@blamejs/exceptd-skills 0.19.39 → 0.20.0

package/AGENTS.md

@@ -58,7 +58,7 @@ Each rule below carries a **Forcing function** annotation declaring whether it i
     Frameworks lag RFCs; RFCs lag attacker innovation — skills must track lag at every layer.
     *Forcing function:* `_meta` version fields are schema-required; reviewer-checked for cross-file version consistency.
 
-    **Pinned ATLAS version: v2026.07 (released 2026-08-07), Secure AI v2 layer (May 2026). Audit cadence: monthly** (ATLAS now ships monthly per CTID; the Secure AI v2 layered set and per-technique maturity classification are tracked separately in `data/atlas-ttps.json` via the `secure_ai_v2_layer` and `maturity` fields).
+    **Pinned ATLAS version: v2026.09 (released 2026-09-15), Secure AI v2 layer (May 2026). Audit cadence: monthly** (ATLAS now ships monthly per CTID; the Secure AI v2 layered set and per-technique maturity classification are tracked separately in `data/atlas-ttps.json` via the `secure_ai_v2_layer` and `maturity` fields).
 
     **Pinned ATT&CK version: v19.2 (released 2026-08-05). Audit cadence: semi-annual** (April and October releases). v19 split Defense Evasion (TA0005) into Stealth (TA0005) and Defense Impairment (TA0112) — affected entries in `data/attack-techniques.json` carry `tactic_moved_from` for traceability. v18 introduced Detection Strategies (DSxxxx) as first-class objects; record applicable strategy IDs on entries where canonical strategies exist.
 
@@ -230,7 +230,7 @@ Wrong: adding a new CVE to `data/cve-catalog.json` without completing all requir
 Right: every new entry requires all fields defined in the CVE catalog schema. Partial entries fail the schema validation in `lib/scoring.js`.
 
 **DR-7: Stale ATLAS / ATT&CK version**
-Current pinned ATLAS version: **v2026.07 (released 2026-08-07)** with the **CTID Secure AI v2 layer (May 2026)**. ATLAS audit cadence is **monthly** (CTID now ships monthly). Current pinned ATT&CK version: **v19.2 (released 2026-08-05)**, semi-annual cadence (April + October). When either source updates: audit all TTP IDs for changes (including v19's Defense Evasion → Stealth / Defense Impairment split), bump `last_threat_review` in affected skills, update `_meta` version fields in `data/atlas-ttps.json` and `data/attack-techniques.json`. Never silently upgrade.
+Current pinned ATLAS version: **v2026.09 (released 2026-09-15)** with the **CTID Secure AI v2 layer (May 2026)**. ATLAS audit cadence is **monthly** (CTID now ships monthly). Current pinned ATT&CK version: **v19.2 (released 2026-08-05)**, semi-annual cadence (April + October). When either source updates: audit all TTP IDs for changes (including v19's Defense Evasion → Stealth / Defense Impairment split), bump `last_threat_review` in affected skills, update `_meta` version fields in `data/atlas-ttps.json` and `data/attack-techniques.json`. Never silently upgrade.
 
 **DR-8: Missing zero-day learning loop**
 Wrong: adding a new entry to `data/cve-catalog.json` without running the learning loop.
@@ -435,7 +435,7 @@ When in doubt, ship the playbook without a collector and open the gap as a follo
 - [ ] All new CVEs have complete `data/cve-catalog.json` entries
 - [ ] All new CVEs have `data/zeroday-lessons.json` entries
 - [ ] All skill `data_deps` resolve to existing files
-- [ ] All ATLAS refs are valid v2026.07 IDs (current pinned version); Secure AI v2 layer flags + maturity present on AI-pipeline entries
+- [ ] All ATLAS refs are valid v2026.09 IDs (current pinned version); Secure AI v2 layer flags + maturity present on AI-pipeline entries
 - [ ] All ATT&CK refs are valid v19.2 IDs (current pinned version); post-split tactics (Stealth / Defense Impairment) used where applicable
 - [ ] All framework control IDs resolve in `data/framework-control-gaps.json`
 - [ ] No skill body contains placeholder language (TODO, TBD, coming soon, placeholder)

package/ARCHITECTURE.md

@@ -36,7 +36,7 @@ data_deps:
   - cve-catalog.json          # files in data/ this skill reads
   - atlas-ttps.json
 atlas_refs:
-  - AML.T0043                 # MITRE ATLAS v2026.07 TTP IDs
+  - AML.T0043                 # MITRE ATLAS v2026.09 TTP IDs
   - AML.T0054
 attack_refs:
   - T1068                     # MITRE ATT&CK TTP IDs
@@ -131,7 +131,7 @@ Schema per entry:
   "AML.T0043": {
     "name": "Craft Adversarial Data",
     "tactic": "ML Attack Staging",
-    "atlas_version": "2026.07",
+    "atlas_version": "2026.09",
     "description": "...",
     "framework_coverage": {
       "NIST-800-53": {"covered": false, "nearest_control": null, "gap_description": "..."},
@@ -211,7 +211,7 @@ RWEP (Real-World Exploit Priority) scoring engine.
 
 - `score(cveId)` — Return RWEP score for a CVE in the catalog
 - `scoreCustom(factors)` — Score a custom factor set (for CVEs not yet in catalog)
-- `validate()` — Schema validation: check all skill data_deps resolve, all CVE entries are complete, all ATLAS refs are valid v2026.07 IDs
+- `validate()` — Schema validation: check all skill data_deps resolve, all CVE entries are complete, all ATLAS refs are valid v2026.09 IDs
 - `compare(cveId)` — Return CVSS vs. RWEP comparison with explanation of the delta
 
 RWEP factor weights. The key names here are the ones a catalog entry's

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.20.0 — 2026-09-19
+
+The minimum supported Node.js is now 24.21.0, so `engines.node` reads `>=24.21.0`. Install 24.21.0 before upgrading; npm reports an engines warning on 24.19 and 24.20. Node 24.21.0 includes OpenSSL 3.5.8 and the NSS 3.126 root certificates. Continuous integration, the release workflow, the daily-refresh and ATLAS-currency workflows, the Docker reproduction harness and `.nvmrc` all use 24.21.0, and the harness base image is pinned to the 24.21.0-alpine3.23 manifest digest.
+
+MITRE ATLAS moves to v2026.09, which includes the v2026.08 changes. v2026.08 generalizes three techniques the catalog carries, and each entry now uses the ATLAS name and description: AML.T0072 covers any command-and-control channel rather than only a reverse shell, AML.T0075 covers enterprise resource discovery rather than only cloud services, and AML.T0089 covers enterprise environment discovery rather than only processes. v2026.09 adds eleven techniques and sub-techniques and changes none of the ones the catalog carries.
+
+Six entries used MITRE's pre-2025 machine-learning wording and now use the current names: AML.T0007, AML.T0010, AML.T0018, AML.T0020, AML.T0024 and AML.T0044. ATLAS also widened AML.T0018 from backdooring a model to manipulating the artifact by any means, so its description was replaced rather than reworded. The skills and playbooks that print these labels next to the id now use the same names.
+
+Two skills named the wrong ATLAS release as the one that introduced a technique. `skill-update-loop` now says ATLAS 2025.12 added AML.T0096, and `mlops-security` says ATLAS 2026.06 added AML.T0113, AML.T0114 and AML.T0091.001.
+
+A new pre-publish check compares `data/atlas-ttps.json` against the ATLAS release it pins and fails on any id or name the release does not carry. It fetches the pinned release and caches it under `.cache/upstream/atlas/`. When it cannot reach the release, it exits non-zero. Eight names and 54 sub-technique ids in that file still disagree with the release. They are recorded as known divergences, so the check fails only on new ones, and they are tracked in issue #397.
+
 ## 0.19.39 — 2026-09-04
 
 The catalog now holds 1,617 CVEs after 100 additions from CISA KEV, concentrated in 2021 — 47 of them — with 17 each from 2019 and 2020 and the oldest reaching back to 2010. Apple accounts for 23, Apache 12, Microsoft and Cisco 6 each. Twenty-four have CISA's ransomware designation, 62 have an obtainable public exploit, and 51 need a restart before the fix is running.

package/CONTEXT.md

@@ -116,7 +116,7 @@ Skills and playbooks read from `data/`. Authoritative catalog inventory:
 | File | Entries | Purpose |
 |------|---------|---------|
 | `cve-catalog.json` | 1323 | CVEs with CVSS, RWEP score, EPSS estimates, CISA KEV flags, PoC and live-patch availability |
-| `atlas-ttps.json` | 174 | MITRE ATLAS v2026.07 (August 2026) techniques with framework gap flags |
+| `atlas-ttps.json` | 174 | MITRE ATLAS v2026.09 (September 2026) techniques with framework gap flags |
 | `attack-techniques.json` | 794 | MITRE ATT&CK techniques with framework coverage mappings |
 | `framework-control-gaps.json` | 194 | Framework control gap entries: designed-for vs. what each control misses |
 | `exploit-availability.json` | 28 | Per-CVE PoC locations, weaponization stage, AI-acceleration factor, live-patch status |

package/README.md

@@ -15,7 +15,7 @@
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/blamejs/exceptd-skills/badge)](https://scorecard.dev/viewer/?uri=github.com/blamejs/exceptd-skills)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 [![Skills](https://img.shields.io/badge/skills-51-d946ef)](#skill-inventory)
-[![ATLAS](https://img.shields.io/badge/MITRE%20ATLAS-v2026.07-d946ef)](https://atlas.mitre.org)
+[![ATLAS](https://img.shields.io/badge/MITRE%20ATLAS-v2026.09-d946ef)](https://atlas.mitre.org)
 [![ATT&CK](https://img.shields.io/badge/MITRE%20ATT%26CK-v19.2-d946ef)](https://attack.mitre.org)
 [![Ed25519-signed](https://img.shields.io/badge/skills-Ed25519--signed-2ea043)](AGENTS.md)
 [![Jurisdictions](https://img.shields.io/badge/jurisdictions-35-blue)](data/global-frameworks.json)
@@ -74,7 +74,7 @@ Assess Linux kernel local privilege escalation exposure. Covers Copy Fail (CVE-2
 ### AI-Specific Attack Surface
 
 **[ai-attack-surface](skills/ai-attack-surface/skill.md)**
-AI/ML attack surface assessment mapped to MITRE ATLAS v2026.07 with explicit gap flags. Covers prompt injection as enterprise RCE (CVE-2025-53773 CVSS 7.8, 85%+ bypass rate against SOTA defenses), MCP supply chain RCE (CVE-2026-30615, zero user interaction, 150M+ downloads), RAG exfiltration, model poisoning, AI-assisted exploit development (41% of 2025 zero-days), credential theft acceleration (160% increase).
+AI/ML attack surface assessment mapped to MITRE ATLAS v2026.09 with explicit gap flags. Covers prompt injection as enterprise RCE (CVE-2025-53773 CVSS 7.8, 85%+ bypass rate against SOTA defenses), MCP supply chain RCE (CVE-2026-30615, zero user interaction, 150M+ downloads), RAG exfiltration, model poisoning, AI-assisted exploit development (41% of 2025 zero-days), credential theft acceleration (160% increase).
 
 **[mcp-agent-trust](skills/mcp-agent-trust/skill.md)**
 Enumerate MCP (Model Context Protocol) trust boundary failures. Covers tool allowlisting gaps, unsigned server manifests, prompt injection via tool responses, supply chain compromise. CVE-2026-30615 (Windsurf, zero-interaction RCE). Generates: tool allowlist policy, server signing requirements, bearer auth config, output sanitization requirements.
@@ -710,7 +710,7 @@ All skills pull from `data/`. Cross-validated against canonical upstream sources
 To resolve a single citation rather than refresh the whole catalog, `exceptd cve <CVE-ID>` and `exceptd rfc <number>` return a status verdict for one id (catalog → resolved cache → one NVD / datatracker lookup, offline-capable). The lookup caches, so a fan-out of agents shares the answer instead of each independently re-researching the same citation.
 
 - `cve-catalog.json` — CVE metadata with RWEP scores, CISA KEV status, PoC availability, live-patch info
-- `atlas-ttps.json` — MITRE ATLAS v2026.07 TTPs with gap flags and exploitation examples. Each TTP now carries a `cve_refs[]` back-edge — operators reading an ATLAS entry see the catalogued CVEs that cite it without grepping `cve-catalog.json`. The same back-edge is populated on `attack-techniques.json`, and each playbook carries a `_meta.fed_by[]` reverse field naming the upstream playbooks that chain into it.
+- `atlas-ttps.json` — MITRE ATLAS v2026.09 TTPs with gap flags and exploitation examples. Each TTP now carries a `cve_refs[]` back-edge — operators reading an ATLAS entry see the catalogued CVEs that cite it without grepping `cve-catalog.json`. The same back-edge is populated on `attack-techniques.json`, and each playbook carries a `_meta.fed_by[]` reverse field naming the upstream playbooks that chain into it.
 - `attack-techniques.json` — MITRE ATT&CK enterprise and ICS techniques, each carrying the catalogued CVEs that cite it in `cve_refs[]`
 - `framework-control-gaps.json` — Per-framework, per-control: what it was designed for vs. what it misses
 - `exploit-availability.json` — PoC locations, weaponization status, AI-assist factor
@@ -727,7 +727,7 @@ To resolve a single citation rather than refresh the whole catalog, `exceptd cve
 
 **Compliance is not security.** A SOC 2 Type II report confirms that controls existed and operated effectively during the audit period. It says nothing about whether those controls are adequate for current attack patterns. When NIST 800-53 SI-2 says "apply security patches in a timely manner" and Copy Fail is a 732-byte deterministic root with a public PoC and no race condition, "timely" is the wrong frame entirely.
 
-**Framework lag is measured in months.** MITRE ATLAS v2026.07 (May 2026) is the most current AI threat framework available. It still lags real exploitation by 3-6 months. NIST AI RMF lags by years. ISO 27001:2022 has no AI-specific controls. These skills explicitly flag every place where framework coverage ends and real attacker capability begins.
+**Framework lag is measured in months.** MITRE ATLAS v2026.09 (September 2026) is the most current AI threat framework available. It still lags real exploitation by 3-6 months. NIST AI RMF lags by years. ISO 27001:2022 has no AI-specific controls. These skills explicitly flag every place where framework coverage ends and real attacker capability begins.
 
 **AI changed the exploit development timeline.** An AI system discovered Copy Fail in approximately one hour. 41% of 2025 zero-days involved AI-assisted reverse engineering on the attacker side. The time between vulnerability introduction and reliable exploitation is compressing faster than patch management processes can adapt. Risk scoring must reflect this.
 

package/data/_indexes/_meta.json

@@ -1,62 +1,62 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-05T04:29:33.248Z",
+  "generated_at": "2026-09-19T10:07:22.278Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "919027cb04c69bd4d8c629e150772e25468b4acd9828e4a973caac8513b6d3ed",
-    "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
-    "data/atlas-ttps.json": "09c4fa9bfedca16747f56a05ae296c820c1e99f5643f9da59e6871014ac057d1",
+    "manifest.json": "60ae19383748426df4cfb40853a5d2e173ae0f73d85c6f09b45f5570a4dae846",
+    "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
+    "data/atlas-ttps.json": "3052c596525fc5b4f65f38124447cd785ff2f86438124dc0a60b387e2ea2e786",
     "data/attack-techniques.json": "77de50423e49525e8ce99ff8c3758e11f68d1e0850e0591a4175edc058addac9",
     "data/cve-catalog.json": "644ceaca7b05c74c905082be18897d81341126da02bbeda75cb6722734a18863",
     "data/cwe-catalog.json": "1c5401f7d60070e6dd8556ce5cafd14aab989d59360a627443b371cc6b50991b",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "522444f698e7915435ceee9f056ab021a11e6875d123c2b8897413401d2b06fa",
+    "data/framework-control-gaps.json": "3d31db812f493494b593cb4ff3436f16676ef7bac9a06205b5583d672229ec36",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
     "data/zeroday-lessons.json": "4b5d0b4d92175307cc7f9c9faf003b337a5ff35d44a54c7bc2b1a686abba6db9",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
-    "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
-    "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
-    "skills/framework-gap-analysis/skill.md": "98696eeda0400a6dcf6c2ba0ec977565626e8e943575fbf1c0a411a09d4acf6e",
-    "skills/compliance-theater/skill.md": "ce163e4478c45a85d8f82e84e05092e442d1405c0642a2015caef61dc691732f",
-    "skills/exploit-scoring/skill.md": "b18b86fd51d3dd94b058c698aa22457a96a7993e5ea474ae246cc60f348948cc",
-    "skills/rag-pipeline-security/skill.md": "360caa6c03913625214e4f2f8430e7306f64ce5f44e8cc3d52af1368c7d8a6b4",
-    "skills/ai-c2-detection/skill.md": "b276c95f5df647dfefff42b34817367d0a0cf5a037beee62134de408ac14e3d9",
-    "skills/policy-exception-gen/skill.md": "9e137c4f39cb8223202e8d1a06ccba1643bd3444188dac174d1d6382a756ce7e",
-    "skills/threat-model-currency/skill.md": "32a1841401ad01abc274ed8362db2f59b43df53d0b274e6f810a418f845e6c28",
-    "skills/global-grc/skill.md": "cbbc37475a6bfabde26ee0f064bb853088d4e004691af92d6fa007f6bfb8ddfd",
-    "skills/zeroday-gap-learn/skill.md": "c4ff1b30a3ac0b11ebd65b35d8caeb309532d66e629051e54dfd6bf6db45d592",
+    "skills/ai-attack-surface/skill.md": "0d6c3ad77c5d4188836941f2a7200aad1a2f5fcb32542023c7a9d12a2ffa93f4",
+    "skills/mcp-agent-trust/skill.md": "6925a1355dedaf9a5e2832cfa8140d67db34670cb6a7da661f240c00a444657a",
+    "skills/framework-gap-analysis/skill.md": "0939a59f8f9d2c40735cefbfa809752b8dd8a14ce36d8ac9ef975bd962132c35",
+    "skills/compliance-theater/skill.md": "7c9db098d969ce994b82f23e7332bdc62d1884e28c01f38b30de31fa5ffd87e5",
+    "skills/exploit-scoring/skill.md": "058048fb30cdf857f3951ec4530e0106017be4daac0cf87d64736ce38a90e031",
+    "skills/rag-pipeline-security/skill.md": "f0d81496051dd048cd900b12ebbf704c3c697663800e879a085b7e561cb6ec20",
+    "skills/ai-c2-detection/skill.md": "8567c4066ec41eae53f0f0e1eb6b7e4e9eab3ec3e95c6c48760f2d62b3a8d870",
+    "skills/policy-exception-gen/skill.md": "d5f1ff0fd8f9b161573d2c1168096d270ae8474c7ae2e4785a7a3e72080689e9",
+    "skills/threat-model-currency/skill.md": "4c0d9885861e7a074a57b4f24670f814a29cce33f08e026711099b254dfa8c2a",
+    "skills/global-grc/skill.md": "5811a02d4c768642ee2b32a5863e6e6bb31532e9655086f417dfd778ff708343",
+    "skills/zeroday-gap-learn/skill.md": "cb64c4af5734a867a09f87ed6e08c8017dc7662d0bacba5d2bd0dd9fc20cdd17",
     "skills/pqc-first/skill.md": "307984c12c2daa473197b5f4b3d9ca97b037f1967610dce29b46aa282a3a842d",
-    "skills/skill-update-loop/skill.md": "c60ab918e0e51bd9ac39d88e58a6fd74b2091e4d0cadb7f1b10dbae824fd220c",
-    "skills/security-maturity-tiers/skill.md": "2d3c46525b5bccce461966ca62bbecaee9a9600afc81b2d80fd63047d6c86cb9",
-    "skills/researcher/skill.md": "9f1211d177c64e4c465407a45ad9e2901c5c6c0af410a0d0a51cc8fb780420d4",
-    "skills/attack-surface-pentest/skill.md": "a2f6da0e1bd910a456b06be600450debbf9d3d3086f1155b2e14b0181ccd9b77",
-    "skills/fuzz-testing-strategy/skill.md": "d35c6b2ae22b28e59c6f0a5284d77e9f9f0ea528814f87914c6b4f2c656d14e3",
-    "skills/dlp-gap-analysis/skill.md": "f6486e2ac28a47db2e32c25f2b073161992c375dec0e01c9760654ab1a4f40b6",
-    "skills/supply-chain-integrity/skill.md": "690fbec29d377ab938f3d4b6e5451bb6cbc8a2af8eb356b27201a6902012fda8",
+    "skills/skill-update-loop/skill.md": "2033331565b74536674ff1d08c823747a9040f1b81081b410250adc797faf200",
+    "skills/security-maturity-tiers/skill.md": "cb3a447292c707d5b897d1a4ef64538d1b478ff094f11b6fe1c3c7091ffb2562",
+    "skills/researcher/skill.md": "f538dde79206c91ba7791f90abc12fc99a7d45cd2e35fab7c264d9ea4b5d383f",
+    "skills/attack-surface-pentest/skill.md": "29faa4807c35832f316faffa0aea8032b1709922a70b74ef3d00fd0e7d053f6d",
+    "skills/fuzz-testing-strategy/skill.md": "ee1f001258f19f7c1ca8b82de67abb79bb16002fb92e40581fd074279e17c6ab",
+    "skills/dlp-gap-analysis/skill.md": "2306ece78407ea4acba32ad0a2e3eb9755d7424e22b3f8a86c8cbc7922059c7e",
+    "skills/supply-chain-integrity/skill.md": "6de2d1b2426019f5f026162216e0ae673b5f186441781aac91e64c22e987b5d2",
     "skills/defensive-countermeasure-mapping/skill.md": "e182f3130fe78e403db6c81c24757bc81dfbc86997e0b5f304f05d5572f7abb2",
     "skills/identity-assurance/skill.md": "86649aa573bde5b2ef2456a77d2fbfa9d1b623a4ef1326dd7a7ab384d0419307",
-    "skills/ot-ics-security/skill.md": "46b7f0bc04e6d894e6a229cc0e7623a633951ebcb5e463513a2c469ded735352",
-    "skills/coordinated-vuln-disclosure/skill.md": "8e4c7319883e6d67f26552165d26860db109de18098724b44b00214c9c2a771a",
-    "skills/threat-modeling-methodology/skill.md": "28d228440a8019dadeff26257cd9d9babddd7144df2efdb9aa4db2e6b9fc25e1",
-    "skills/webapp-security/skill.md": "2b2c362e2670dc4f465b2531d87c9c9fc56d9d0808256e9d83ec853159f6dd1f",
+    "skills/ot-ics-security/skill.md": "4c85b1caf2e8bcb3683a3d98ba8f3cc58b656d3ec8dd88b86e2f70e9ecd4710f",
+    "skills/coordinated-vuln-disclosure/skill.md": "59288f7423e90138dd05b0e3f21bb4c09769b2eee74070f1c2ae38cbfdef8806",
+    "skills/threat-modeling-methodology/skill.md": "d3123e9732f972c736b2dc570968a1318002ce73df7d979ca94f17d39bd01e26",
+    "skills/webapp-security/skill.md": "ff8a4f9d6296cbf27e0ad5318865eee6971098eb59d66de1ac60b801e1ebda12",
     "skills/ai-risk-management/skill.md": "3e116dc6f03f31e32f1ee885516d72d9c11d3ff67d2184108b13dcbdf5f417bf",
-    "skills/sector-healthcare/skill.md": "4a7c1f94ec9baa09327772b899b8b78e723a73973d0c0b44b9c11c573fd9883e",
-    "skills/sector-financial/skill.md": "2191a0bb897775bc24af3aeae3a132e5c9e8f1bfa503a13f69c895224bac6e66",
-    "skills/sector-federal-government/skill.md": "7b6880c3919bc0af5468ceaee144264676580276c9a2d70cfc58d6114dd6aa43",
-    "skills/sector-energy/skill.md": "a75255774aabc31a85f28f2a0ba30f02cb5b7d2fc2e0428c293fb94f1249cf69",
+    "skills/sector-healthcare/skill.md": "45d8bcccbe1c758dbf96e3fc9f7ee98fd9051b23f9e665c7cdafaf0ca3fcbdcd",
+    "skills/sector-financial/skill.md": "5c16936f529fdb615c89bf57bceccd6ecf46a06441f3dbbc0540fc1c6aba6665",
+    "skills/sector-federal-government/skill.md": "9b836c4c140c2fbd9ce0c5b900cb344c8f45d4e5fabdbb23ff7a95887445f68f",
+    "skills/sector-energy/skill.md": "4a61701fd57fa6b1382ebdfd5ba9f259d5b6f81fd9c67b35cff2ce422238ecbe",
     "skills/sector-telecom/skill.md": "4b80771e78a474e3f43227ecc730ddda1684bff98d7e6e53f5ec373e1e886f34",
-    "skills/api-security/skill.md": "cc2851e3344dcdf99335d0f5b7c19c755871c5d973b5ae384b35e5017877aa44",
-    "skills/cloud-security/skill.md": "2b62492d19895fd5e4b5091af20014606a94c62f0058a6e7e24a1fa381713db5",
-    "skills/container-runtime-security/skill.md": "7e9ff5c68b1b86436cb1f9cc3fa9aaeac7a68de7f01877e7202944138d307066",
-    "skills/mlops-security/skill.md": "156965bdf43f8d3973ac9bc95f71d39d36a8c1a72e4833eb83faee3d4e5168eb",
-    "skills/incident-response-playbook/skill.md": "5a4de978515f974cb88cb4dcfb69d02eefa7a0d29a22a2f8a732fb7f8dd5d107",
-    "skills/ransomware-response/skill.md": "ed9855c8ce1fb2830f1cf69a4554bf7600964f32fd75898b41f8a23003ae9a6d",
+    "skills/api-security/skill.md": "fa79bae604fd10a189fd4d536fd0dab8aa32c93ab79ab0cc4eb8a938d34a7e7f",
+    "skills/cloud-security/skill.md": "f3c7cb10af02d5f37ac0978e81d7c7c9316265a4778d6a120f17d007e3e20068",
+    "skills/container-runtime-security/skill.md": "36d7e93fbacd9d797dd1127cd1db0a60d1793745d1b310d0ac3a198d8ba8f563",
+    "skills/mlops-security/skill.md": "f64e46099b139fd7f10a69cbe12b1675541aff82f7fa2bb3ec3507ddecbf3776",
+    "skills/incident-response-playbook/skill.md": "599a0bf585d23ded6c5ae1c517decf6e084bdff61ef4ee51c4b63658672c6e78",
+    "skills/ransomware-response/skill.md": "c35ea6718f78b35da97c39d4159c9fd794d31945f5c96ed772d5fc13f513c4cb",
     "skills/email-security-anti-phishing/skill.md": "0965eca982e8fc633b85e70c0ba6becb8c0f5ee7bdd0be96ad73a9a222bb8816",
-    "skills/age-gates-child-safety/skill.md": "3f2fbc7045b3ae9ba87e634d92dd37db8ed280136ad226c7b6d0fd544e9a9c79",
+    "skills/age-gates-child-safety/skill.md": "cd4abcbe200f8ab589ae6c06cba1c6ee46144ba83624c6bd69e3559678ea4e9b",
     "skills/cloud-iam-incident/skill.md": "5155c3f441541c490ef84c200cd42c134ca5fb9b6ea685abfe0dc2bad64c4c01",
     "skills/idp-incident-response/skill.md": "cb2f2c5b90de4592bfd66dcd55f9bf2004f370746d519cad577fcbaf36125878",
     "skills/vc-wallet-trust/skill.md": "802dada75d934c9ab322246f650eb2eac9e2f72c1f094b0cebcfa605b56108a5",
@@ -107,7 +107,7 @@
     "handoff_dag_nodes": 51,
     "summary_cards": 51,
     "section_offsets_skills": 51,
-    "token_budget_total_approx": 442032,
+    "token_budget_total_approx": 442042,
     "recipes": 8,
     "jurisdiction_clocks": 29,
     "did_ladders": 8,