@blamejs/exceptd-skills 0.18.30 → 0.19.1

package/manifest.json

@@ -1,12 +1,12 @@
 {
   "name": "exceptd-security",
-  "version": "0.18.30",
+  "version": "0.19.1",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
-  "atlas_version": "2026.06",
-  "atlas_version_date": "2026-06-30",
-  "attack_version": "19.1",
+  "atlas_version": "2026.07",
+  "atlas_version_date": "2026-08-07",
+  "attack_version": "19.2",
   "attack_version_date": "2026-05-12",
   "threat_review_date": "2026-05-15",
   "sources_dir": "sources/",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-08-08T02:22:29.278Z",
+      "signed_at": "2026-08-08T07:07:14.047Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -132,8 +132,8 @@
         "AU-Essential-8-App-Hardening"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "dbRdAJTIpiZSAjWFIWVhWRu3qgaM55Ny0zS3GUIXQmOMtpC1lZuGn5LEamgeC/SSm74wSfKpK4/kdwdx4BIMAA==",
-      "signed_at": "2026-08-08T02:22:29.280Z",
+      "signature": "hnKY1LYEKUurrzJIFcvwCZpclpk/XT8fMVJeCKqzrpOpfgov2d3AciuiEky85PhREzAmYGFfk2sLRC6ayJ6UDw==",
+      "signed_at": "2026-08-08T07:07:14.050Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -214,8 +214,8 @@
         "RFC-9700"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "wREB+mZgthecczhafoQfp/Wu8n46J32vh35NtW4t5ZiY5mw9817koZTateEsGz1mEHi/97o3cGfZ+H5pFpHsDA==",
-      "signed_at": "2026-08-08T02:22:29.280Z",
+      "signature": "uiJt3Oj0lSLr7Nm0OoM2qI/z/oAIAiPwMfP12s97jVYeA7xfOlU21fc7zidT/9YulunfaSjBSAlgv6paWmosBg==",
+      "signed_at": "2026-08-08T07:07:14.053Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -268,8 +268,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "XEKGT1cf1DN2+hWFvUPafEELu2YwcAGAr9tenXS4Gxr3R1sXYcHd1thidl2mpkTS9crr/nK/GjXcuvlUezXKBA==",
-      "signed_at": "2026-08-08T02:22:29.280Z"
+      "signature": "80LN540R3z/gcIMCF/8H6nh2V6xdudctYKE74Ve7bqecyPUQf2NfCA/8T9L18tIz7BTyBkiI/V5JcG4ClgNyCQ==",
+      "signed_at": "2026-08-08T07:07:14.056Z"
     },
     {
       "name": "compliance-theater",
@@ -300,8 +300,8 @@
         "CMMC-2.0-Level-2"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "URNMHfqGBDdGthW22sGLq/x9sVwYgvKRO9zEOFPcTLbk4LkPqJXF3My4DxELtmqOuWjDLAJCt8Tku9mQWpPeAw==",
-      "signed_at": "2026-08-08T02:22:29.281Z"
+      "signature": "Tsat4OgtCJ6yGJQeIQnz+XTU11B8SLgbPe1zmb2UFOzxqlBnRoKeOzIVwFsv7wM0mP1bXQvQgFFpIOxN2VeTCQ==",
+      "signed_at": "2026-08-08T07:07:14.058Z"
     },
     {
       "name": "exploit-scoring",
@@ -331,8 +331,8 @@
         "CIS-Controls-v8-Control7"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "ZOQ/MWqQQXZs2xR/NiILzkS2vdCaf6P5Rqb0cmKeiCCTlXDPnNN5z5xPmKXtAACDtTJEpbgBAO6v3nkw0lVgDQ==",
-      "signed_at": "2026-08-08T02:22:29.281Z"
+      "signature": "zxsj3SExhBJ+A7UDZEI4uWl4OCbnn5+ddCRCalhlHKFyRML9fcB9qd1v9a+hDoeVJXGr/OBXHR3MdyD8XEhrDQ==",
+      "signed_at": "2026-08-08T07:07:14.060Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -373,8 +373,8 @@
         "AU-Essential-8-App-Hardening"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "YRWSEG//Fmphj33NthT8fhvu9Oz1fhYlYAwqeIvx2ikUlqjESDdF0fTiVwW747uBZW/lPXFHNjl4JafMrcy2Dg==",
-      "signed_at": "2026-08-08T02:22:29.281Z",
+      "signature": "jXnBa88P0p8onbTQNZE4XXWOKA0CBVeFY7ddkoilU5o/iXwoEqeAc779USZC71IPoCFMq+8dFMQgEov9m+5GCw==",
+      "signed_at": "2026-08-08T07:07:14.062Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -440,8 +440,8 @@
         "RFC-9000"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "zBEmuGZrhaLW7hgc6aDkHABw4iuu0+7pwtsb7aCj7K9T40xAIkVnSyv92G9btmsX2vuc65Vlav3fi9QAYEvGDQ==",
-      "signed_at": "2026-08-08T02:22:29.282Z",
+      "signature": "nqqZUnu7ZocLNJKs3KJO6NnoC8MgmS1iGP9TGrv51e+trjqb4Gf2mAjCTe7pINFivWDK00A0ZHazaMAKKbaNCA==",
+      "signed_at": "2026-08-08T07:07:14.063Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -481,8 +481,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "cttcHeZekjEzbbcfinlU8SDTJAhqoAePL/CSf+zTBmMy+YWE0Lzi9Cv9CSi0g51BHrimVm8iSP+BagXC0C/dDQ==",
-      "signed_at": "2026-08-08T02:22:29.282Z",
+      "signature": "ZfFXIDjwGDwlZA30TOMPmNr0IK/sydbsiox7LYU0pGkaRlQW18/oSjkHZRgiQpP5yzQhuFsKdztA7Ec6BDQLAA==",
+      "signed_at": "2026-08-08T07:07:14.065Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -516,8 +516,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "o9JHAYXEU1PZBqSSu7nyy7PWY1ML9y51gEb73N/eaCLBSw6CuGdpyxGwWRYb9kS1o7Px+p3HsXt2Iu3xa+CACQ==",
-      "signed_at": "2026-08-08T02:22:29.282Z",
+      "signature": "CtiEhtzaqg/hCGX1wmgEGq0O6o+UNf9RAM3xxn0rQVEkFt/IEmyYqsWd1qjpqMdp8kbEXgAsd816AwFwLYMaAA==",
+      "signed_at": "2026-08-08T07:07:14.068Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -558,7 +558,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-08-05",
       "signature": "Eu2AnT4xyZH9n3OKjm5S9vaiHqUE+1N3oLAQbbt78OCp2HnAQMvqBkUn9rgl4Il7Il7yZW8N7c8hq3mkst+EAA==",
-      "signed_at": "2026-08-08T02:22:29.283Z",
+      "signed_at": "2026-08-08T07:07:14.070Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -599,8 +599,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
-      "signature": "agl+LgS9xwvNt1fl6nJbVH83viNa36KlxQF9x6w1YJ9rDJztsPn4BzbVIgZOMf77DW+N9sR8hH0Zu1OEmah8Dg==",
-      "signed_at": "2026-08-08T02:22:29.283Z",
+      "signature": "tlvk8q1fa1scoDsJMZnigCoRNO3dqoK03Ve8tuYE2/nPwAMAGlofHpoE0mI0BX4pPODPgCfSjzgKEUn6HkcZDw==",
+      "signed_at": "2026-08-08T07:07:14.076Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -668,8 +668,8 @@
         "New CRQC timeline estimates from academic cryptanalysis"
       ],
       "last_threat_review": "2026-08-05",
-      "signature": "6KeXiUxE1hd6oQslSAXaMerPn+Z+mG/w/Wch5j6hCjfWJYt0tTwthl695bywswR2NnqJvpK3Kn3iVwdy2Pv8AQ==",
-      "signed_at": "2026-08-08T02:22:29.284Z",
+      "signature": "DNXmzLVK71XI/b9mkIBw30KVdVV5Wc9/0o/pP35RkferqtvlsMHjj4WJpoGXpIu8/hJyuMJRQrV7pzfR68iIAg==",
+      "signed_at": "2026-08-08T07:07:14.080Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -718,8 +718,8 @@
         "IETF RFC publications and draft status changes (datatracker.ietf.org, rfc-editor.org); run `npm run validate-rfcs` quarterly"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "8W0alFz9LpOQqTYN7YXVPEmgI1eT3bsBlda+FH9fT7fmysWVVQAFA5y0teqUH0jRMCbTPbh3WYQv8wLO7nJgBw==",
-      "signed_at": "2026-08-08T02:22:29.284Z"
+      "signature": "AzyfBZd5bxpQpaFb/S5ZJI2/NjeACLuq/u8GzKHehhlggWUqILIrS4aJ6eXn0I3UBhuXRcNBBx1mXriCSmhQAA==",
+      "signed_at": "2026-08-08T07:07:14.085Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -758,8 +758,8 @@
         "PQC tooling maturity shifting overkill to practical"
       ],
       "last_threat_review": "2026-08-05",
-      "signature": "jVPmV3GovoD3lkbyamm+bcf0vn8PBgn9gWoYwbV4UKIWbyNSlwnxS/BV2EMujPyfX8bU9yplbUPORKikDoX6BQ==",
-      "signed_at": "2026-08-08T02:22:29.284Z",
+      "signature": "8JHth6QjMcUuAD069/QvpMxgRMG+L/PVTE68/UdX9kG4SNA20ds7vHU15YzMNBmWWgiUvpLAE6hzctz1N7bWCg==",
+      "signed_at": "2026-08-08T07:07:14.088Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -813,7 +813,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-08-08T02:22:29.285Z"
+      "signed_at": "2026-08-08T07:07:14.090Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -888,8 +888,8 @@
         "PTES revision incorporating AI-surface enumeration",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
-      "signature": "IPf8oR/blIXjsRHEc+2BNbjIYtgikabF/c+6Xfs5vilFf0mBgJTKAqmJNfrSNPQuCSmuA+Ltbv6eCgJlLBLyDw==",
-      "signed_at": "2026-08-08T02:22:29.285Z"
+      "signature": "GuHxmoEU97+lQfU11chYwXVQhSMpddU0OS1iLkYDmEJhBkHRWWaOa2emYJoVUBDB9v/PTKcFEuEraZwYg+8nCw==",
+      "signed_at": "2026-08-08T07:07:14.092Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -949,8 +949,8 @@
         "syzkaller eBPF and io_uring surface expansion as new kernel attack surfaces ship",
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
-      "signature": "sl+sYiVwJIEkkPVM/bz+OTILrFfMLc2QDrpA8c19dF9Qc8P30bOXjI3SO6uZin/aWSDfmM5IdFOleREazdMTAA==",
-      "signed_at": "2026-08-08T02:22:29.285Z"
+      "signature": "R2jcBorSMWFuZKHUugWEni9q/W7Qk73Kg0SztXlySYu9+D2Ee43gyYsUy0nSa0oCTS8pyuhFiFv2XN0EaweTBQ==",
+      "signed_at": "2026-08-08T07:07:14.094Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -1027,8 +1027,8 @@
         "MCP gateway / proxy standardisation (Anthropic enterprise MCP gateway, Portkey MCP) — tool-call argument inspection is the missing primary control",
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
-      "signature": "OVAUEww37jlj+90k52kQs7O+IX/wZGM/dFUuPQzKEs9ja0Czm2DXpmRjYqVv7PlDvOL22Ew0yV9LKQfldmGkBA==",
-      "signed_at": "2026-08-08T02:22:29.286Z"
+      "signature": "uIQdYlbKIQw8qQRDeGnXv4D/wuPAvYFRzos3kqkyELx+v9rGmfmT7w5s1608lpJxXzGLIA7BSN2/wLJJAZmXCg==",
+      "signed_at": "2026-08-08T07:07:14.095Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1111,8 +1111,8 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge overly permissive allowed list by Satoki Tsuji; AI training-stack supply-chain exposure; track patch and SBOM-attestation impact",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
-      "signature": "c8TcF8E5Fyufm6Gn3ceIhJfGnGEbmzl+W0DqmdF+IHW07KB4Wo11ctkp2IFSsmQIFoxhIjkMyUHaC7UV4MlMCA==",
-      "signed_at": "2026-08-08T02:22:29.286Z"
+      "signature": "4EMvqqcYHnM+9fmlS156Utl3T248EqHdiB89zVyW8+wUYHAU/VLUOr27JiiSmj5iZrdY5Prq7t9Hsk3LuVx5Aw==",
+      "signed_at": "2026-08-08T07:07:14.098Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1169,7 +1169,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-08-08T02:22:29.286Z"
+      "signed_at": "2026-08-08T07:07:14.100Z"
     },
     {
       "name": "identity-assurance",
@@ -1243,7 +1243,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-08-08T02:22:29.287Z"
+      "signed_at": "2026-08-08T07:07:14.103Z"
     },
     {
       "name": "ot-ics-security",
@@ -1278,7 +1278,7 @@
         "AML.T0010"
       ],
       "attack_refs": [
-        "T0855",
+        "T1692.001",
         "T0883",
         "T1190",
         "T1068"
@@ -1301,8 +1301,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
-      "signature": "5H2gSx4XzIg0/y/zCiB4pusEmLMsK8WDwPP3/R8OM1TDULKDZyEbWfvaWaLMobU17KbVVr6fc80royegGx4qAQ==",
-      "signed_at": "2026-08-08T02:22:29.287Z"
+      "signature": "1PFZXMfQwM0dHsZQfo+rg5hJB00dfeOL41VA3J8gNF6cCUpplw9vQuZfODX/SwXI/WmDQwM9G2sd1X/i7LG9DA==",
+      "signed_at": "2026-08-08T07:07:14.107Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1361,8 +1361,8 @@
         "UK NCSC Vulnerability Disclosure Toolkit revisions and AU ISM CVD guidance updates",
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
-      "signature": "AaTylp+zWRfJF5vAcJlImdnAxNeMFboe4tZ9N+V7eDF40BKDC7TX2Lb7u69X4Ry5zxBAqx0tOEpesni1DNOzDA==",
-      "signed_at": "2026-08-08T02:22:29.287Z"
+      "signature": "5b3J9mk/iEi6OzeC0O2hw/K/ofTrH8519l+ZUpK8gqB/v0XbDFceIIBPB8TQM8wCct5iG0Krb7OCDSIbU0jVBw==",
+      "signed_at": "2026-08-08T07:07:14.109Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1415,8 +1415,8 @@
         "LINDDUN-GO and LINDDUN-PRO updates incorporating LLM privacy threats",
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
-      "signature": "q/F/WUeakWNZOJ542rRsMgtM0Ium2AkkDBLOju3vG0+m8PtO/yuBhffhPrL/U6IvGDH6xaoYP+zvqTkaTcB7CQ==",
-      "signed_at": "2026-08-08T02:22:29.287Z"
+      "signature": "fibgNRd+STEyN3ZlnIxJddfaOXISYosdjoxkQ/oNVTP3GKhN1A4c3Jh0HZPbhTdjhrbJM/mE5ufiIOs7+RCMCQ==",
+      "signed_at": "2026-08-08T07:07:14.112Z"
     },
     {
       "name": "webapp-security",
@@ -1498,8 +1498,8 @@
         "D3-MFA"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "giKG4Spsb/a9y6GD1k6rKCYWLl3rMRYGt9RxBsb8WknNGSYi/Hz4PB+UnztgsN9JYl07PjL+DE3iAHbgh3GZAQ==",
-      "signed_at": "2026-08-08T02:22:29.288Z",
+      "signature": "3qtC0X8QR9YufDfeL/AUiw3EeJwvSfSrUWojndEZVmeJ3MtM12I94OJmaQT1AWaTRWVa9f91owgLl6AgoTNVAA==",
+      "signed_at": "2026-08-08T07:07:14.114Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1559,7 +1559,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-08-08T02:22:29.288Z"
+      "signed_at": "2026-08-08T07:07:14.116Z"
     },
     {
       "name": "sector-healthcare",
@@ -1625,8 +1625,8 @@
         "D3-MFA"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "0HQkFkUf8EMaPetY4lFsy/11V96wk+YeMSEyY5CWrjC9hQ3vZ0fPsPLWe8EzBxOhgxrt55RXDrBGArmB2i4cAw==",
-      "signed_at": "2026-08-08T02:22:29.288Z"
+      "signature": "Z/lPfIH5ARAOoeR81ATj6lQlekZP/8tzg23Pr1H9BxxdQedRsLGDNVIHu81qNuoA7GNRRMtxXpwrS7fXbMh5Cw==",
+      "signed_at": "2026-08-08T07:07:14.121Z"
     },
     {
       "name": "sector-financial",
@@ -1714,8 +1714,8 @@
         "OSFI B-13 (Technology and Cyber Risk Management) post-2024 examination findings",
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
-      "signature": "zgUqH1eeQlUSB99dWskBa0vBqC9PR7zhIYkBjB/aksWlc0uvqGMXOfusT3kObX+TB1pgTgIyTWUfZqjWyBrSAg==",
-      "signed_at": "2026-08-08T02:22:29.289Z"
+      "signature": "kPV8cEpIUAMKY2USvFxAn6JkkRMlBAM2mGLy6ViS9O3rv+3dsAgBqKgcBTBbuSoMZgY2KKruoG+SkrR3aoViAg==",
+      "signed_at": "2026-08-08T07:07:14.124Z"
     },
     {
       "name": "sector-federal-government",
@@ -1791,8 +1791,8 @@
         "EU Cybersecurity Certification Scheme on Common Criteria (EUCC) operational — first certificates issued 2024; high-assurance level for government use cases ramping",
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
-      "signature": "3xBhtZe9UrcdmfmnQPqnu+5m8MrvT1rT/zlpbQhNuCdJZXwv2ovJCxQUPULP0WVvSrJHfvvmkaTbPUtA1C5MDw==",
-      "signed_at": "2026-08-08T02:22:29.289Z"
+      "signature": "CbxW5qhlaiqf+P3xIemSHlMz9OoWat2srh7F3+nAIsa0Y4nBr6WCXZXZlUUjrjptZ3Ny+Cw485HMLWRO9qbcBw==",
+      "signed_at": "2026-08-08T07:07:14.126Z"
     },
     {
       "name": "sector-energy",
@@ -1826,7 +1826,7 @@
       ],
       "atlas_refs": [],
       "attack_refs": [
-        "T0855",
+        "T1692.001",
         "T0883",
         "T1190",
         "T1078"
@@ -1865,8 +1865,8 @@
         "MadIoT-class research on consumer-IoT-driven grid frequency manipulation moving from proof-of-concept to attributed campaigns",
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
-      "signature": "Bwycwk/pJ19YtZpifD2/MKbs8KkzfpUzYNVswjOfqEBPUiZKhMPTY1TdEyPnNyQvgB1BVHW/z+WpQ9CW9P9cBQ==",
-      "signed_at": "2026-08-08T02:22:29.290Z"
+      "signature": "lVHORFJzvkxNqJfT34inW28BzlA8dCWDfo0JS9tsiNW3PUxdijZS22g4GMbQJgaSKGv7F3ag5rWk75O+IChUAw==",
+      "signed_at": "2026-08-08T07:07:14.129Z"
     },
     {
       "name": "sector-telecom",
@@ -1952,7 +1952,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-08-08T02:22:29.290Z"
+      "signed_at": "2026-08-08T07:07:14.133Z"
     },
     {
       "name": "api-security",
@@ -2030,8 +2030,8 @@
         "D3-CBAN"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "JAIe0jXjIIKUC8kYNCN9ZBMhoSSdbNskIg7/lKKAXzACf/uFpjlhaOY8Sm4j8ivAtgHdqyrsIeRy7P8SWm8yBw==",
-      "signed_at": "2026-08-08T02:22:29.290Z",
+      "signature": "hyLAsPCAkUkhNeaaFtgSg5XsKs2L8HuFoPka/Urzel54XPMQ0F3MwRD7j/ZURzIHQxvrAxmS3OCXEsBrgcFxAw==",
+      "signed_at": "2026-08-08T07:07:14.136Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2125,8 +2125,8 @@
         "eBPF-based runtime detection coverage of confidential-computing enclaves (AWS Nitro Enclaves, Azure Confidential VMs, GCP Confidential Space) — partial visibility is a tracked detection gap",
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
-      "signature": "L1DVbQq61lkUrAz/DkV/Je9u653qhyUoTfGrUEgbHrc/rX4UWYOnWObR0P3EsPPq5t9GS8YKsMkZH0WJevAxAQ==",
-      "signed_at": "2026-08-08T02:22:29.291Z"
+      "signature": "MfijBq1nzlyPQWf5/EcTn5Xx7ThdZ9BT8/W/+daxhATfMSoSTrMn9pYh1R83Chr9n2ahQeMoPUkSxL7Cr9V3Dw==",
+      "signed_at": "2026-08-08T07:07:14.138Z"
     },
     {
       "name": "container-runtime-security",
@@ -2197,8 +2197,8 @@
         "D3-IOPR"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "s4kKyXP0UVCE4IAo2ogL7Vb9YygYZxvWgx5azGfehLQKwBZ4RinUBdlqC/OhRdzi/ZpCGAViEGusGHexKmNXAA==",
-      "signed_at": "2026-08-08T02:22:29.291Z",
+      "signature": "QJ8RF3ifPFc0mr3gYkloHqg5nuYe1GS4h+xbKYDCkM+HbA3iTd5keJ59P2P3z8TwVdOt8XM8WOsx6aRUrFL0Cw==",
+      "signed_at": "2026-08-08T07:07:14.140Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2276,10 +2276,10 @@
         "OpenSSF model-signing emergence to v1.0 — Sigstore-based model-weight signing; track for production adoption and admission-control integration",
         "SLSA v1.1 ML profile (draft) — model-provenance extension for training-run attestation chains; track ID and section changes",
         "EU AI Act high-risk technical-file implementing acts (2026-2027) — operational requirements for Article 10 / 13 / 15 documentation may pin ML-BOM or model-signing",
-        "MITRE ATLAS v2026.06 (released June 2026) is additive over v2026.05 — it adds AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) and refreshes AML.T0054 (LLM Jailbreak), with no technique-ID removals. Earlier releases shipped the AML.T0010 sub-technique expansion and agentic-AI techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\") this forecast tracked. Forward watch: subsequent monthly ATLAS releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
+        "MITRE ATLAS v2026.07 (released June 2026) is additive over v2026.05 — it adds AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) and refreshes AML.T0054 (LLM Jailbreak), with no technique-ID removals. Earlier releases shipped the AML.T0010 sub-technique expansion and agentic-AI techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\") this forecast tracked. Forward watch: subsequent monthly ATLAS releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
-      "signature": "Lksu8f3T2mlR1mzDVLFPNknjR7gi9ZyQkCTx5z3Pp7Wb2BYB4tixL1DkWQiX0TO5ay9n6OrlG724tELESAUGBw==",
-      "signed_at": "2026-08-08T02:22:29.291Z"
+      "signature": "3fTzOGMZrQN1hrALLtcWoh7OTqGKV+6Q6fHbpvhKPFoJdROvMTx9P6HoRcdBEXGL9uuk8RMKtSOu1DxKzpE0Bw==",
+      "signed_at": "2026-08-08T07:07:14.142Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2352,8 +2352,8 @@
         "IL INCD Incident Response Process v4 (slated for 2026-2027) consolidating AI-incident sub-class",
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
-      "signature": "YseIGVsCqWXjavUPbmbgeTRKDOhFPgVqm453+n0z7haj4DNeKobnNVK8ZCYj+YDJ1A5c5Sg/EF4/UUYpD5qIDw==",
-      "signed_at": "2026-08-08T02:22:29.292Z"
+      "signature": "/UO/jY++K1XfLiFnNdNabeZ3upnuJ7rwN7KW8j+V6KVgRnts62pG9o8wGo/PMjtyRv+2n7URlncZ2W70I+9oDg==",
+      "signed_at": "2026-08-08T07:07:14.144Z"
     },
     {
       "name": "ransomware-response",
@@ -2432,8 +2432,8 @@
         "SCOTUS or circuit-court rulings on ransomware payment, sanctions liability, and insurance-policy enforcement"
       ],
       "last_threat_review": "2026-06-10",
-      "signature": "aKpZzYGkstC1E3FPjf0gpwObUoCOzztBFjfa8/e5alOfcqYX1oryKo8A/j8QpVwSOTJ5nab+2DMHtvyrXq5hAQ==",
-      "signed_at": "2026-08-08T02:22:29.292Z"
+      "signature": "QCItAtMwG3tMrh1KYarQ8s/mnUF3n7nxraltBVQ3Dgc7EDuVHWQg9UfAcJDttxYnz2vMLZFi/OZv4ArQ6m7QAA==",
+      "signed_at": "2026-08-08T07:07:14.145Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2501,7 +2501,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-08-08T02:22:29.292Z"
+      "signed_at": "2026-08-08T07:07:14.147Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2575,8 +2575,8 @@
         "France SREN (Securing and Regulating the Digital Space) Act 2024 — ARCOM age-verification referential for adult content services; double-anonymity model under deployment",
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
-      "signature": "Bk+pigkDpy/jexcfQBZLPZR0+CnO7XW5gF4UCMf10ZWPB43iOR89UC+MYr7VUDybgaH20LPIZPCHuy+LFq9+Dw==",
-      "signed_at": "2026-08-08T02:22:29.292Z"
+      "signature": "l/jeAAnb7H2GQzp1x05bsdZwzC0NNTBi3ZuiwgDly5EVSoikbnVWpx921bT5G3OPkx4dqs2PohlvTG0gLxCrAA==",
+      "signed_at": "2026-08-08T07:07:14.149Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2655,8 +2655,8 @@
         "D3-CAA"
       ],
       "last_threat_review": "2026-05-15",
-      "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-08-08T02:22:29.293Z",
+      "signature": "vrMvYLdYJLlEAC8YvOb/g3LJ8gU1YmYewZ94J5AFgxxh2EiDyszqo3D/WVpt5NTrDSS/N5OgOf5Vwom/KGlMCA==",
+      "signed_at": "2026-08-08T07:07:14.151Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2750,7 +2750,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-08-08T02:22:29.293Z",
+      "signed_at": "2026-08-08T07:07:14.154Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2822,7 +2822,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-08-08T02:22:29.293Z"
+      "signed_at": "2026-08-08T07:07:14.156Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2881,7 +2881,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-08-08T02:22:29.294Z"
+      "signed_at": "2026-08-08T07:07:14.158Z"
     },
     {
       "name": "network-trust",
@@ -2937,7 +2937,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-08-08T02:22:29.294Z"
+      "signed_at": "2026-08-08T07:07:14.161Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2974,7 +2974,7 @@
       "attack_refs": [
         "T1070",
         "T1565.001",
-        "T1562.008"
+        "T1685.002"
       ],
       "framework_gaps": [
         "NIST-800-53-SI-2",
@@ -2991,8 +2991,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
-      "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-08-08T02:22:29.294Z"
+      "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
+      "signed_at": "2026-08-08T07:07:14.163Z"
     },
     {
       "name": "self-update-integrity",
@@ -3046,7 +3046,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-08-08T02:22:29.294Z"
+      "signed_at": "2026-08-08T07:07:14.166Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3104,7 +3104,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-08-08T02:22:29.294Z"
+      "signed_at": "2026-08-08T07:07:14.168Z"
     },
     {
       "name": "decompression-dos",
@@ -3162,7 +3162,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-08-08T02:22:29.294Z"
+      "signed_at": "2026-08-08T07:07:14.169Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3217,7 +3217,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-08-08T02:22:29.295Z"
+      "signed_at": "2026-08-08T07:07:14.171Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3272,11 +3272,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-08-08T02:22:29.295Z"
+      "signed_at": "2026-08-08T07:07:14.174Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "FFJqoat9PLbwMGqxGBFuWk1ECJqSNDlUOwLgS7nwFbn7QAO1HPes4ZzMs/uT+XHtHLu51L3Jb0f6bTNmGbs3Dg=="
+    "signature_base64": "gkapXtrFMkr8xMOGbYA2XA2t546Xb1I4jN9m3qhVqxScR2GVOt7FjvK/6MlKfIOOySEEBydJ1T5IUmwfRTorBA=="
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.30",
-  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1025 CVEs / 232 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+  "version": "0.19.1",
+  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1025 CVEs / 232 CWEs / 794 ATT&CK + ICS / 171 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
     "ai-skills",
@@ -43,7 +43,7 @@
   "license": "Apache-2.0",
   "author": "blamejs contributors",
   "engines": {
-    "node": ">=24.16.0"
+    "node": ">=24.19.0"
   },
   "bin": {
     "exceptd": "bin/exceptd.js"