@blamejs/exceptd-skills 0.18.5 → 0.18.7

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-14T15:51:29.599Z",
+  "generated_at": "2026-06-20T16:35:33.578Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "d6486b4209c765883b69c32a3f52df0956c2e9cb770cc0d603fafb5b15aeb865",
+    "manifest.json": "6e8a5ac562c706b0142ad12b07a62982bb83d500870ca33a5d865bd17a16d23a",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",
-    "data/cve-catalog.json": "eedd129c657e535d53df5d4d44fa54009b69cde85673cf7c9d426054eddc43d2",
+    "data/cve-catalog.json": "06ca53e69071dfe94867c10717f3ff2962c50341defcaf050f1a96236b5be51c",
     "data/cwe-catalog.json": "359263361fa52069e2856cc352d8f1c757d614ea840db6ef3ff5e696185ca220",
     "data/d3fend-catalog.json": "349d14b2777342d38e5f8b0149a9ebd7703ee59f67a9efee200d1e19313088ac",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -71,6 +71,25 @@
   },
   "skill_count": 51,
   "catalog_count": 11,
+  "outputs": [
+    "activity-feed.json",
+    "catalog-summaries.json",
+    "chains.json",
+    "currency.json",
+    "did-ladders.json",
+    "frequency.json",
+    "handoff-dag.json",
+    "jurisdiction-clocks.json",
+    "jurisdiction-map.json",
+    "recipes.json",
+    "section-offsets.json",
+    "stale-content.json",
+    "summary-cards.json",
+    "theater-fingerprints.json",
+    "token-budget.json",
+    "trigger-table.json",
+    "xref.json"
+  ],
   "index_stats": {
     "xref_entries": {
       "cwe_refs": 53,

package/data/cve-catalog.json

@@ -1322,6 +1322,7 @@
   "CVE-2025-53773": {
     "name": "GitHub Copilot / VS Code 'YOLO mode' Prompt Injection RCE",
     "type": "RCE-via-prompt-injection",
+    "attack_class": "prompt-injection",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
     "cvss_correction_note": "v0.12.6 source audit corrected from CVSS 9.6/AV:N (network) to CVSS 7.8/AV:L (local) — the attack is local-vector via developer-side IDE interaction; the attacker does not reach in over the network. NVD authoritative.",
@@ -1436,6 +1437,7 @@
   "CVE-2026-30615": {
     "name": "Windsurf MCP Local-Vector RCE via Adversarial Tool Response",
     "type": "RCE-supply-chain",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
     "cvss_correction_note": "v0.12.9 (2026-05-13): catalog previously stored CVSS 9.8 / AV:N. NVD authoritative is 8.0 / AV:L (local attack vector; attacker must control HTML content the Windsurf MCP client processes — not a network-vector zero-interaction RCE as initially cataloged). Source: https://nvd.nist.gov/vuln/detail/CVE-2026-30615 (published 2026-04-15, last_modified 2026-04-27, vulnStatus: Deferred). Recompute RWEP with blast_radius reduced from 30→20 to reflect local-vector + Scope:U.",
@@ -1699,6 +1701,7 @@
   "CVE-2026-39884": {
     "name": "Flux159 mcp-server-kubernetes Argument Injection via port_forward",
     "type": "argument-injection",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.3,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
     "cisa_kev": false,
@@ -3555,6 +3558,7 @@
     "ai_assisted_weaponization": false,
     "name": "Anthropic MCP SDK stdio command-injection",
     "type": "command-injection",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
     "cisa_kev": false,
@@ -5742,6 +5746,7 @@
     "id": "CVE-2025-38352",
     "name": "Android / Linux Kernel POSIX CPU Timer Race (sandbox-escape LPE)",
     "type": "race-condition-lpe",
+    "attack_class": "kernel-lpe",
     "cvss_score": 7.4,
     "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cisa_kev": true,
@@ -6689,6 +6694,7 @@
     "id": "CVE-2025-22225",
     "name": "VMware ESXi Arbitrary Kernel Write (VM-escape chain, ransomware-active)",
     "type": "arbitrary-kernel-write-vm-escape",
+    "attack_class": "kernel-lpe",
     "cvss_score": 8.2,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
     "cisa_kev": true,
@@ -7256,6 +7262,7 @@
     "id": "CVE-2025-55319",
     "name": "Visual Studio Code Agentic-AI Command Injection (ZeroPath AI-discovered)",
     "type": "command-injection-agentic",
+    "attack_class": "ai-c2",
     "cvss_score": 7.4,
     "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
     "cisa_kev": false,
@@ -11564,6 +11571,7 @@
   "CVE-2026-25592": {
     "name": "Microsoft Semantic Kernel SessionsPythonPlugin Path Traversal — Prompt-Injection to Host RCE",
     "type": "RCE",
+    "attack_class": "prompt-injection",
     "cvss_score": 9.9,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 9.9 (CRITICAL), Scope:Changed. The high score reflects worst-case impact; the RWEP score is intentionally lower (Hard Rule #3) because there is no confirmed in-the-wild exploitation or KEV listing and a patch shipped at disclosure.",
@@ -11681,6 +11689,7 @@
   "CVE-2025-49596": {
     "name": "MCP Inspector Missing Authentication — Unauthenticated RCE via the Inspector Proxy",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.3,
     "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
     "cvss_note": "Operator v3.1 estimate (NVD has not assessed v3.1; the GitHub CNA published CVSS v4.0 9.4 CRITICAL). Exploitation lures a victim's browser to reach the locally-bound, unauthenticated MCP Inspector proxy (the 0.0.0.0-day / DNS-rebinding class), hence AC:H / UI:R; once reached, commands run over stdio with no auth.",
@@ -11787,6 +11796,7 @@
   "CVE-2025-54136": {
     "name": "Cursor MCPoison — Persistent RCE via Modified Already-Trusted MCP Config",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 8.8 (HIGH). The 'trust-on-first-use, never-re-validated' design lets a one-time approval become silent persistent code execution.",
@@ -11894,6 +11904,7 @@
   "CVE-2026-22252": {
     "name": "LibreChat MCP stdio Transport — Authenticated Arbitrary Command Execution as Root",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 9.9,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 9.9 (CRITICAL), Scope:Changed (the GitHub CNA scored 9.1 with PR:H). The MCP stdio transport runs the supplied command as root inside the container, so any authenticated user reaches host-class execution.",
@@ -11998,6 +12009,7 @@
   "CVE-2026-22688": {
     "name": "Tencent WeKnora MCP stdio Command Injection",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 8.8 (HIGH); the GitHub CNA scored 9.9 (Scope:Changed). Authenticated command injection through the MCP stdio settings.",
@@ -12099,6 +12111,7 @@
   "CVE-2026-40933": {
     "name": "FlowiseAI Flowise MCP Custom Config Command Injection",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 9.9,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
     "cvss_note": "NVD/CNA CVSS v3.1 base 9.9 (CRITICAL, Scope:Changed). Authenticated command injection via the Custom MCP configuration.",
@@ -12199,6 +12212,7 @@
   "CVE-2026-30624": {
     "name": "Agent Zero MCP Server Config Command Injection",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.6,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
     "cvss_note": "NVD CVSS v3.1 base 8.6 (HIGH). Remote code execution through malicious MCP server configurations executed without adequate validation.",
@@ -12293,6 +12307,7 @@
   "CVE-2026-30616": {
     "name": "Jaaz MCP stdio Command Execution RCE",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 7.3,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
     "cvss_note": "CISA-ADP CVSS v3.1 base 7.3 (HIGH). Remote code execution in MCP stdio command execution handling.",
@@ -12387,6 +12402,7 @@
   "CVE-2026-30617": {
     "name": "Langchain-Chatchat MCP Management Interface stdio RCE",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.6,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
     "cvss_note": "NVD CVSS v3.1 base 8.6 (HIGH). RCE through an exposed MCP management interface that configures malicious stdio server commands.",
@@ -12481,6 +12497,7 @@
   "CVE-2026-30625": {
     "name": "Upsonic MCP Task Allowed-Command Argument Injection RCE",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 9.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL). RCE via MCP task creation where allow-listed commands (npm, npx) accept flags that enable arbitrary OS command execution.",
@@ -12575,6 +12592,7 @@
   "CVE-2026-26015": {
     "name": "DocsGPT MCP stdio Unauthenticated Remote Code Execution",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 9.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL); the GitHub advisory scores 10.0. Unauthenticated: a crafted payload bypasses the MCP test behavior to execute commands.",
@@ -12783,6 +12801,7 @@
   "CVE-2025-23254": {
     "name": "NVIDIA TensorRT-LLM Python Executor Deserialization RCE (ShadowMQ)",
     "type": "RCE",
+    "attack_class": "ai-c2",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
     "cvss_note": "NVIDIA/NVD CVSS v3.1 base 8.8 (HIGH, Scope:Changed). Insecure deserialization in the TensorRT-LLM Python executor.",
@@ -12885,6 +12904,7 @@
   "CVE-2025-30165": {
     "name": "vLLM V0 Engine ZeroMQ Deserialization RCE (ShadowMQ)",
     "type": "RCE",
+    "attack_class": "ai-c2",
     "cvss_score": 8,
     "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 8.0 (HIGH, AV:Adjacent). Unsafe deserialization over ZeroMQ in multi-node V0-engine deployments.",
@@ -12988,6 +13008,7 @@
   "CVE-2024-50050": {
     "name": "Meta Llama Stack Socket Deserialization RCE (ShadowMQ)",
     "type": "RCE",
+    "attack_class": "ai-c2",
     "cvss_score": 6.3,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
     "cvss_note": "NVD CISA-ADP CVSS v3.1 base 6.3 (MEDIUM); Oligo and Snyk originally scored the same flaw 9.3 (CRITICAL) — a documented CVSS dispute. The serialization format was replaced with JSON in the fix.",
@@ -13091,6 +13112,7 @@
   "CVE-2025-60455": {
     "name": "Modular Max Server KVCache-Agent Deserialization RCE (ShadowMQ)",
     "type": "RCE",
+    "attack_class": "ai-c2",
     "cvss_score": 8.4,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NVD CVSS v3.1 base 8.4 (HIGH). Unsafe deserialization reachable when --experimental-enable-kvcache-agent is enabled.",
@@ -17799,6 +17821,7 @@
   "CVE-2024-5565": {
     "name": "Vanna.AI Prompt Injection to Remote Code Execution",
     "type": "RCE",
+    "attack_class": "prompt-injection",
     "cvss_score": 8.1,
     "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "JFrog (CNA) CVSS v3.1 base 8.1 (HIGH); the GitHub advisory (GHSA-7735-w2jp-gvg6) rates it 9.2 (CRITICAL); NVD has not published its own assessed score. Prompt injection through the text-to-SQL ask method - with visualization enabled, the default - makes the LLM emit attacker-chosen Python that Vanna runs to build the Plotly figure, giving remote code execution (CWE-94 / CWE-77).",
@@ -17907,6 +17930,7 @@
   "CVE-2024-12366": {
     "name": "PandasAI Prompt Injection to Remote Code Execution",
     "type": "RCE",
+    "attack_class": "prompt-injection",
     "cvss_score": 9.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "CISA-ADP CVSS v3.1 base 9.8 (CRITICAL); the GitHub advisory (GHSA-vv2h-2w3q-3fx7) also rates it Critical; NVD has not published its own assessed score. PandasAI's interactive prompt (chat) fails to distinguish legitimate from malicious input, so prompt injection drives the natural-language interface into executing arbitrary Python - remote code execution (CWE-94), no authentication or user interaction required.",
@@ -47286,6 +47310,7 @@
   "CVE-2026-42271": {
     "name": "BerriAI LiteLLM MCP Test-Endpoint Authenticated Command Injection (CISA KEV)",
     "type": "RCE",
+    "attack_class": "mcp-supply-chain",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cvss_note": "NIST (NVD) CVSS v3.1 base 8.8 (HIGH); the GitHub (CNA) advisory rates it CVSS v4.0 8.7 (HIGH). The MCP REST test endpoints accept attacker-supplied server configurations that spawn arbitrary subprocesses; any authenticated caller, including a low-privilege internal-user key, reaches command execution on the proxy host (CWE-77 / CWE-78).",

package/data/playbooks/framework.json

@@ -42,7 +42,7 @@
     "feeds_into": [
       {
         "playbook_id": "sbom",
-        "condition": "any compliance_theater_check.verdict == 'theater' AND blast_radius_score >= 4"
+        "condition": "analyze.compliance_theater_check.verdict == 'theater' AND analyze.blast_radius_score >= 4"
       }
     ],
     "fed_by": [
@@ -717,7 +717,7 @@
           "action": "raise_severity"
         },
         {
-          "condition": "any compliance_theater_check.verdict == 'theater' AND blast_radius_score >= 3",
+          "condition": "analyze.compliance_theater_check.verdict == 'theater' AND blast_radius_score >= 3",
           "action": "trigger_playbook",
           "target_playbook": "sbom"
         }

package/data/playbooks/post-quantum-migration.json

@@ -817,7 +817,7 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "no-cryptographic-asset-register == fired AND jurisdiction_obligations contains NIS2-Art21-2h",
+          "condition": "no-cryptographic-asset-register == fired AND jurisdiction_obligations contains 'EU'",
           "action": "notify_legal"
         },
         {

package/lib/auto-discovery.js

@@ -411,19 +411,39 @@ async function fetchDatatracker(url, ctx) {
   if ((ctx && ctx.airGap === true) || process.env.EXCEPTD_AIR_GAP === "1") {
     return { ok: false, error: "air-gap-blocked", source: "datatracker" };
   }
-  const ac = new AbortController();
-  const t = setTimeout(() => ac.abort(), TIMEOUT_MS);
+  // Adopt the vendored blamejs retry primitive, matching source-osv /
+  // source-ghsa / source-advisories / refresh-network: a transient Datatracker
+  // failure (HTTP 429/5xx, ECONNRESET/ETIMEDOUT family) backs off with
+  // exponential jitter instead of being dropped on the first hiccup, which
+  // silently yielded no discovered working groups. A genuine 4xx (e.g. 404 on
+  // a renamed WG acronym) carries a non-retryable statusCode, so the classifier
+  // does not waste attempts on it. The caller contract is unchanged: discovery
+  // never throws — it returns drafts, not errors — so an exhausted retry budget
+  // (or any non-retryable failure) collapses to the same `null` the
+  // single-fetch path returned, which discoverNewRfcs treats as one WG skip.
+  const { withRetry } = require("../vendor/blamejs/retry.js");
+  const once = async () => {
+    const ac = new AbortController();
+    const t = setTimeout(() => ac.abort(), TIMEOUT_MS);
+    try {
+      const res = await fetch(url, {
+        signal: ac.signal,
+        headers: { "User-Agent": USER_AGENT, Accept: "application/json" },
+      });
+      if (!res.ok) {
+        const e = new Error(`HTTP ${res.status} from ${url}`);
+        e.statusCode = res.status; // let withRetry's classifier retry 429/5xx
+        throw e;
+      }
+      return await res.json();
+    } finally {
+      clearTimeout(t);
+    }
+  };
   try {
-    const res = await fetch(url, {
-      signal: ac.signal,
-      headers: { "User-Agent": USER_AGENT, Accept: "application/json" },
-    });
-    if (!res.ok) return null;
-    return await res.json();
+    return await withRetry(once, { maxAttempts: 3, baseDelayMs: 100, maxDelayMs: 2000, jitterFactor: 0.5 });
   } catch {
     return null;
-  } finally {
-    clearTimeout(t);
   }
 }
 

package/lib/collectors/ai-api.js

@@ -26,11 +26,18 @@ const os = require("node:os");
 const COLLECTOR_ID = "ai-api";
 
 function readSafe(full, max = 256 * 1024) {
+  let fd;
   try {
-    const s = fs.statSync(full);
+    fd = fs.openSync(full, "r");
+    const s = fs.fstatSync(fd);
     if (s.size > max) return null;
-    return fs.readFileSync(full, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than s.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 function fileExists(full) {

package/lib/collectors/cicd-pipeline-compromise.js

@@ -32,11 +32,18 @@ const OIDC_WALK_EXCLUDES = codeExcludeSet();
 const COLLECTOR_ID = "cicd-pipeline-compromise";
 
 function readSafe(p, max = 512 * 1024) {
+  let fd;
   try {
-    const s = fs.statSync(p);
+    fd = fs.openSync(p, "r");
+    const s = fs.fstatSync(fd);
     if (s.size > max) return null;
-    return fs.readFileSync(p, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than s.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 function walkWorkflows(root) {
@@ -206,8 +213,14 @@ function scanWorkflow(content, rel) {
   // Pull-request-from-forks (without target) requires runtime info
   // to detect fork status — left to operator evidence.
   if (hasPRTarget) {
-    const secretsRefs = content.match(/\$\{\{\s*secrets\.([A-Z_][A-Z0-9_]*)\s*\}\}/g) || [];
-    const nonDefault = secretsRefs.filter(r => !/secrets\.GITHUB_TOKEN/.test(r));
+    // Compare the captured secret NAME exactly to GITHUB_TOKEN. An unanchored
+    // /secrets\.GITHUB_TOKEN/ substring test also matched custom secrets such
+    // as GITHUB_TOKEN_PROD, silently treating them as the built-in token and
+    // dropping a real fork-PR secret exposure (false negative).
+    const nonDefault = [];
+    for (const m of content.matchAll(/\$\{\{\s*secrets\.([A-Z_][A-Z0-9_]*)\s*\}\}/g)) {
+      if (m[1] !== "GITHUB_TOKEN") nonDefault.push(m[0]);
+    }
     if (nonDefault.length > 0) {
       hits["secret-exposed-to-fork-pr"].push({ file: rel, snippet: `pull_request_target + ${nonDefault.length} secrets.* reference(s)` });
     }
@@ -243,7 +256,13 @@ function scanOidcPolicies(root) {
       if (!e.isFile() || !/\.json$/i.test(e.name)) continue;
       const text = readSafe(full);
       if (!text) continue;
-      if (!/token\.actions\.githubusercontent\.com/.test(text)) continue;
+      // The authoritative OIDC sub-claim detection is the self-anchored patterns
+      // below — each is bound to the leading `"` of the JSON key
+      // (`"token.actions.githubusercontent.com:sub"`), so a lookalike issuer
+      // such as `"eviltoken.actions…"` cannot match. No separate substring
+      // pre-filter on the issuer host: it added nothing the anchored patterns
+      // don't already enforce, and a bare host-substring check reads as an
+      // incomplete URL sanitization.
       // sub-claim wildcards. Cover the three shapes the playbook lists.
       const subWildcard =
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"\*"/.test(text) ||

package/lib/collectors/cred-stores.js

@@ -26,11 +26,18 @@ const os = require("node:os");
 const COLLECTOR_ID = "cred-stores";
 
 function readSafe(full, max = 512 * 1024) {
+  let fd;
   try {
-    const s = fs.statSync(full);
+    fd = fs.openSync(full, "r");
+    const s = fs.fstatSync(fd);
     if (s.size > max) return null;
-    return fs.readFileSync(full, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than s.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 function statSafe(full) {
@@ -133,8 +140,14 @@ function parseKubeConfig(content) {
     let blockHasStatic = false;
     for (const m of block.matchAll(userKvRe)) {
       const upto = block.slice(0, m.index);
-      const lastUserAt = upto.lastIndexOf("\n  user:");
-      const lastAuthProviderAt = upto.lastIndexOf("auth-provider:");
+      // Indentation-agnostic key anchors: a kubeconfig may use 2-space, 4-space,
+      // or tab indentation. Hardcoding "\n  user:" missed a user-level static
+      // token under any other indentation and mislabeled it as an auth-provider
+      // (dynamic) token.
+      const userMatches = [...upto.matchAll(/\n[ \t]*user\s*:/g)];
+      const lastUserAt = userMatches.length ? userMatches[userMatches.length - 1].index : -1;
+      const apMatches = [...upto.matchAll(/\n[ \t]*auth-provider\s*:/g)];
+      const lastAuthProviderAt = apMatches.length ? apMatches[apMatches.length - 1].index : -1;
       // Reject when the closest enclosing key is auth-provider rather
       // than user — those are dynamic tokens, not static credentials.
       if (lastAuthProviderAt > lastUserAt) continue;

package/lib/collectors/crypto.js

@@ -28,11 +28,18 @@ const { spawnSync } = require("node:child_process");
 const COLLECTOR_ID = "crypto";
 
 function readFileSafe(p, max = 256 * 1024) {
+  let fd;
   try {
-    const st = fs.statSync(p);
+    fd = fs.openSync(p, "r");
+    const st = fs.fstatSync(fd);
     if (st.size > max) return null;
-    return fs.readFileSync(p, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than st.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 // Same sshd_config Include-expansion logic as the hardening

package/lib/collectors/hardening.js

@@ -25,11 +25,18 @@ function readSysctl(p) {
 }
 
 function readFileSafe(p, max = 256 * 1024) {
+  let fd;
   try {
-    const st = fs.statSync(p);
+    fd = fs.openSync(p, "r");
+    const st = fs.fstatSync(fd);
     if (st.size > max) return null;
-    return fs.readFileSync(p, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than st.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 // Expand the base sshd_config into the effective directive stream by

package/lib/collectors/library-author.js

@@ -43,11 +43,18 @@ const DEFAULT_MAX_DEPTH = 6;
 const DEFAULT_EXCLUDES = codeExcludeSet();
 
 function readSafe(full, max = 512 * 1024) {
+  let fd;
   try {
-    const s = fs.statSync(full);
+    fd = fs.openSync(full, "r");
+    const s = fs.fstatSync(fd);
     if (s.size > max) return null;
-    return fs.readFileSync(full, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than s.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 function walkWorkflows(root) {
@@ -307,9 +314,23 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
       scan: (text) => {
         const j = JSON.parse(text);
         let missing = 0;
+        // Only a REMOTE-tarball entry (`resolved` is an http(s)/git URL) is
+        // expected to carry an integrity hash. Workspace links — npm v3 emits
+        // them as `{ "resolved": "<relative-path>", "link": true }` — and
+        // file:/link:/workspace:/git: refs legitimately have NO integrity (a
+        // local symlink is not a registry artifact). Counting them flips
+        // lockfile-missing-integrity to a false hit on every npm-workspaces
+        // monorepo even when every registry dep is sha512-pinned. Mirrors
+        // sbom.js's local-ref demotion; the bare-relative-path + `link:true`
+        // shape is the canonical workspace link.
         const walkObj = (obj) => {
           if (!obj || typeof obj !== "object") return;
-          if (obj.resolved && obj.integrity == null) missing++;
+          if (
+            obj.resolved &&
+            obj.integrity == null &&
+            obj.link !== true &&
+            /^(?:https?:|git\+|git:|ssh:)/i.test(String(obj.resolved))
+          ) missing++;
           for (const v of Object.values(obj)) if (v && typeof v === "object") walkObj(v);
         };
         walkObj(j.packages || j.dependencies || {});

package/lib/collectors/mcp.js

@@ -31,11 +31,18 @@ const os = require("node:os");
 const COLLECTOR_ID = "mcp";
 
 function readSafe(full, max = 1024 * 1024) {
+  let fd;
   try {
-    const s = fs.statSync(full);
+    fd = fs.openSync(full, "r");
+    const s = fs.fstatSync(fd);
     if (s.size > max) return null;
-    return fs.readFileSync(full, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than s.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 function readJson(full) {

package/lib/collectors/runtime.js

@@ -20,11 +20,18 @@ const path = require("node:path");
 const COLLECTOR_ID = "runtime";
 
 function readFileSafe(p, max = 512 * 1024) {
+  let fd;
   try {
-    const s = fs.statSync(p);
+    fd = fs.openSync(p, "r");
+    const s = fs.fstatSync(fd);
     if (s.size > max) return null;
-    return fs.readFileSync(p, "utf8");
+    // readFileSync(fd) loops read() to EOF — a single readSync may return
+    // fewer than s.size bytes on network/FUSE/sync-backed fds, which would
+    // leave the buffer tail NUL-filled and silently drop trailing content.
+    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    return fs.readFileSync(fd, "utf8");
   } catch { return null; }
+  finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
 const NOPASSWD_WILDCARD_RE = /\bNOPASSWD:\s*(?:ALL|\/[^,\n]*\*)/;

package/lib/collectors/sbom.js

@@ -283,22 +283,35 @@ function findSbomDocuments(cwd) {
   const found = [];
   for (const s of SBOM_FORMATS) {
     const p = path.join(cwd, s.file);
-    if (fs.existsSync(p)) {
-      try {
-        const stat = fs.statSync(p);
-        let content;
-        try { content = fs.readFileSync(p, "utf8"); } catch { content = null; }
-        let component_count = null;
-        if (content && s.format === "cyclonedx-1.x") {
-          try {
-            const j = JSON.parse(content);
-            component_count = (j.components || []).length;
-          } catch {}
-        }
-        found.push({ file: s.file, format: s.format, size_bytes: stat.size, component_count });
-      } catch (e) {
-        found.push({ file: s.file, format: s.format, error: e.message });
+    let fd;
+    // Open once and fstat the descriptor instead of existsSync→statSync→read:
+    // an absent file (ENOENT) is skipped just as the existsSync(false) path did,
+    // but there is no TOCTOU window between the check, the size stat, and the read.
+    try { fd = fs.openSync(p, "r"); }
+    catch (e) { if (e.code === "ENOENT") continue; found.push({ file: s.file, format: s.format, error: e.message }); continue; }
+    try {
+      const stat = fs.fstatSync(fd);
+      let content;
+      // Read from the already-open descriptor (no re-open by path → no
+      // TOCTOU window, preserving the fstat-on-fd hardening). readFileSync(fd)
+      // loops internally to EOF; a single readSync(fd, buf, …, stat.size) does
+      // NOT — it can return a short read (network/FUSE mount, signal), leaving
+      // the buffer NUL-padded and truncating valid JSON, so JSON.parse would
+      // throw and component_count silently fall back to null on a present,
+      // parseable SBOM. The fd stays open for the finally{} closeSync.
+      try { content = fs.readFileSync(fd, "utf8"); } catch { content = null; }
+      let component_count = null;
+      if (content && s.format === "cyclonedx-1.x") {
+        try {
+          const j = JSON.parse(content);
+          component_count = (j.components || []).length;
+        } catch {}
       }
+      found.push({ file: s.file, format: s.format, size_bytes: stat.size, component_count });
+    } catch (e) {
+      found.push({ file: s.file, format: s.format, error: e.message });
+    } finally {
+      if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } }
     }
   }
   return found;