which scopes IR against the prompt-injection and AI-C2 exposure bands). CSAF-style auditor evidence bundles consume the Framework Gaps and ATLAS TTP Coverage Gaps sections verbatim — preserve the framework-control IDs as cited.\n\n```\n## AI Attack Surface Asse ...",
       "key_xrefs": {
@@ -980,7 +980,7 @@
           "AML.T0010"
         ],
         "attack_refs": [
-          "T0855",
+          "T1692.001",
           "T0883",
           "T1190",
           "T1068"
@@ -1447,7 +1447,7 @@
         ],
         "atlas_refs": [],
         "attack_refs": [
-          "T0855",
+          "T1692.001",
           "T0883",
           "T1190",
           "T1078"
@@ -2321,7 +2321,7 @@
         "attack_refs": [
           "T1070",
           "T1565.001",
-          "T1562.008"
+          "T1685.002"
         ],
         "rfc_refs": [],
         "dlp_refs": []

package/data/_indexes/token-budget.json

@@ -3,8 +3,8 @@
     "schema_version": "1.0.0",
     "tokenizer_note": "Character-density approximation: 1 token ≈ 4 chars. This is the canonical rule-of-thumb for OpenAI tokenizers on English+technical text. Claude's tokenizer is typically more efficient on prose; treat this as an upper-bound budget for both. Consumers with stricter precision needs should re-tokenize with their own tokenizer.",
     "approx_chars_per_token": 4,
-    "total_chars": 1767897,
-    "total_approx_tokens": 441982,
+    "total_chars": 1767951,
+    "total_approx_tokens": 441995,
     "skill_count": 51
   },
   "skills": {
@@ -580,10 +580,10 @@
     },
     "threat-model-currency": {
       "path": "skills/threat-model-currency/skill.md",
-      "bytes": 33297,
-      "chars": 33111,
+      "bytes": 33301,
+      "chars": 33115,
       "lines": 448,
-      "approx_tokens": 8278,
+      "approx_tokens": 8279,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -597,9 +597,9 @@
           "approx_tokens": 135
         },
         "the-14-threat-class-checklist": {
-          "bytes": 11120,
-          "chars": 11106,
-          "approx_tokens": 2777
+          "bytes": 11124,
+          "chars": 11110,
+          "approx_tokens": 2778
         },
         "threat-context": {
           "bytes": 1831,
@@ -870,10 +870,10 @@
     },
     "skill-update-loop": {
       "path": "skills/skill-update-loop/skill.md",
-      "bytes": 47847,
-      "chars": 47713,
+      "bytes": 47843,
+      "chars": 47709,
       "lines": 522,
-      "approx_tokens": 11928,
+      "approx_tokens": 11927,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -887,9 +887,9 @@
           "approx_tokens": 385
         },
         "ttp-mapping": {
-          "bytes": 1092,
-          "chars": 1090,
-          "approx_tokens": 273
+          "bytes": 1088,
+          "chars": 1086,
+          "approx_tokens": 272
         },
         "why-skills-decay": {
           "bytes": 887,
@@ -1400,10 +1400,10 @@
     },
     "ot-ics-security": {
       "path": "skills/ot-ics-security/skill.md",
-      "bytes": 37122,
-      "chars": 36924,
+      "bytes": 37134,
+      "chars": 36936,
       "lines": 344,
-      "approx_tokens": 9231,
+      "approx_tokens": 9234,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -1417,9 +1417,9 @@
           "approx_tokens": 1118
         },
         "ttp-mapping": {
-          "bytes": 3736,
-          "chars": 3712,
-          "approx_tokens": 928
+          "bytes": 3744,
+          "chars": 3720,
+          "approx_tokens": 930
         },
         "exploit-availability-matrix": {
           "bytes": 2319,
@@ -1855,16 +1855,16 @@
     },
     "sector-energy": {
       "path": "skills/sector-energy/skill.md",
-      "bytes": 54792,
-      "chars": 54582,
+      "bytes": 54824,
+      "chars": 54614,
       "lines": 412,
-      "approx_tokens": 13646,
+      "approx_tokens": 13654,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
-          "bytes": 5378,
-          "chars": 5348,
-          "approx_tokens": 1337
+          "bytes": 5386,
+          "chars": 5356,
+          "approx_tokens": 1339
         },
         "framework-lag-declaration": {
           "bytes": 8344,
@@ -1872,9 +1872,9 @@
           "approx_tokens": 2082
         },
         "ttp-mapping": {
-          "bytes": 6378,
-          "chars": 6358,
-          "approx_tokens": 1590
+          "bytes": 6394,
+          "chars": 6374,
+          "approx_tokens": 1594
         },
         "exploit-availability-matrix": {
           "bytes": 4027,
@@ -1882,9 +1882,9 @@
           "approx_tokens": 1000
         },
         "analysis-procedure": {
-          "bytes": 10946,
-          "chars": 10902,
-          "approx_tokens": 2726
+          "bytes": 10950,
+          "chars": 10906,
+          "approx_tokens": 2727
         },
         "output-format": {
           "bytes": 3460,
@@ -2185,10 +2185,10 @@
     },
     "incident-response-playbook": {
       "path": "skills/incident-response-playbook/skill.md",
-      "bytes": 63031,
-      "chars": 62779,
+      "bytes": 63036,
+      "chars": 62784,
       "lines": 549,
-      "approx_tokens": 15695,
+      "approx_tokens": 15696,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -2202,9 +2202,9 @@
           "approx_tokens": 2541
         },
         "ttp-mapping": {
-          "bytes": 4952,
-          "chars": 4944,
-          "approx_tokens": 1236
+          "bytes": 4957,
+          "chars": 4949,
+          "approx_tokens": 1237
         },
         "exploit-availability-matrix": {
           "bytes": 3811,
@@ -2240,10 +2240,10 @@
     },
     "ransomware-response": {
       "path": "skills/ransomware-response/skill.md",
-      "bytes": 48434,
-      "chars": 48252,
+      "bytes": 48439,
+      "chars": 48257,
       "lines": 371,
-      "approx_tokens": 12063,
+      "approx_tokens": 12064,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -2257,9 +2257,9 @@
           "approx_tokens": 1692
         },
         "ttp-mapping": {
-          "bytes": 2237,
-          "chars": 2235,
-          "approx_tokens": 559
+          "bytes": 2242,
+          "chars": 2240,
+          "approx_tokens": 560
         },
         "exploit-availability-matrix": {
           "bytes": 2592,

package/data/_indexes/xref.json

@@ -1157,7 +1157,7 @@
     "T1110": [
       "identity-assurance"
     ],
-    "T0855": [
+    "T1692.001": [
       "ot-ics-security",
       "sector-energy"
     ],
@@ -1246,7 +1246,7 @@
       "log-injection-telemetry",
       "privacy-consent-ops"
     ],
-    "T1562.008": [
+    "T1685.002": [
       "audit-log-integrity"
     ],
     "T1574": [

package/data/atlas-ttps.json

@@ -1,14 +1,14 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "atlas_version": "2026.06",
-    "atlas_release_date": "2026-06-30",
+    "atlas_version": "2026.07",
+    "atlas_release_date": "2026-08-07",
     "secure_ai_v2_release_date": "2026-05-06",
     "secure_ai_v2_source": "https://ctid.mitre.org/blog/2026/05/06/secure-ai-v2-release",
-    "last_updated": "2026-07-03",
-    "last_threat_review": "2026-07-03",
+    "last_updated": "2026-08-08",
+    "last_threat_review": "2026-08-08",
     "source": "https://atlas.mitre.org",
-    "note": "AI-relevant ATLAS TTPs with framework_gap field, curated as a subset of the full ATLAS matrix and pinned to v2026.06. ATLAS content follows a YYYY.MM calendar-versioning scheme; the CalVer scheme and the per-technique platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) were introduced in v2026.05. The v2026.05 → v2026.06 audit (AGENTS.md Hard Rule #12) confirmed the release is additive with NO technique-ID removals or renames, so every AML.T* id curated in this file remains valid. Upstream v2026.06 additionally published three new techniques — AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) — refreshed AML.T0054 (LLM Jailbreak), and shipped new case studies (EchoLeak zero-click prompt injection, AI-in-the-Middle C2 relays, Semantic Kernel RCE); these newly-published techniques are not yet ingested into this curated subset and are tracked as future-curation candidates (the subset intentionally trails the full matrix, e.g. 170 curated of the full ATLAS technique set). framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
+    "note": "AI-relevant ATLAS TTPs with framework_gap field, curated as a subset of the full ATLAS matrix and pinned to v2026.07. ATLAS content follows a YYYY.MM calendar-versioning scheme; the CalVer scheme and the per-technique platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) were introduced in v2026.05. The v2026.05 → v2026.07 audit (AGENTS.md Hard Rule #12) confirmed the release is additive with NO technique-ID removals or renames, so every AML.T* id curated in this file remains valid. Upstream v2026.07 additionally published three new techniques — AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) — refreshed AML.T0054 (LLM Jailbreak), and shipped new case studies (EchoLeak zero-click prompt injection, AI-in-the-Middle C2 relays, Semantic Kernel RCE); these newly-published techniques are not yet ingested into this curated subset and are tracked as future-curation candidates (the subset intentionally trails the full matrix, e.g. 170 curated of the full ATLAS technique set). framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
     "tlp": "CLEAR",
     "source_confidence": {
       "scheme": "Admiralty (A-F + 1-6)",
@@ -21,7 +21,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "bulk_intake_note": " v0.13.18: +137 AML.* techniques from MITRE ATLAS STIX bundle (atlas-navigator-data dist/stix-atlas.json). Now tracking ATLAS v2026.06 (June 2026 release). Auto-imported entries flagged _auto_imported:true + _intake_method:v0.13.18-bulk-mitre-atlas-stix for downstream curation."
+    "bulk_intake_note": " v0.13.18: +137 AML.* techniques from MITRE ATLAS STIX bundle (atlas-navigator-data dist/stix-atlas.json). Now tracking ATLAS v2026.07 (June 2026 release). Auto-imported entries flagged _auto_imported:true + _intake_method:v0.13.18-bulk-mitre-atlas-stix for downstream curation."
   },
   "AML.T0001": {
     "id": "AML.T0001",
@@ -536,7 +536,7 @@
       "Multiple production AI assistant prompt injection incidents 2025-2026"
     ],
     "framework_gap": true,
-    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v2026.06 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
+    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v2026.07 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
     "controls_that_partially_help": [
       "NIST-800-53-AC-2",
       "ISO-27001-2022-A.8.28"
@@ -1037,45 +1037,6 @@
     "stix_id": "attack-pattern--f8d5be4e-b5f8-5b61-bdc9-3a8818327210",
     "is_subtechnique": false
   },
-  "AML.T0104": {
-    "id": "AML.T0104",
-    "name": "Publish Poisoned AI Agent Tool",
-    "tactic": "Resource Development",
-    "description": "Adversary publishes a poisoned AI agent tool — MCP server, plugin, function-calling package — to a registry where it will be discovered and installed by victim agents. Distinguished from T0010 (general supply-chain compromise) by being scoped to AI-agent tool registries and from T0053 (plugin compromise) by being the publishing step rather than the runtime trust failure.",
-    "subtechniques": [
-      "AML.T0104.000 — Typosquat publish to MCP registry",
-      "AML.T0104.001 — Compromised-account publish to agent-tool registry",
-      "AML.T0104.002 — Slow-poison via legitimate-tool update with later backdoor"
-    ],
-    "real_world_instances": [
-      "CVE-2026-30615 — Windsurf MCP zero-interaction RCE via published tool",
-      "MCP registry typosquat campaigns 2025-2026"
-    ],
-    "framework_gap": true,
-    "framework_gap_detail": "No framework has a publish-time control for AI-agent tool registries. SA-12 supply chain assumes traditional package registries. No framework requires Ed25519-style signing or registry-side review on agent-tool publishes.",
-    "controls_that_partially_help": [
-      "NIST-800-53-SA-12",
-      "ISO-27001-2022-A.8.30"
-    ],
-    "controls_that_dont_help": [
-      "NIST-800-53-SI-3"
-    ],
-    "detection": "Registry-side reputation scoring on newly published tools; signature requirement enforcement at registry boundary; victim-side allowlist of audited tools",
-    "exceptd_skills": [],
-    "secure_ai_v2_layer": true,
-    "maturity": "high",
-    "last_verified": "2026-05-19",
-    "description_full": "Adversaries may create and publish poisoned AI agent tools. Poisoned tools may contain an [LLM Prompt Injection](/techniques/AML.T0051), which can lead to a variety of impacts. Tools may be published to open source version control repositories (e.g. GitHub, GitLab), to package registries (e.g. npm), or to repositories specifically designed for sharing tools (e.g. OpenClaw Hub). These registries may be largely unregulated and may contain many poisoned tools [\\[1\\]][1]. Tools may also be published as remotely hosted servers [\\[2\\]][2]. [1]: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto [2]: https://mcpservers.org/remote-mcp-servers",
-    "platforms": [
-      "ATLAS"
-    ],
-    "reference_url": "https://atlas.mitre.org/techniques/AML.T0104",
-    "stix_id": "attack-pattern--04842d98-bb69-586e-9765-6ff1f56ef722",
-    "is_subtechnique": false,
-    "cve_refs": [
-      "CVE-2025-54136"
-    ]
-  },
   "AML.T0105": {
     "id": "AML.T0105",
     "name": "Escape to Host",
@@ -1531,22 +1492,6 @@
     "stix_id": "attack-pattern--d74153d6-ac3c-52fb-9847-e0a6f675cd93",
     "is_subtechnique": false
   },
-  "AML.T0019": {
-    "id": "AML.T0019",
-    "name": "Publish Poisoned Datasets",
-    "tactic": "Resource Development",
-    "description": "Adversaries may [Poison Training Data](/techniques/AML.T0020) and publish it to a public location.",
-    "reference_url": "https://atlas.mitre.org/techniques/AML.T0019",
-    "last_verified": "2026-05-19",
-    "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
-    "description_full": "Adversaries may [Poison Training Data](/techniques/AML.T0020) and publish it to a public location. The poisoned dataset may be a novel dataset or a poisoned variant of an existing open source dataset. This data may be introduced to a victim system via [AI Supply Chain Compromise](/techniques/AML.T0010).",
-    "platforms": [
-      "ATLAS"
-    ],
-    "stix_id": "attack-pattern--c38896b2-974c-5ed5-adeb-c2477b311353",
-    "is_subtechnique": false
-  },
   "AML.T0021": {
     "id": "AML.T0021",
     "name": "Establish Accounts",
@@ -1870,22 +1815,6 @@
     "stix_id": "attack-pattern--b8b16dac-3b95-59f7-8bf7-60e39b0c062f",
     "is_subtechnique": false
   },
-  "AML.T0058": {
-    "id": "AML.T0058",
-    "name": "Publish Poisoned Models",
-    "tactic": "Resource Development",
-    "description": "Adversaries may publish a poisoned model to a public location such as a model registry or code repository.",
-    "reference_url": "https://atlas.mitre.org/techniques/AML.T0058",
-    "last_verified": "2026-05-19",
-    "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
-    "description_full": "Adversaries may publish a poisoned model to a public location such as a model registry or code repository. The poisoned model may be a novel model or a poisoned variant of an existing open-source model. This model may be introduced to a victim system via [AI Supply Chain Compromise](/techniques/AML.T0010).",
-    "platforms": [
-      "ATLAS"
-    ],
-    "stix_id": "attack-pattern--d4c7f78e-4609-555c-a2eb-3d344dab3309",
-    "is_subtechnique": false
-  },
   "AML.T0059": {
     "id": "AML.T0059",
     "name": "Erode Dataset Integrity",
@@ -3678,5 +3607,93 @@
     ],
     "stix_id": "attack-pattern--bd0fd9ca-cc30-542e-9c1a-de9f66c9455b",
     "is_subtechnique": true
+  },
+  "AML.T0115": {
+    "id": "AML.T0115",
+    "name": "Publish Poisoned AI Artifacts",
+    "tactic": "Resource Development",
+    "is_subtechnique": false,
+    "subtechniques": [
+      "AML.T0115.000",
+      "AML.T0115.001",
+      "AML.T0115.002"
+    ],
+    "reference_url": "https://atlas.mitre.org/techniques/AML.T0115",
+    "description": "Adversary publishes a poisoned AI artifact — a dataset, a model, or an agent tool — to a distribution channel where a victim will discover and consume it. ATLAS 2026.07 consolidated the three previously separate publish-poisoned techniques under this parent; the sub-techniques record which artifact class is published.",
+    "supersedes": "AML.T0019, AML.T0058, AML.T0104",
+    "cve_refs": [],
+    "exceptd_skills": []
+  },
+  "AML.T0115.000": {
+    "id": "AML.T0115.000",
+    "name": "Publish Poisoned AI Artifacts: Datasets",
+    "tactic": "Resource Development",
+    "description": "Adversaries may [Poison Training Data](/techniques/AML.T0020) and publish it to a public location.",
+    "reference_url": "https://atlas.mitre.org/techniques/AML.T0115.000",
+    "last_verified": "2026-05-19",
+    "_auto_imported": true,
+    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
+    "description_full": "Adversaries may [Poison Training Data](/techniques/AML.T0020) and publish it to a public location. The poisoned dataset may be a novel dataset or a poisoned variant of an existing open source dataset. This data may be introduced to a victim system via [AI Supply Chain Compromise](/techniques/AML.T0010).",
+    "platforms": [
+      "ATLAS"
+    ],
+    "stix_id": "attack-pattern--c38896b2-974c-5ed5-adeb-c2477b311353",
+    "is_subtechnique": true,
+    "supersedes": "AML.T0019",
+    "parent_technique": "AML.T0115"
+  },
+  "AML.T0115.001": {
+    "id": "AML.T0115.001",
+    "name": "Publish Poisoned AI Artifacts: Models",
+    "tactic": "Resource Development",
+    "description": "Adversaries may publish a poisoned model to a public location such as a model registry or code repository.",
+    "reference_url": "https://atlas.mitre.org/techniques/AML.T0115.001",
+    "last_verified": "2026-05-19",
+    "_auto_imported": true,
+    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
+    "description_full": "Adversaries may publish a poisoned model to a public location such as a model registry or code repository. The poisoned model may be a novel model or a poisoned variant of an existing open-source model. This model may be introduced to a victim system via [AI Supply Chain Compromise](/techniques/AML.T0010).",
+    "platforms": [
+      "ATLAS"
+    ],
+    "stix_id": "attack-pattern--d4c7f78e-4609-555c-a2eb-3d344dab3309",
+    "is_subtechnique": true,
+    "supersedes": "AML.T0058",
+    "parent_technique": "AML.T0115"
+  },
+  "AML.T0115.002": {
+    "id": "AML.T0115.002",
+    "name": "Publish Poisoned AI Artifacts: AI Agent Tools",
+    "tactic": "Resource Development",
+    "description": "Adversary publishes a poisoned AI agent tool — MCP server, plugin, function-calling package — to a registry where it will be discovered and installed by victim agents. Distinguished from T0010 (general supply-chain compromise) by being scoped to AI-agent tool registries and from T0053 (plugin compromise) by being the publishing step rather than the runtime trust failure.",
+    "real_world_instances": [
+      "CVE-2026-30615 — Windsurf MCP zero-interaction RCE via published tool",
+      "MCP registry typosquat campaigns 2025-2026"
+    ],
+    "framework_gap": true,
+    "framework_gap_detail": "No framework has a publish-time control for AI-agent tool registries. SA-12 supply chain assumes traditional package registries. No framework requires Ed25519-style signing or registry-side review on agent-tool publishes.",
+    "controls_that_partially_help": [
+      "NIST-800-53-SA-12",
+      "ISO-27001-2022-A.8.30"
+    ],
+    "controls_that_dont_help": [
+      "NIST-800-53-SI-3"
+    ],
+    "detection": "Registry-side reputation scoring on newly published tools; signature requirement enforcement at registry boundary; victim-side allowlist of audited tools",
+    "exceptd_skills": [],
+    "secure_ai_v2_layer": true,
+    "maturity": "high",
+    "last_verified": "2026-05-19",
+    "description_full": "Adversaries may create and publish poisoned AI agent tools. Poisoned tools may contain an [LLM Prompt Injection](/techniques/AML.T0051), which can lead to a variety of impacts. Tools may be published to open source version control repositories (e.g. GitHub, GitLab), to package registries (e.g. npm), or to repositories specifically designed for sharing tools (e.g. OpenClaw Hub). These registries may be largely unregulated and may contain many poisoned tools [\\[1\\]][1]. Tools may also be published as remotely hosted servers [\\[2\\]][2]. [1]: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto [2]: https://mcpservers.org/remote-mcp-servers",
+    "platforms": [
+      "ATLAS"
+    ],
+    "reference_url": "https://atlas.mitre.org/techniques/AML.T0115.002",
+    "stix_id": "attack-pattern--04842d98-bb69-586e-9765-6ff1f56ef722",
+    "is_subtechnique": true,
+    "cve_refs": [
+      "CVE-2025-54136"
+    ],
+    "supersedes": "AML.T0104",
+    "parent_technique": "AML.T0115"
   }
 }