@blamejs/exceptd-skills 0.19.37 → 0.19.39

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.19.37",
+  "version": "0.19.39",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-08-30T13:29:33.372Z",
+      "signed_at": "2026-09-05T04:29:31.958Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -133,7 +133,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "hnKY1LYEKUurrzJIFcvwCZpclpk/XT8fMVJeCKqzrpOpfgov2d3AciuiEky85PhREzAmYGFfk2sLRC6ayJ6UDw==",
-      "signed_at": "2026-08-30T13:29:33.373Z",
+      "signed_at": "2026-09-05T04:29:31.960Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -215,7 +215,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "uiJt3Oj0lSLr7Nm0OoM2qI/z/oAIAiPwMfP12s97jVYeA7xfOlU21fc7zidT/9YulunfaSjBSAlgv6paWmosBg==",
-      "signed_at": "2026-08-30T13:29:33.374Z",
+      "signed_at": "2026-09-05T04:29:31.960Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -269,7 +269,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "80LN540R3z/gcIMCF/8H6nh2V6xdudctYKE74Ve7bqecyPUQf2NfCA/8T9L18tIz7BTyBkiI/V5JcG4ClgNyCQ==",
-      "signed_at": "2026-08-30T13:29:33.374Z"
+      "signed_at": "2026-09-05T04:29:31.960Z"
     },
     {
       "name": "compliance-theater",
@@ -301,7 +301,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Tsat4OgtCJ6yGJQeIQnz+XTU11B8SLgbPe1zmb2UFOzxqlBnRoKeOzIVwFsv7wM0mP1bXQvQgFFpIOxN2VeTCQ==",
-      "signed_at": "2026-08-30T13:29:33.374Z"
+      "signed_at": "2026-09-05T04:29:31.961Z"
     },
     {
       "name": "exploit-scoring",
@@ -332,7 +332,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "zxsj3SExhBJ+A7UDZEI4uWl4OCbnn5+ddCRCalhlHKFyRML9fcB9qd1v9a+hDoeVJXGr/OBXHR3MdyD8XEhrDQ==",
-      "signed_at": "2026-08-30T13:29:33.375Z"
+      "signed_at": "2026-09-05T04:29:31.961Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -374,7 +374,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lrj8/nJWYzgeOYPF9Ax59A0mxCXWKKhH9QI+88KQNiKly0Hq+pA5wdtL0J9LY24YrVWmqEhpSHueGlj03UNOAA==",
-      "signed_at": "2026-08-30T13:29:33.375Z",
+      "signed_at": "2026-09-05T04:29:31.961Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -441,7 +441,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "nqqZUnu7ZocLNJKs3KJO6NnoC8MgmS1iGP9TGrv51e+trjqb4Gf2mAjCTe7pINFivWDK00A0ZHazaMAKKbaNCA==",
-      "signed_at": "2026-08-30T13:29:33.375Z",
+      "signed_at": "2026-09-05T04:29:31.962Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -482,7 +482,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "ZfFXIDjwGDwlZA30TOMPmNr0IK/sydbsiox7LYU0pGkaRlQW18/oSjkHZRgiQpP5yzQhuFsKdztA7Ec6BDQLAA==",
-      "signed_at": "2026-08-30T13:29:33.376Z",
+      "signed_at": "2026-09-05T04:29:31.962Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -517,7 +517,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "CtiEhtzaqg/hCGX1wmgEGq0O6o+UNf9RAM3xxn0rQVEkFt/IEmyYqsWd1qjpqMdp8kbEXgAsd816AwFwLYMaAA==",
-      "signed_at": "2026-08-30T13:29:33.376Z",
+      "signed_at": "2026-09-05T04:29:31.963Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -558,7 +558,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-08-05",
       "signature": "Eu2AnT4xyZH9n3OKjm5S9vaiHqUE+1N3oLAQbbt78OCp2HnAQMvqBkUn9rgl4Il7Il7yZW8N7c8hq3mkst+EAA==",
-      "signed_at": "2026-08-30T13:29:33.377Z",
+      "signed_at": "2026-09-05T04:29:31.963Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -600,7 +600,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "tlvk8q1fa1scoDsJMZnigCoRNO3dqoK03Ve8tuYE2/nPwAMAGlofHpoE0mI0BX4pPODPgCfSjzgKEUn6HkcZDw==",
-      "signed_at": "2026-08-30T13:29:33.377Z",
+      "signed_at": "2026-09-05T04:29:31.963Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -669,7 +669,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "DNXmzLVK71XI/b9mkIBw30KVdVV5Wc9/0o/pP35RkferqtvlsMHjj4WJpoGXpIu8/hJyuMJRQrV7pzfR68iIAg==",
-      "signed_at": "2026-08-30T13:29:33.378Z",
+      "signed_at": "2026-09-05T04:29:31.964Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -719,7 +719,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "AzyfBZd5bxpQpaFb/S5ZJI2/NjeACLuq/u8GzKHehhlggWUqILIrS4aJ6eXn0I3UBhuXRcNBBx1mXriCSmhQAA==",
-      "signed_at": "2026-08-30T13:29:33.378Z"
+      "signed_at": "2026-09-05T04:29:31.964Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -759,7 +759,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "8JHth6QjMcUuAD069/QvpMxgRMG+L/PVTE68/UdX9kG4SNA20ds7vHU15YzMNBmWWgiUvpLAE6hzctz1N7bWCg==",
-      "signed_at": "2026-08-30T13:29:33.379Z",
+      "signed_at": "2026-09-05T04:29:31.965Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -813,7 +813,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-08-30T13:29:33.379Z"
+      "signed_at": "2026-09-05T04:29:31.965Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -889,7 +889,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "GuHxmoEU97+lQfU11chYwXVQhSMpddU0OS1iLkYDmEJhBkHRWWaOa2emYJoVUBDB9v/PTKcFEuEraZwYg+8nCw==",
-      "signed_at": "2026-08-30T13:29:33.379Z"
+      "signed_at": "2026-09-05T04:29:31.965Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -950,7 +950,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "R2jcBorSMWFuZKHUugWEni9q/W7Qk73Kg0SztXlySYu9+D2Ee43gyYsUy0nSa0oCTS8pyuhFiFv2XN0EaweTBQ==",
-      "signed_at": "2026-08-30T13:29:33.380Z"
+      "signed_at": "2026-09-05T04:29:31.966Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -1028,7 +1028,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "uIQdYlbKIQw8qQRDeGnXv4D/wuPAvYFRzos3kqkyELx+v9rGmfmT7w5s1608lpJxXzGLIA7BSN2/wLJJAZmXCg==",
-      "signed_at": "2026-08-30T13:29:33.380Z"
+      "signed_at": "2026-09-05T04:29:31.966Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1112,7 +1112,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "4EMvqqcYHnM+9fmlS156Utl3T248EqHdiB89zVyW8+wUYHAU/VLUOr27JiiSmj5iZrdY5Prq7t9Hsk3LuVx5Aw==",
-      "signed_at": "2026-08-30T13:29:33.381Z"
+      "signed_at": "2026-09-05T04:29:31.966Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1169,7 +1169,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "W8kg2Okd/VF521VmeVFGK2TmXkFPycuwgYdyNxLU2fMN+sR9Aals/X+Xqr/prrGEsqWnZsCInSq1TYzFr0wiDg==",
-      "signed_at": "2026-08-30T13:29:33.381Z"
+      "signed_at": "2026-09-05T04:29:31.967Z"
     },
     {
       "name": "identity-assurance",
@@ -1243,7 +1243,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-08-30T13:29:33.381Z"
+      "signed_at": "2026-09-05T04:29:31.967Z"
     },
     {
       "name": "ot-ics-security",
@@ -1302,7 +1302,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "1PFZXMfQwM0dHsZQfo+rg5hJB00dfeOL41VA3J8gNF6cCUpplw9vQuZfODX/SwXI/WmDQwM9G2sd1X/i7LG9DA==",
-      "signed_at": "2026-08-30T13:29:33.381Z"
+      "signed_at": "2026-09-05T04:29:31.967Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1362,7 +1362,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "5b3J9mk/iEi6OzeC0O2hw/K/ofTrH8519l+ZUpK8gqB/v0XbDFceIIBPB8TQM8wCct5iG0Krb7OCDSIbU0jVBw==",
-      "signed_at": "2026-08-30T13:29:33.382Z"
+      "signed_at": "2026-09-05T04:29:31.968Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1416,7 +1416,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "fibgNRd+STEyN3ZlnIxJddfaOXISYosdjoxkQ/oNVTP3GKhN1A4c3Jh0HZPbhTdjhrbJM/mE5ufiIOs7+RCMCQ==",
-      "signed_at": "2026-08-30T13:29:33.382Z"
+      "signed_at": "2026-09-05T04:29:31.968Z"
     },
     {
       "name": "webapp-security",
@@ -1499,7 +1499,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "3qtC0X8QR9YufDfeL/AUiw3EeJwvSfSrUWojndEZVmeJ3MtM12I94OJmaQT1AWaTRWVa9f91owgLl6AgoTNVAA==",
-      "signed_at": "2026-08-30T13:29:33.382Z",
+      "signed_at": "2026-09-05T04:29:31.968Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1559,7 +1559,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-08-30T13:29:33.383Z"
+      "signed_at": "2026-09-05T04:29:31.969Z"
     },
     {
       "name": "sector-healthcare",
@@ -1626,7 +1626,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Z/lPfIH5ARAOoeR81ATj6lQlekZP/8tzg23Pr1H9BxxdQedRsLGDNVIHu81qNuoA7GNRRMtxXpwrS7fXbMh5Cw==",
-      "signed_at": "2026-08-30T13:29:33.383Z"
+      "signed_at": "2026-09-05T04:29:31.969Z"
     },
     {
       "name": "sector-financial",
@@ -1715,7 +1715,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "kPV8cEpIUAMKY2USvFxAn6JkkRMlBAM2mGLy6ViS9O3rv+3dsAgBqKgcBTBbuSoMZgY2KKruoG+SkrR3aoViAg==",
-      "signed_at": "2026-08-30T13:29:33.384Z"
+      "signed_at": "2026-09-05T04:29:31.969Z"
     },
     {
       "name": "sector-federal-government",
@@ -1792,7 +1792,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "CbxW5qhlaiqf+P3xIemSHlMz9OoWat2srh7F3+nAIsa0Y4nBr6WCXZXZlUUjrjptZ3Ny+Cw485HMLWRO9qbcBw==",
-      "signed_at": "2026-08-30T13:29:33.384Z"
+      "signed_at": "2026-09-05T04:29:31.970Z"
     },
     {
       "name": "sector-energy",
@@ -1866,7 +1866,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "lVHORFJzvkxNqJfT34inW28BzlA8dCWDfo0JS9tsiNW3PUxdijZS22g4GMbQJgaSKGv7F3ag5rWk75O+IChUAw==",
-      "signed_at": "2026-08-30T13:29:33.384Z"
+      "signed_at": "2026-09-05T04:29:31.970Z"
     },
     {
       "name": "sector-telecom",
@@ -1952,7 +1952,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-08-30T13:29:33.385Z"
+      "signed_at": "2026-09-05T04:29:31.970Z"
     },
     {
       "name": "api-security",
@@ -2031,7 +2031,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "hyLAsPCAkUkhNeaaFtgSg5XsKs2L8HuFoPka/Urzel54XPMQ0F3MwRD7j/ZURzIHQxvrAxmS3OCXEsBrgcFxAw==",
-      "signed_at": "2026-08-30T13:29:33.385Z",
+      "signed_at": "2026-09-05T04:29:31.971Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2126,7 +2126,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "MfijBq1nzlyPQWf5/EcTn5Xx7ThdZ9BT8/W/+daxhATfMSoSTrMn9pYh1R83Chr9n2ahQeMoPUkSxL7Cr9V3Dw==",
-      "signed_at": "2026-08-30T13:29:33.386Z"
+      "signed_at": "2026-09-05T04:29:31.971Z"
     },
     {
       "name": "container-runtime-security",
@@ -2198,7 +2198,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "QJ8RF3ifPFc0mr3gYkloHqg5nuYe1GS4h+xbKYDCkM+HbA3iTd5keJ59P2P3z8TwVdOt8XM8WOsx6aRUrFL0Cw==",
-      "signed_at": "2026-08-30T13:29:33.386Z",
+      "signed_at": "2026-09-05T04:29:31.972Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2279,7 +2279,7 @@
         "MITRE ATLAS v2026.07 (released June 2026) is additive over v2026.05 — it adds AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) and refreshes AML.T0054 (LLM Jailbreak), with no technique-ID removals. Earlier releases shipped the AML.T0010 sub-technique expansion and agentic-AI techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\") this forecast tracked. Forward watch: subsequent monthly ATLAS releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "e4uV8JvtEbC/lKGqJ6Y3ugEetF6aEv7R7CwJ/Y9N4thWNg8fconRcOPDS+045PW8xmcAqAbkSi+I4N1E6EPTAA==",
-      "signed_at": "2026-08-30T13:29:33.387Z"
+      "signed_at": "2026-09-05T04:29:31.972Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2353,7 +2353,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "asDHEy7Y2Bj4ikCkpP5MHRe33TIY8aQ1a+KN1UZgl89g9LyLcXzSg/weACafxJNzhOUkXnKBAtBrQIKW6p6nDQ==",
-      "signed_at": "2026-08-30T13:29:33.387Z"
+      "signed_at": "2026-09-05T04:29:31.973Z"
     },
     {
       "name": "ransomware-response",
@@ -2433,7 +2433,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "UTDsSMDvW5cpuSDBgZO5AzKowXWAR3WqeUeqyHXaikxslC6YBDL/gIojm9Km3/mgOS6pD5JKb/LLcfb4T/r4BQ==",
-      "signed_at": "2026-08-30T13:29:33.387Z"
+      "signed_at": "2026-09-05T04:29:31.973Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2501,7 +2501,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-08-30T13:29:33.388Z"
+      "signed_at": "2026-09-05T04:29:31.973Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2576,7 +2576,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "l/jeAAnb7H2GQzp1x05bsdZwzC0NNTBi3ZuiwgDly5EVSoikbnVWpx921bT5G3OPkx4dqs2PohlvTG0gLxCrAA==",
-      "signed_at": "2026-08-30T13:29:33.388Z"
+      "signed_at": "2026-09-05T04:29:31.974Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2656,7 +2656,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "vrMvYLdYJLlEAC8YvOb/g3LJ8gU1YmYewZ94J5AFgxxh2EiDyszqo3D/WVpt5NTrDSS/N5OgOf5Vwom/KGlMCA==",
-      "signed_at": "2026-08-30T13:29:33.389Z",
+      "signed_at": "2026-09-05T04:29:31.974Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2750,7 +2750,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-08-30T13:29:33.389Z",
+      "signed_at": "2026-09-05T04:29:31.975Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2822,7 +2822,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-08-30T13:29:33.389Z"
+      "signed_at": "2026-09-05T04:29:31.975Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2881,7 +2881,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-08-30T13:29:33.389Z"
+      "signed_at": "2026-09-05T04:29:31.975Z"
     },
     {
       "name": "network-trust",
@@ -2937,7 +2937,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-08-30T13:29:33.390Z"
+      "signed_at": "2026-09-05T04:29:31.975Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2992,7 +2992,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
-      "signed_at": "2026-08-30T13:29:33.390Z"
+      "signed_at": "2026-09-05T04:29:31.975Z"
     },
     {
       "name": "self-update-integrity",
@@ -3046,7 +3046,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-08-30T13:29:33.390Z"
+      "signed_at": "2026-09-05T04:29:31.976Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3104,7 +3104,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-08-30T13:29:33.390Z"
+      "signed_at": "2026-09-05T04:29:31.976Z"
     },
     {
       "name": "decompression-dos",
@@ -3162,7 +3162,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-08-30T13:29:33.390Z"
+      "signed_at": "2026-09-05T04:29:31.976Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3217,7 +3217,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-08-30T13:29:33.391Z"
+      "signed_at": "2026-09-05T04:29:31.976Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3272,11 +3272,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-08-30T13:29:33.391Z"
+      "signed_at": "2026-09-05T04:29:31.976Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "KvT0mjUwuj/eKqiuU5gyPulyWrtoOh30duov5DkIQnjSjSBo9ccl8B/JxKUDkxzVgyNtA6UHKobIXIajXbZVAA=="
+    "signature_base64": "10ialekDx1tzGR5g+qNIaoE29V4SJSCaNjvC15i7tU2397W6zJJdrn5exoE3Hv2AYL4c55wOc85p6BeqxpmRBg=="
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.19.37",
-  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1517 CVEs / 236 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+  "version": "0.19.39",
+  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1617 CVEs / 236 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
     "ai-skills",

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:6bd5a13d-98d8-4b30-8f6c-77f662aae35f",
+  "serialNumber": "urn:uuid:883f4ca1-1652-4026-bee4-db59835da42c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-30T00:00:00.000Z",
+    "timestamp": "2026-09-04T00:00:00.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.19.37"
+        "version": "0.19.39"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.37",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.39",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.19.37",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1517 CVEs / 236 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.19.39",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1617 CVEs / 236 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.37",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.39",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a61eba67d308dbb61edaaad3eee88b5358afd6dd4afe5ddc61eb99a8b970559d"
+          "content": "b3c6729bac9663805269af4008bb5e6e55e567a3205c23376917bdb010650d48"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.37"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.39"
         },
         {
           "type": "vcs",
@@ -124,11 +124,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1875ffd83b2c91e53acc32ad3d19214b774245ada518ada0c3cddda1c22ff4e3"
+          "content": "0a8901852c4ec9399ad9ad796d42145aa37d6eca1c3f1b55b7a7f4ff260396f1"
         },
         {
           "alg": "SHA3-512",
-          "content": "d7a12fa3233c078552a59aaf15694e7e6aafb7079223906946045c59fdb02bf23393c73170ca7563c44540e97c23f81f93ec7ca07286e8628e4929910f42122f"
+          "content": "8aa4593046fd4923120eb97bb14a60a4d8ba8f99d23c723e7beb8153ac8976bee81fdc3b96cb09fc3c58f6dfb29a8ef3f8d3e0febeb2053de7700089eb681ef4"
         }
       ]
     },
@@ -319,11 +319,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "00312ce7b17c9df7cdc94f1aaf668fc9e891c25f9b14c650707f65c11e6677d7"
+          "content": "77de50423e49525e8ce99ff8c3758e11f68d1e0850e0591a4175edc058addac9"
         },
         {
           "alg": "SHA3-512",
-          "content": "c6759327c48ea2a6342917bf4bd4262022f9846490b41bf059bc946db71121fa2b396295683116fe7845e75749b1174cf6bb7745517e4d02411a69dcb9a32981"
+          "content": "3557f81633915f986e79b95a474416ec6f691a4dd3979e8277c7ceefc146a2481d1c534d688c471cd917aefa202c7d310f98f209692109cd3e0ccc509836b794"
         }
       ]
     },
@@ -334,11 +334,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4577bceadf71d30f4abce3e36050296399cd6f35a2616399215e23e09572b20c"
+          "content": "644ceaca7b05c74c905082be18897d81341126da02bbeda75cb6722734a18863"
         },
         {
           "alg": "SHA3-512",
-          "content": "a769af4db6487faa745a96079bbc89a3de2243be94d557f329eb57c0b9b4065f45a592c76674cb918bf1ef187700e8985033ca56c1ae03165ec60ff0d5f4904e"
+          "content": "a3a17f03ebd9ed76673421c78918f7971307cb637f5d533f4926d79bcbedd079b7a1efa85c3e88e3ae4662e930da1b0314fd498d2bf681527a0ac295473e79a1"
         }
       ]
     },
@@ -349,11 +349,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e8d9741fae3938a7cc078832f9c5fba8e864809c6b6eb998fd8ba0a6fcd69ad4"
+          "content": "1c5401f7d60070e6dd8556ce5cafd14aab989d59360a627443b371cc6b50991b"
         },
         {
           "alg": "SHA3-512",
-          "content": "5d1d1f269928cb00827da0e46929d7eaa0946c120eeb1c6aa0687406f62aa212e663e12783707f2a6ce13c952a77e29903d917abe1e73ec987560153be54da66"
+          "content": "16d30f09c877dc0deeac9dbf0711cfdbd2450439fbd6e2a269632b8f032e168c6771e834dd147d29be2ff573df7295a0e2adba4f208da15d6ce06ece2e922220"
         }
       ]
     },
@@ -409,11 +409,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a5c8378d53886252cfcfd319de46c4ceadce2e3511f810d2e9dbf94cf6b252f7"
+          "content": "522444f698e7915435ceee9f056ab021a11e6875d123c2b8897413401d2b06fa"
         },
         {
           "alg": "SHA3-512",
-          "content": "1f3e3d7cdf66b9ff22658ee445b91fe66a6239223179d22e98049e82d22fd509730a01ef67e846bbfbb37fb9790f4f2136b35307fc2ce0f6277bcfb50cbd0434"
+          "content": "5e3b5af82f4de67e7caa242e1dd6ebcbb5fa7f8c050434f4f62a69061622533ec53b5e884c938b82ebd621bb1e87f1d71072b82c23d3423b73dc9a6cfd2c85d4"
         }
       ]
     },
@@ -949,11 +949,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8c36024218e83f003ea28269f49b061bacb4f8ad49a6cf4d452229745705c70c"
+          "content": "4b5d0b4d92175307cc7f9c9faf003b337a5ff35d44a54c7bc2b1a686abba6db9"
         },
         {
           "alg": "SHA3-512",
-          "content": "b4c03072208d59d49d402445d6bad9bf048df2ae9ad6a0a3e81a003ab4c5cf70d313143bc9ea24e525928d78a7f33e89bb4c7e4728672a982ac6189b15983734"
+          "content": "d30ab0f18bb5ad62bc9e4576733099744225b4394e12dedc0bef7db64e0485c2c9065a4e07e0588a41910efdafbfd7b6b28f8b9381bbd376073774e4b4219d2c"
         }
       ]
     },
@@ -1954,11 +1954,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a92cc16a7f17121273701c76dbc50d46df3175b55aa707948dd1ffd0d94c8327"
+          "content": "919027cb04c69bd4d8c629e150772e25468b4acd9828e4a973caac8513b6d3ed"
         },
         {
           "alg": "SHA3-512",
-          "content": "59a9961ce8f2359f3aede07e3f62cbe61d33d00a363baa48ef074d979e1c23302e5d2d14e1465dee0f1f4941545b7653e41f8f3e8cdf47a0c26191db9fcaee78"
+          "content": "ed0b85048b1e5a04fc8f5acc1844ee8437b97509c2320cf6ca1a29ad272bed24385c667658a300fcce28d76aaa8219ceceb80e618e30c9a8e0f6c76f3ef7d5ab"
         }
       ]
     },
@@ -2074,11 +2074,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5fb0450b671a072b033ba8ae7d3f4ac437fc83073a3a34adcb29593307c495b4"
+          "content": "7aafdd9067020f95f3f80f11b550bbb220a15960ee762528d07ae5ca56bf6822"
         },
         {
           "alg": "SHA3-512",
-          "content": "97bf3b615125ee46c0187df6af7fc270aa0734d577be45d5806970f12c6e3315c49c10a96e0ce440f8367d4a4c1f41e966bccf8be99d04f421a8239033311e58"
+          "content": "624cd1ae26b5e426aa21bfc2d1f324150270af7903dd42ebad02508467b79d18a7dc1eb9df2d7f47f76697e13087d5e7d564dce2bd915aa7cad7ea893b711849"
         }
       ]
     },