@blamejs/exceptd-skills 0.19.0 → 0.19.2

package/AGENTS.md

@@ -44,9 +44,9 @@ Each rule below carries a **Forcing function** annotation declaring whether it i
 12. **External data version pinning** — Every reference to external data (MITRE ATLAS, MITRE ATT&CK, NIST frameworks, CISA KEV, IETF RFCs and Internet-Drafts) must pin to a specific version. When a new version is released: (a) audit for breaking changes (renamed TTPs, tactic-split moves, replaced RFCs, deprecated controls), (b) bump `last_threat_review` in all affected skills, (c) update `_meta` version fields in the relevant `data/*.json` file, (d) update `last_verified` on affected `data/rfc-references.json` entries, (e) never silently inherit version changes. Frameworks lag RFCs; RFCs lag attacker innovation — skills must track lag at every layer.
     *Forcing function:* `_meta` version fields are schema-required; reviewer-checked for cross-file version consistency.
 
-    **Pinned ATLAS version: v2026.06 (June 2026), Secure AI v2 layer (May 2026). Audit cadence: monthly** (ATLAS now ships monthly per CTID; the Secure AI v2 layered set and per-technique maturity classification are tracked separately in `data/atlas-ttps.json` via the `secure_ai_v2_layer` and `maturity` fields).
+    **Pinned ATLAS version: v2026.07 (released 2026-08-07), Secure AI v2 layer (May 2026). Audit cadence: monthly** (ATLAS now ships monthly per CTID; the Secure AI v2 layered set and per-technique maturity classification are tracked separately in `data/atlas-ttps.json` via the `secure_ai_v2_layer` and `maturity` fields).
 
-    **Pinned ATT&CK version: v19.1 (May 2026). Audit cadence: semi-annual** (April and October releases). v19 split Defense Evasion (TA0005) into Stealth (TA0005) and Defense Impairment (TA0112) — affected entries in `data/attack-techniques.json` carry `tactic_moved_from` for traceability. v18 introduced Detection Strategies (DSxxxx) as first-class objects; record applicable strategy IDs on entries where canonical strategies exist.
+    **Pinned ATT&CK version: v19.2 (released 2026-08-05). Audit cadence: semi-annual** (April and October releases). v19 split Defense Evasion (TA0005) into Stealth (TA0005) and Defense Impairment (TA0112) — affected entries in `data/attack-techniques.json` carry `tactic_moved_from` for traceability. v18 introduced Detection Strategies (DSxxxx) as first-class objects; record applicable strategy IDs on entries where canonical strategies exist.
 
     The IETF RFC / Internet-Draft catalog lives at `data/rfc-references.json`; each entry tracks status, errata count, replaces / replaced-by, and `last_verified`.
 
@@ -206,7 +206,7 @@ Wrong: adding a new CVE to `data/cve-catalog.json` without completing all requir
 Right: every new entry requires all fields defined in the CVE catalog schema. Partial entries fail the schema validation in `lib/scoring.js`.
 
 **DR-7: Stale ATLAS / ATT&CK version**
-Current pinned ATLAS version: **v2026.06 (June 2026)** with the **CTID Secure AI v2 layer (May 2026)**. ATLAS audit cadence is **monthly** (CTID now ships monthly). Current pinned ATT&CK version: **v19.1 (May 2026)**, semi-annual cadence (April + October). When either source updates: audit all TTP IDs for changes (including v19's Defense Evasion → Stealth / Defense Impairment split), bump `last_threat_review` in affected skills, update `_meta` version fields in `data/atlas-ttps.json` and `data/attack-techniques.json`. Never silently upgrade.
+Current pinned ATLAS version: **v2026.07 (released 2026-08-07)** with the **CTID Secure AI v2 layer (May 2026)**. ATLAS audit cadence is **monthly** (CTID now ships monthly). Current pinned ATT&CK version: **v19.2 (released 2026-08-05)**, semi-annual cadence (April + October). When either source updates: audit all TTP IDs for changes (including v19's Defense Evasion → Stealth / Defense Impairment split), bump `last_threat_review` in affected skills, update `_meta` version fields in `data/atlas-ttps.json` and `data/attack-techniques.json`. Never silently upgrade.
 
 **DR-8: Missing zero-day learning loop**
 Wrong: adding a new entry to `data/cve-catalog.json` without running the learning loop.
@@ -407,8 +407,8 @@ When in doubt, ship the playbook without a collector and open the gap as a follo
 - [ ] All new CVEs have complete `data/cve-catalog.json` entries
 - [ ] All new CVEs have `data/zeroday-lessons.json` entries
 - [ ] All skill `data_deps` resolve to existing files
-- [ ] All ATLAS refs are valid v2026.06 IDs (current pinned version); Secure AI v2 layer flags + maturity present on AI-pipeline entries
-- [ ] All ATT&CK refs are valid v19.1 IDs (current pinned version); post-split tactics (Stealth / Defense Impairment) used where applicable
+- [ ] All ATLAS refs are valid v2026.07 IDs (current pinned version); Secure AI v2 layer flags + maturity present on AI-pipeline entries
+- [ ] All ATT&CK refs are valid v19.2 IDs (current pinned version); post-split tactics (Stealth / Defense Impairment) used where applicable
 - [ ] All framework control IDs resolve in `data/framework-control-gaps.json`
 - [ ] No skill body contains placeholder language (TODO, TBD, coming soon, placeholder)
 - [ ] No skill uses CVSS as sole risk metric

package/ARCHITECTURE.md

@@ -36,7 +36,7 @@ data_deps:
   - cve-catalog.json          # files in data/ this skill reads
   - atlas-ttps.json
 atlas_refs:
-  - AML.T0043                 # MITRE ATLAS v2026.06 TTP IDs
+  - AML.T0043                 # MITRE ATLAS v2026.07 TTP IDs
   - AML.T0054
 attack_refs:
   - T1068                     # MITRE ATT&CK TTP IDs
@@ -124,7 +124,7 @@ Schema per entry:
   "AML.T0043": {
     "name": "Craft Adversarial Data",
     "tactic": "ML Attack Staging",
-    "atlas_version": "2026.06",
+    "atlas_version": "2026.07",
     "description": "...",
     "framework_coverage": {
       "NIST-800-53": {"covered": false, "nearest_control": null, "gap_description": "..."},
@@ -204,7 +204,7 @@ RWEP (Real-World Exploit Priority) scoring engine.
 
 - `score(cveId)` — Return RWEP score for a CVE in the catalog
 - `scoreCustom(factors)` — Score a custom factor set (for CVEs not yet in catalog)
-- `validate()` — Schema validation: check all skill data_deps resolve, all CVE entries are complete, all ATLAS refs are valid v2026.06 IDs
+- `validate()` — Schema validation: check all skill data_deps resolve, all CVE entries are complete, all ATLAS refs are valid v2026.07 IDs
 - `compare(cveId)` — Return CVSS vs. RWEP comparison with explanation of the delta
 
 RWEP factor weights:

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.19.2 — 2026-08-08
+
+EPSS data on 115 catalog entries is corrected. A refresh had updated an entry's score without its percentile — and on 70 entries written a score with no percentile at all — leaving the two fields drawn from different daily publications. Because the percentile is the score's rank within its publication, the result was entries ranked in the top decile on a score that no longer supported it, which is the input exploit-prioritisation leans on hardest. Scores and percentiles are now written together. A new gate rejects any publication whose percentiles do not track its scores, requires an entry to carry both numbers or neither, and checks that the human-readable EPSS note on an entry restates the values the entry actually holds — 76 notes described an earlier publication than the fields beside them. The ordering check is a corruption detector rather than a provenance proof: it catches a stale value that contradicts the new score's rank, which is what a partial refresh produces, but two fields cannot be proven to share a publication from the catalog alone.
+
+Technique references resolve again. ATT&CK retired `T1562` and its sub-techniques when Impair Defenses became the Defense Impairment tactic, and ATLAS 2026.07 consolidated three publish-poisoned techniques under `AML.T0115`. References to the retired identifiers survived in the D3FEND and DLP control maps, pointing operators at pages MITRE no longer serves and leaving the controls citing them mapped to nothing. Those references now name their successors. Skill text that abbreviated ATLAS runs as `AML.T0096 / T0017` now spells each identifier out, since a bare `T0017` is a different and real ICS technique. A new gate resolves every technique identifier named outside the two pinned MITRE catalogs against them, so a future pin bump cannot leave this residue behind.
+
+`AML.T0091.001` (Use Alternate Authentication Material: Web Session Cookie), `AML.T0113` (Steal Web Session Cookie) and `AML.T0114` (AI Service Web Interface) are now carried in the ATLAS catalog; shipped skills already referenced all three.
+
+Catalog and documentation metadata match the data again. The ATLAS catalog described its pinned release as carrying no removals or renames, which the consolidation contradicts; the ATT&CK catalog named v19.1 while pinned to v19.2; and the README, the `CONTEXT.md` inventory table and the `AGENTS.md` pin dates carried counts and dates from earlier releases. The entries re-keyed under `AML.T0115` had inherited the retired techniques' STIX identifiers and import provenance — they now carry their own, with the superseded identifier kept under a field that names it as such. The release notes for 0.18.29 listed eight new weakness classes where twelve shipped; the four omitted are CWE-138, CWE-274, CWE-441 and CWE-782.
+
+## 0.19.1 — 2026-08-08
+
+The pinned MITRE releases move to ATLAS 2026.07 and ATT&CK 19.2, and the audit that pin bumps require turned up eleven technique identifiers in the shipped catalogs that operators could be routed to but MITRE does not publish as usable.
+
+Five ATT&CK techniques were revoked upstream and are remapped to their successors: `T1562.001` and `T1562.006` to `T1685` (Disable or Modify Tools), `T1562.004` to `T1686` (Disable or Modify System Firewall), `T1562.008` to `T1685.002` (Disable or Modify Cloud Log), and the ICS technique `T0855` to `T1692.001` (Command Message). All seven CVE back-references move with them. These were already revoked in 19.1, the previously pinned release, so they had been shipping revoked for a full version cycle. Six further identifiers — `T0001`, `T0017`, `T0051`, `T0096`, `T1480.003` and `T1486.004` — appear in no ATT&CK domain at either version and are removed; none carried a CVE reference.
+
+ATLAS 2026.07 consolidates three techniques into a new parent, and the catalog follows: `AML.T0019` (Publish Poisoned Datasets), `AML.T0058` (Publish Poisoned Models) and `AML.T0104` (Publish Poisoned AI Agent Tool) become `AML.T0115.000`, `AML.T0115.001` and `AML.T0115.002` under Publish Poisoned AI Artifacts. Each successor records the identifier it replaced, and the CVE and D3FEND cross-references follow.
+
+A new validator checks every shipped technique identifier against the pinned upstream release and runs nightly with the data refresh, where it has the network access the question needs. It reports anything revoked, deprecated or absent upstream, and treats an unreachable upstream as its own outcome rather than a pass — the silent-pass path is what let eleven bad identifiers ship. Offline, the suite now also pins referential integrity between the CVE catalog and the technique mirrors, so a future remap cannot update one and miss the other.
+
 ## 0.19.0 — 2026-08-08
 
 The minimum supported Node.js is raised to 24.19.0 (`engines.node` is now `>=24.19.0`), the current Node 24 LTS patch. It carries roughly three months of runtime security fixes over the previous 24.16.0 floor, including OpenSSL 3.5.7 and the V8 patches released across 24.17, 24.18 and 24.19. Continuous integration, the release workflow, the daily-refresh and ATLAS-currency workflows, and the Docker reproduction harness all move to 24.19.0 together, and the harness base image is re-pinned to the 24.19.0-alpine3.23 manifest digest. The `.nvmrc` that 0.18.0 described is now actually in the repository — it had been swallowed by the dotfile ignore rule and never tracked, so `nvm use` in a fresh checkout selected nothing. It is tracked and pinned to 24.19.0, and the lockstep test now covers both it and the published `engines.node` floor, neither of which any test compared against the toolchain before.
@@ -26,7 +46,7 @@ The batch centers on the late-2022 enterprise-edge and mail-infrastructure wave
 
 Windows kernel and platform escalation is the other center of gravity: the CLFS driver overflows used ahead of ransomware deployment (CVE-2023-23376, CVE-2022-37969), the ALPC and COM+ Event System escalations (CVE-2023-21674, CVE-2022-41033), the CNG Key Isolation flaw reachable inside LSA (CVE-2022-41125), the Print Spooler activation-context escape (CVE-2022-41073), the JScript9 type confusion delivered through Office remote templates by APT37 (CVE-2022-41128), both Mark-of-the-Web bypasses (CVE-2022-41049, CVE-2022-41091), the Defender SmartScreen bypass (CVE-2022-44698), the Active Directory Certificate Services escalation known as Certifried (CVE-2022-26923), and the LNK shortcut flaw Stuxnet used (CVE-2010-2568). Client-side and mobile exploitation covers the Samsung clipboard-provider chain into the Mali and DPU drivers (CVE-2021-25337, CVE-2021-25369, CVE-2021-25370), Apple WebKit and kernel zero-days across iOS, iPadOS and macOS (CVE-2023-23529, CVE-2022-42856, CVE-2022-42827, CVE-2022-32917, CVE-2022-32893, CVE-2022-32894, CVE-2021-31010, CVE-2020-9934), Chromium V8, GPU, Mojo and Intents zero-days (CVE-2022-4262, CVE-2022-4135, CVE-2022-3723, CVE-2022-3075, CVE-2022-2856), and the WebRTC heap overflow Candiru used to deliver DevilsTongue (CVE-2022-2294). A long tail of Linux and Android privilege escalation (CVE-2021-3493, CVE-2013-6282, CVE-2013-2596, CVE-2013-2094, CVE-2011-1823, CVE-2013-2597), signed-driver escalation primitives suitable for bring-your-own-vulnerable-driver (CVE-2018-19320 through CVE-2018-19323, CVE-2015-2291), and internet-facing devices recruited into botnets (CVE-2018-6530, CVE-2022-26258, CVE-2011-4723, CVE-2017-5521, CVE-2018-7445) rounds out the set.
 
-Eight weakness classes backing these entries are new to the CWE catalog: CWE-197 (numeric truncation), CWE-259 (hard-coded password), CWE-270 (privilege context switching error), CWE-311 (missing encryption of sensitive data), CWE-406 (network amplification), CWE-664 (improper control of a resource through its lifetime), CWE-824 (access of uninitialized pointer), and CWE-1285 (improper validation of a specified index, position or offset). CVE-2013-2094 now maps to CWE-1285 rather than the CWE-189 category, which MITRE prohibits using to map real-world vulnerabilities.
+Twelve weakness classes backing these entries are new to the CWE catalog: CWE-138 (improper neutralization of special elements), CWE-197 (numeric truncation), CWE-259 (hard-coded password), CWE-270 (privilege context switching error), CWE-274 (improper handling of insufficient privileges), CWE-311 (missing encryption of sensitive data), CWE-406 (network amplification), CWE-441 (unintended proxy or intermediary, the confused-deputy class), CWE-664 (improper control of a resource through its lifetime), CWE-782 (exposed IOCTL with insufficient access control), CWE-824 (access of uninitialized pointer), and CWE-1285 (improper validation of a specified index, position or offset). CVE-2013-2094 now maps to CWE-1285 rather than the CWE-189 category, which MITRE prohibits using to map real-world vulnerabilities.
 
 ## 0.18.28 — 2026-08-05
 

package/CONTEXT.md

@@ -113,16 +113,16 @@ Skills and playbooks read from `data/`. Authoritative catalog inventory:
 
 | File | Entries | Purpose |
 |------|---------|---------|
-| `cve-catalog.json` | 459 | CVEs with CVSS, RWEP score, EPSS estimates, CISA KEV flags, PoC and live-patch availability |
-| `atlas-ttps.json` | 170 | MITRE ATLAS v2026.06 (May 2026) techniques with framework gap flags |
-| `attack-techniques.json` | 805 | MITRE ATT&CK techniques with framework coverage mappings |
+| `cve-catalog.json` | 1025 | CVEs with CVSS, RWEP score, EPSS estimates, CISA KEV flags, PoC and live-patch availability |
+| `atlas-ttps.json` | 174 | MITRE ATLAS v2026.07 (August 2026) techniques with framework gap flags |
+| `attack-techniques.json` | 794 | MITRE ATT&CK techniques with framework coverage mappings |
 | `framework-control-gaps.json` | 194 | Framework control gap entries: designed-for vs. what each control misses |
 | `exploit-availability.json` | 28 | Per-CVE PoC locations, weaponization stage, AI-acceleration factor, live-patch status |
 | `global-frameworks.json` | 35 jurisdictions | Patch SLAs and notification windows across global regulatory regimes |
-| `zeroday-lessons.json` | 459 | Learning-loop entries: zero-day → attack vector → control gap → framework gap → new control |
-| `cwe-catalog.json` | 181 | CWE v4.20 entries (Top 25 2024 plus AI- and supply-chain-relevant weaknesses) |
+| `zeroday-lessons.json` | 1025 | Learning-loop entries: zero-day → attack vector → control gap → framework gap → new control |
+| `cwe-catalog.json` | 232 | CWE v4.20 entries (Top 25 2024 plus AI- and supply-chain-relevant weaknesses) |
 | `d3fend-catalog.json` | 468 | MITRE D3FEND v1.3.0 defensive techniques for offensive → defensive mapping |
-| `rfc-references.json` | 8888 | IETF RFC / Internet-Draft references with status, errata count, replaces / replaced-by, `last_verified` dates |
+| `rfc-references.json` | 8889 | IETF RFC / Internet-Draft references with status, errata count, replaces / replaced-by, `last_verified` dates |
 | `dlp-controls.json` | 22 | DLP control entries indexed by channel, classifier, surface, enforcement mode, evidence type |
 | `playbooks/` | 33 | Playbook specifications (see above) |
 | `_indexes/` | 17 derived files | Pre-computed indexes built by `npm run build-indexes` |

package/README.md

@@ -15,8 +15,8 @@
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/blamejs/exceptd-skills/badge)](https://scorecard.dev/viewer/?uri=github.com/blamejs/exceptd-skills)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 [![Skills](https://img.shields.io/badge/skills-51-d946ef)](#skill-inventory)
-[![ATLAS](https://img.shields.io/badge/MITRE%20ATLAS-v2026.06-d946ef)](https://atlas.mitre.org)
-[![ATT&CK](https://img.shields.io/badge/MITRE%20ATT%26CK-v19.1-d946ef)](https://attack.mitre.org)
+[![ATLAS](https://img.shields.io/badge/MITRE%20ATLAS-v2026.07-d946ef)](https://atlas.mitre.org)
+[![ATT&CK](https://img.shields.io/badge/MITRE%20ATT%26CK-v19.2-d946ef)](https://attack.mitre.org)
 [![Ed25519-signed](https://img.shields.io/badge/skills-Ed25519--signed-2ea043)](AGENTS.md)
 [![Jurisdictions](https://img.shields.io/badge/jurisdictions-35-blue)](data/global-frameworks.json)
 
@@ -30,7 +30,7 @@ This platform surfaces what is actually happening right now. Every skill explici
 
 ## Status
 
-Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 923 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
+Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 1025 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
 
 ---
 
@@ -49,7 +49,7 @@ Assess Linux kernel local privilege escalation exposure. Covers Copy Fail (CVE-2
 ### AI-Specific Attack Surface
 
 **[ai-attack-surface](skills/ai-attack-surface/skill.md)**
-Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.06 with explicit gap flags. Covers prompt injection as enterprise RCE (CVE-2025-53773 CVSS 7.8, 85%+ bypass rate against SOTA defenses), MCP supply chain RCE (CVE-2026-30615, zero user interaction, 150M+ downloads), RAG exfiltration, model poisoning, AI-assisted exploit development (41% of 2025 zero-days), credential theft acceleration (160% increase).
+Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.07 with explicit gap flags. Covers prompt injection as enterprise RCE (CVE-2025-53773 CVSS 7.8, 85%+ bypass rate against SOTA defenses), MCP supply chain RCE (CVE-2026-30615, zero user interaction, 150M+ downloads), RAG exfiltration, model poisoning, AI-assisted exploit development (41% of 2025 zero-days), credential theft acceleration (160% increase).
 
 **[mcp-agent-trust](skills/mcp-agent-trust/skill.md)**
 Enumerate MCP (Model Context Protocol) trust boundary failures. Covers tool allowlisting gaps, unsigned server manifests, prompt injection via tool responses, supply chain compromise. CVE-2026-30615 (Windsurf, zero-interaction RCE). Generates: tool allowlist policy, server signing requirements, bearer auth config, output sanitization requirements.
@@ -622,7 +622,7 @@ All skills pull from `data/`. Cross-validated against canonical upstream sources
 To resolve a single citation rather than refresh the whole catalog, `exceptd cve <CVE-ID>` and `exceptd rfc <number>` return a status verdict for one id (catalog → resolved cache → one NVD / datatracker lookup, offline-capable). The lookup caches, so a fan-out of agents shares the answer instead of each independently re-researching the same citation.
 
 - `cve-catalog.json` — CVE metadata with RWEP scores, CISA KEV status, PoC availability, live-patch info
-- `atlas-ttps.json` — MITRE ATLAS v2026.06 TTPs with gap flags and exploitation examples. Each TTP now carries a `cve_refs[]` back-edge — operators reading an ATLAS entry see the catalogued CVEs that cite it without grepping `cve-catalog.json`. The same back-edge is populated on `attack-techniques.json`, and each playbook carries a `_meta.fed_by[]` reverse field naming the upstream playbooks that chain into it.
+- `atlas-ttps.json` — MITRE ATLAS v2026.07 TTPs with gap flags and exploitation examples. Each TTP now carries a `cve_refs[]` back-edge — operators reading an ATLAS entry see the catalogued CVEs that cite it without grepping `cve-catalog.json`. The same back-edge is populated on `attack-techniques.json`, and each playbook carries a `_meta.fed_by[]` reverse field naming the upstream playbooks that chain into it.
 - `framework-control-gaps.json` — Per-framework, per-control: what it was designed for vs. what it misses
 - `exploit-availability.json` — PoC locations, weaponization status, AI-assist factor
 - `global-frameworks.json` — All major global compliance frameworks (35 jurisdictions) with control inventories and lag scores
@@ -638,7 +638,7 @@ To resolve a single citation rather than refresh the whole catalog, `exceptd cve
 
 **Compliance is not security.** A SOC 2 Type II report confirms that controls existed and operated effectively during the audit period. It says nothing about whether those controls are adequate for current attack patterns. When NIST 800-53 SI-2 says "apply security patches in a timely manner" and Copy Fail is a 732-byte deterministic root with a public PoC and no race condition, "timely" is the wrong frame entirely.
 
-**Framework lag is measured in months.** MITRE ATLAS v2026.06 (May 2026) is the most current AI threat framework available. It still lags real exploitation by 3-6 months. NIST AI RMF lags by years. ISO 27001:2022 has no AI-specific controls. These skills explicitly flag every place where framework coverage ends and real attacker capability begins.
+**Framework lag is measured in months.** MITRE ATLAS v2026.07 (May 2026) is the most current AI threat framework available. It still lags real exploitation by 3-6 months. NIST AI RMF lags by years. ISO 27001:2022 has no AI-specific controls. These skills explicitly flag every place where framework coverage ends and real attacker capability begins.
 
 **AI changed the exploit development timeline.** Copy Fail was discovered by an AI system in approximately one hour. 41% of 2025 zero-days involved AI-assisted reverse engineering on the attacker side. The time between vulnerability introduction and reliable exploitation is compressing faster than patch management processes can adapt. Risk scoring must reflect this.
 

package/data/_indexes/_meta.json

@@ -1,68 +1,68 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-08T04:46:34.083Z",
+  "generated_at": "2026-08-08T18:32:36.137Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "1eceba3a8b05e0730c4cdf66599351ece47b0139d376012cec48015c4bad16cd",
-    "README.md": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a",
-    "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "7421b89bd0594f01d72e04695aeffec35d9f32fa54ac74994a0d082373f7b51a",
-    "data/cve-catalog.json": "86c19b46830b266819f5d51d22e33895e77c9fa57c8dbdb93d6dcbc38489bf7d",
+    "manifest.json": "53564f4e897f2d56d4eba1ccd97e9d9cb942c8307221e1ac7a9946cc6c312ab1",
+    "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
+    "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
+    "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
+    "data/cve-catalog.json": "0f440663a16dfffa241e173eb8ba8613c790015e2eb5f81a5a33ea88975ca1d5",
     "data/cwe-catalog.json": "27b244f6e82528ddef7923d0ddaca9942db3c49411ff8184c471d9195179803f",
-    "data/d3fend-catalog.json": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d",
-    "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
+    "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
+    "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "31771df41c66ff5c890fe12a9af2accf97198933c9f65949b04adbe33037fd4d",
+    "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "e3b4ab4430aae788328f821c2fb0a93df7c12c806e2a3a4eca23f9e6bb00100b",
+    "data/zeroday-lessons.json": "9bc4f85c15d1618ef438a9221346c6913f823c5b8368acc2b2d5756c3a07c21e",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
-    "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
-    "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
-    "skills/framework-gap-analysis/skill.md": "3eca7d751da22c4b6ac9d399d5519853f9274ed03fcb315cdedab67e7b4e4cb9",
-    "skills/compliance-theater/skill.md": "a7742199a9c25dde18ca022c5f844eed7395ff7b1aa350f7d0b573e721f2d04a",
-    "skills/exploit-scoring/skill.md": "b7015d8a6b0f8b8fae92d8bda12ee64d62429ab57edfec49d4d7772f03885c67",
-    "skills/rag-pipeline-security/skill.md": "20439a98ff5026adad9684649b249371a68e685b27be6b42358068d635a8e296",
-    "skills/ai-c2-detection/skill.md": "6503b57a793885b73aabfef6d336fd2717af33b1228571a2fb732dc9f5f475dc",
-    "skills/policy-exception-gen/skill.md": "4c368d05875cbb4a7f008e627a7452a176db21b9ac5f08f813ac8007ddd17bbc",
-    "skills/threat-model-currency/skill.md": "11be4c065cab1bdd5230b03869850651b61478aa8fd690ca47373bcf205af5f6",
+    "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
+    "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
+    "skills/framework-gap-analysis/skill.md": "98696eeda0400a6dcf6c2ba0ec977565626e8e943575fbf1c0a411a09d4acf6e",
+    "skills/compliance-theater/skill.md": "ce163e4478c45a85d8f82e84e05092e442d1405c0642a2015caef61dc691732f",
+    "skills/exploit-scoring/skill.md": "b18b86fd51d3dd94b058c698aa22457a96a7993e5ea474ae246cc60f348948cc",
+    "skills/rag-pipeline-security/skill.md": "360caa6c03913625214e4f2f8430e7306f64ce5f44e8cc3d52af1368c7d8a6b4",
+    "skills/ai-c2-detection/skill.md": "b276c95f5df647dfefff42b34817367d0a0cf5a037beee62134de408ac14e3d9",
+    "skills/policy-exception-gen/skill.md": "9e137c4f39cb8223202e8d1a06ccba1643bd3444188dac174d1d6382a756ce7e",
+    "skills/threat-model-currency/skill.md": "32a1841401ad01abc274ed8362db2f59b43df53d0b274e6f810a418f845e6c28",
     "skills/global-grc/skill.md": "cbbc37475a6bfabde26ee0f064bb853088d4e004691af92d6fa007f6bfb8ddfd",
-    "skills/zeroday-gap-learn/skill.md": "b9216006195d7db2e2f66e55b8b9e99702c7e6a36100dea641709101027b2825",
-    "skills/pqc-first/skill.md": "794e53921d5d8b0bfcd512f6c28b1fecf2ef3bb5a9ccd83826bb0b79cae4aef4",
-    "skills/skill-update-loop/skill.md": "fbcc0786ebbc2d2735944269f82ded10affd9f4efa29c2f6cdc4c283024837de",
-    "skills/security-maturity-tiers/skill.md": "708094f0ca32b33cf8593a29f3d6f9c63f1b6421233c5d5bfe8039de56bc85aa",
+    "skills/zeroday-gap-learn/skill.md": "c4ff1b30a3ac0b11ebd65b35d8caeb309532d66e629051e54dfd6bf6db45d592",
+    "skills/pqc-first/skill.md": "307984c12c2daa473197b5f4b3d9ca97b037f1967610dce29b46aa282a3a842d",
+    "skills/skill-update-loop/skill.md": "c60ab918e0e51bd9ac39d88e58a6fd74b2091e4d0cadb7f1b10dbae824fd220c",
+    "skills/security-maturity-tiers/skill.md": "2d3c46525b5bccce461966ca62bbecaee9a9600afc81b2d80fd63047d6c86cb9",
     "skills/researcher/skill.md": "9f1211d177c64e4c465407a45ad9e2901c5c6c0af410a0d0a51cc8fb780420d4",
-    "skills/attack-surface-pentest/skill.md": "5b1f96ae23825c0a1eb77d2ede29143308b7219e10f99c5b657fb6f788fad3b8",
-    "skills/fuzz-testing-strategy/skill.md": "632b4004ae953fbea3ede136557dc044395ea8aa7b49b220e7d1e5d0c5cb676f",
-    "skills/dlp-gap-analysis/skill.md": "485a628c5153a579e771077c79c7ddd647a2fba98dbe2b048ca98d0f8d54007f",
-    "skills/supply-chain-integrity/skill.md": "3a6ae83729b9e8967740aa9ccb3951e474471424225f8d15815d68f36801b6ea",
-    "skills/defensive-countermeasure-mapping/skill.md": "48f140a265a96cd8c2d065f63a351ad02bbcbca5f75a686f3e8094e93f2d0383",
+    "skills/attack-surface-pentest/skill.md": "a2f6da0e1bd910a456b06be600450debbf9d3d3086f1155b2e14b0181ccd9b77",
+    "skills/fuzz-testing-strategy/skill.md": "d35c6b2ae22b28e59c6f0a5284d77e9f9f0ea528814f87914c6b4f2c656d14e3",
+    "skills/dlp-gap-analysis/skill.md": "f6486e2ac28a47db2e32c25f2b073161992c375dec0e01c9760654ab1a4f40b6",
+    "skills/supply-chain-integrity/skill.md": "690fbec29d377ab938f3d4b6e5451bb6cbc8a2af8eb356b27201a6902012fda8",
+    "skills/defensive-countermeasure-mapping/skill.md": "e182f3130fe78e403db6c81c24757bc81dfbc86997e0b5f304f05d5572f7abb2",
     "skills/identity-assurance/skill.md": "86649aa573bde5b2ef2456a77d2fbfa9d1b623a4ef1326dd7a7ab384d0419307",
-    "skills/ot-ics-security/skill.md": "1424e2468f630f43e98deb711c5fe00e696963bf4c7432cd23f4d33776354131",
-    "skills/coordinated-vuln-disclosure/skill.md": "85c83345ea12b84370c33d17a69b3923c437461c9056200bf48ac5a07c530c91",
-    "skills/threat-modeling-methodology/skill.md": "5bc17057a36c6d57dfb7a89eeffd0115255505e24731e992a6eaaa7ada241b7f",
-    "skills/webapp-security/skill.md": "1f51b893bd52819763d9a15cc8245a64c48a25e99243c6bff602ea56a3a0f7e4",
+    "skills/ot-ics-security/skill.md": "46b7f0bc04e6d894e6a229cc0e7623a633951ebcb5e463513a2c469ded735352",
+    "skills/coordinated-vuln-disclosure/skill.md": "8e4c7319883e6d67f26552165d26860db109de18098724b44b00214c9c2a771a",
+    "skills/threat-modeling-methodology/skill.md": "28d228440a8019dadeff26257cd9d9babddd7144df2efdb9aa4db2e6b9fc25e1",
+    "skills/webapp-security/skill.md": "2b2c362e2670dc4f465b2531d87c9c9fc56d9d0808256e9d83ec853159f6dd1f",
     "skills/ai-risk-management/skill.md": "3e116dc6f03f31e32f1ee885516d72d9c11d3ff67d2184108b13dcbdf5f417bf",
-    "skills/sector-healthcare/skill.md": "c3648a045d7caf584f7183f3b1171eb6056c5655446d84c143068ed2a5c08e1d",
-    "skills/sector-financial/skill.md": "8ed139656416b59fae9d04d077c3381bbf8d39d41b102d23e83ce012f317d54d",
-    "skills/sector-federal-government/skill.md": "f62fde3f38da53f11bc342ce7d5ed0aa08f989d39f6a737a82748ae7866cc77e",
-    "skills/sector-energy/skill.md": "52eaf78e2adbd082f3f5507d1cc304e36b48e435284b4277953853fcae93e7bc",
+    "skills/sector-healthcare/skill.md": "4a7c1f94ec9baa09327772b899b8b78e723a73973d0c0b44b9c11c573fd9883e",
+    "skills/sector-financial/skill.md": "2191a0bb897775bc24af3aeae3a132e5c9e8f1bfa503a13f69c895224bac6e66",
+    "skills/sector-federal-government/skill.md": "7b6880c3919bc0af5468ceaee144264676580276c9a2d70cfc58d6114dd6aa43",
+    "skills/sector-energy/skill.md": "a75255774aabc31a85f28f2a0ba30f02cb5b7d2fc2e0428c293fb94f1249cf69",
     "skills/sector-telecom/skill.md": "4b80771e78a474e3f43227ecc730ddda1684bff98d7e6e53f5ec373e1e886f34",
-    "skills/api-security/skill.md": "ad548f992000bb8192ec1e9f2d022969cd0159af8d4d3ab1ed43df03d6d9a391",
-    "skills/cloud-security/skill.md": "70840280d14c8b01c16c05757774da6cfe97e85ec6f18948e4081a3e1d784880",
-    "skills/container-runtime-security/skill.md": "39b3944f2a02987fcfdc08c5e710552097937098b5e89799932f43ea1765c321",
-    "skills/mlops-security/skill.md": "b004014c10181571db4fe8b2bb329ebf82d209eb5b1b020fd5d5e32b1b593ee9",
-    "skills/incident-response-playbook/skill.md": "306c8a34c2d57792bf892c2e0f611944f4622f81b5c7aeb048614887c5e29a62",
-    "skills/ransomware-response/skill.md": "932ab8b0958f9bdcbb0b0430bd88ab8005398b43417bcdac715141a9ad85b63c",
+    "skills/api-security/skill.md": "cc2851e3344dcdf99335d0f5b7c19c755871c5d973b5ae384b35e5017877aa44",
+    "skills/cloud-security/skill.md": "2b62492d19895fd5e4b5091af20014606a94c62f0058a6e7e24a1fa381713db5",
+    "skills/container-runtime-security/skill.md": "7e9ff5c68b1b86436cb1f9cc3fa9aaeac7a68de7f01877e7202944138d307066",
+    "skills/mlops-security/skill.md": "156965bdf43f8d3973ac9bc95f71d39d36a8c1a72e4833eb83faee3d4e5168eb",
+    "skills/incident-response-playbook/skill.md": "5a4de978515f974cb88cb4dcfb69d02eefa7a0d29a22a2f8a732fb7f8dd5d107",
+    "skills/ransomware-response/skill.md": "ed9855c8ce1fb2830f1cf69a4554bf7600964f32fd75898b41f8a23003ae9a6d",
     "skills/email-security-anti-phishing/skill.md": "0965eca982e8fc633b85e70c0ba6becb8c0f5ee7bdd0be96ad73a9a222bb8816",
-    "skills/age-gates-child-safety/skill.md": "d299a1bb4374343a9e0c066f4579df0ba89d86fc74b1b622219c57b4b17050da",
-    "skills/cloud-iam-incident/skill.md": "6aab2e400d1e87df7ac2b6f0a17dac6aa99723b217258c4a7b446703d1521775",
+    "skills/age-gates-child-safety/skill.md": "3f2fbc7045b3ae9ba87e634d92dd37db8ed280136ad226c7b6d0fd544e9a9c79",
+    "skills/cloud-iam-incident/skill.md": "5155c3f441541c490ef84c200cd42c134ca5fb9b6ea685abfe0dc2bad64c4c01",
     "skills/idp-incident-response/skill.md": "cb2f2c5b90de4592bfd66dcd55f9bf2004f370746d519cad577fcbaf36125878",
     "skills/vc-wallet-trust/skill.md": "802dada75d934c9ab322246f650eb2eac9e2f72c1f094b0cebcfa605b56108a5",
     "skills/mail-server-hardening/skill.md": "0554e23457851ac1cdb3b8217fae902789798db1bbc67c5f4cf1df6fd265cf15",
     "skills/network-trust/skill.md": "d1c2fd6ce0bd74e508a41a61c8618cc5c979eaea2702ca97003ce46ba8c9dfa8",
-    "skills/audit-log-integrity/skill.md": "72485e8df55dea8df80b675f04f32de2d32b8ee17d5e0aa96e61cd9bcb831193",
+    "skills/audit-log-integrity/skill.md": "0a83d540d0249228110403d330a6ad833488010b49552efacad125e4725ba54e",
     "skills/self-update-integrity/skill.md": "305d4841d7434e18812be4b8646eb7a4f7f4416e3646aad3b6e7152d16f0c8af",
     "skills/multitenancy-isolation/skill.md": "60d7db9cbac49b307c7062a3b27a3cef8aab8cc774176c428075981fbc18758f",
     "skills/decompression-dos/skill.md": "53fd0a90ccc0e7ac6056e9c9fd40f3ab3342d30739399079b5e644eef6405d88",
@@ -107,7 +107,7 @@
     "handoff_dag_nodes": 51,
     "summary_cards": 51,
     "section_offsets_skills": 51,
-    "token_budget_total_approx": 441982,
+    "token_budget_total_approx": 442032,
     "recipes": 8,
     "jurisdiction_clocks": 29,
     "did_ladders": 8,

package/data/_indexes/activity-feed.json

@@ -5,6 +5,22 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-08-08",
+      "type": "catalog_update",
+      "artifact": "data/atlas-ttps.json",
+      "path": "data/atlas-ttps.json",
+      "schema_version": "1.0.0",
+      "entry_count": 174
+    },
+    {
+      "date": "2026-08-08",
+      "type": "catalog_update",
+      "artifact": "data/attack-techniques.json",
+      "path": "data/attack-techniques.json",
+      "schema_version": "1.0.0",
+      "entry_count": 794
+    },
     {
       "date": "2026-08-08",
       "type": "catalog_update",
@@ -58,20 +74,12 @@
       "schema_version": "1.0.0",
       "entry_count": 8889
     },
-    {
-      "date": "2026-07-03",
-      "type": "catalog_update",
-      "artifact": "data/atlas-ttps.json",
-      "path": "data/atlas-ttps.json",
-      "schema_version": "1.0.0",
-      "entry_count": 170
-    },
     {
       "date": "2026-06-10",
       "type": "skill_review",
       "artifact": "ai-attack-surface",
       "path": "skills/ai-attack-surface/skill.md",
-      "note": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.06 with explicit framework gap flags"
+      "note": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.07 with explicit framework gap flags"
     },
     {
       "date": "2026-06-10",
@@ -283,14 +291,6 @@
       "path": "skills/age-gates-child-safety/skill.md",
       "note": "Age-related gates and child online safety for mid-2026 — COPPA + CIPA + California AADC + GDPR Art. 8 + DSA Art. 28 + UK Online Safety Act + UK Children's Code + AU Online Safety Act + IN DPDPA child provisions + KOSA pending; age verification standards (IEEE 2089-2021, OpenID Connect age claims); AI product age policies"
     },
-    {
-      "date": "2026-06-10",
-      "type": "catalog_update",
-      "artifact": "data/attack-techniques.json",
-      "path": "data/attack-techniques.json",
-      "schema_version": "1.0.0",
-      "entry_count": 805
-    },
     {
       "date": "2026-06-02",
       "type": "skill_review",

package/data/_indexes/catalog-summaries.json

@@ -7,9 +7,9 @@
   "catalogs": {
     "atlas-ttps.json": {
       "path": "data/atlas-ttps.json",
-      "purpose": "MITRE ATLAS TTPs (AML.T0xxx) cited by skills, with tactic, name, description. Pinned to ATLAS v2026.06 (May 2026).",
+      "purpose": "MITRE ATLAS TTPs (AML.T0xxx) cited by skills, with tactic, name, description. Pinned to ATLAS v2026.07 (May 2026).",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-03",
+      "last_updated": "2026-08-08",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -18,7 +18,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 170,
+      "entry_count": 174,
       "sample_keys": [
         "AML.T0001",
         "AML.T0040",
@@ -31,7 +31,7 @@
       "path": "data/attack-techniques.json",
       "purpose": null,
       "schema_version": "1.0.0",
-      "last_updated": "2026-06-10",
+      "last_updated": "2026-08-08",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -40,13 +40,13 @@
         "rebuild_after_days": 365,
         "note": "Catalog must be rebuilt against the upstream ATT&CK release whenever MITRE publishes a new version. AGENTS.md external-data version-pinning rule requires the bump to be intentional, not silent. ATT&CK ships semi-annually (April + October); audit on each release for tactic moves, technique splits, and new Detection Strategies."
       },
-      "entry_count": 805,
+      "entry_count": 794,
       "sample_keys": [
-        "T0001",
-        "T0017",
-        "T0051",
-        "T0096",
-        "T0853"
+        "T0853",
+        "T0867",
+        "T0883",
+        "T1021",
+        "T1027"
       ]
     },
     "cve-catalog.json": {