@blamejs/exceptd-skills 0.19.4 → 0.19.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.19.5 — 2026-08-08
+
+Three CVEs reported a control with no name and no requirement text. Their catalog entries held a bare string where the schema expects a control record, which was invisible until 0.19.4 began displaying the field and then rendered as `- undefined undefined:` in the gap report. All three describe the remediation clock for a KEV-listed flaw and now say so, closing the vulnerability-management gaps that already cite them. A malformed record is now omitted from the report rather than printed, so this class degrades to silence instead of noise, and the catalog test fails on the shape so it cannot recur unseen. Three further controls declared no framework gap at all and now name the ones they close.
+
+Eight more CVEs report the controls they require, among them CitrixBleed, the Fortinet SSL-VPN out-of-bounds write, the ConnectWise ScreenConnect traversal and the Cisco Secure Firewall Management Center deserialization. These concentrate on what a perimeter appliance compromise demands beyond patching — treating a device that ran a vulnerable build during confirmed exploitation as compromised rather than fixed, and keeping request-level logs outside the appliance's own trust zone long enough to investigate a listing that arrives years after disclosure. Each names the framework controls it closes and carries a test that separates the control being present from it being effective.
+
 ## 0.19.4 — 2026-08-08
 
 `framework-gap` now reports the controls a CVE needs that no framework carries yet. The command already answered half the question — which existing controls are insufficient — and stopped there, so an operator learned which controls fall short without learning what belongs in their place. The catalog had recorded the answer for 302 CVEs since the zero-day learning loop began and no command read it, in either output mode. Each entry names the requirement, its evidence, and the specific framework controls it closes, so it attaches to the gaps listed above it rather than reading as free-standing advice. Both the human-readable report and `--json` carry it, and the summary line counts it.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-08T22:55:59.109Z",
+  "generated_at": "2026-08-09T04:06:57.598Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4f92a89e4b15843aed7516645c38e3eaec48993fe3043f74b98e97a42f2d38b4",
+    "manifest.json": "d8a29cea517d6283eb77e3dafcf4b762bae6c4c4ceb7175ec07d61704adb8410",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "9bc4f85c15d1618ef438a9221346c6913f823c5b8368acc2b2d5756c3a07c21e",
+    "data/zeroday-lessons.json": "e71be5d0f356ce0d249b8b01f348553b48d80213e693955f1ea9615b56aec918",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/zeroday-lessons.json

@@ -2140,7 +2140,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-094",
+        "name": "AI-RUNTIME-API-PATH-TRAVERSAL-VALIDATION",
+        "description": "MLflow's artifact endpoint joins a caller-supplied path onto the artifact root and serves the result, so containment must be enforced on the read direction and not only on uploads and extractions: resolve the requested path to an absolute canonical form, verify the resolved result is still under the artifact root (rejecting absolute paths, ../ segments, and symlinks that leave the root), and do that check before the file handle is opened rather than by filtering the request string. On a tracking server the read half is the higher-value half, because the same host holds the object-store credentials, the tracking database URI, and the operator key material that an arbitrary-file read returns.",
+        "evidence": "Packet: the tracking-server artifact endpoint resolves user-controlled paths under the artifact root without normalization, and an unauthenticated HTTP request carrying ../ reads arbitrary files from the host filesystem (CWE-22, CVSS 7.5). A PoC is public and a patch is available.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.28",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-033",
+        "name": "AI-ML-DEVELOPER-TOOLING-INVENTORY",
+        "description": "An MLflow tracking server is typically stood up by a data-science team rather than by IT, so nothing tells the application-patching program that a network-reachable artifact-read flaw exists on it — the asset is not on the list the patch SLA runs against. The inventory entry for this server must record each listening endpoint, whether any authentication sits in front of the artifact route specifically (this traversal is reachable unauthenticated), and the blast radius of a file read from that host: artifact-store credentials, registered model artifacts, and training-data paths, which is how a file read becomes model-supply-chain tampering. It needs its own patch SLA tier rather than the generic application tier.",
+        "evidence": "Packet: an unauthenticated HTTP request to the tracking server's artifact endpoint reads arbitrary host files. The CVE is not KEV-listed and active exploitation is unknown despite a public PoC and RWEP 35 — the exact profile that never surfaces on a KEV-driven patch queue and so depends on the asset being inventoried to be remediated at all.",
+        "gap_closes": [
+          "NIST-AI-RMF-MEASURE-2.7",
+          "OWASP-ML-Top-10-2023-ML06",
+          "AU-ISM-1546",
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2024-27132": {
     "name": "MLflow Recipe Template Injection XSS to Client-Side RCE",
@@ -2400,7 +2424,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "human_researcher",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "A NetScaler ADC/Gateway is the authentication and TLS-termination boundary for the applications behind it, so the 14/30-day patch windows the citing controls grade against are the wrong clock for it — the device is not protected by the perimeter, it is the perimeter. CVE-2023-3519 argues for a distinct tier: for a pre-authentication defect on an internet-reachable NetScaler, either the fixed build is deployed or the exposed virtual server's public interface is taken offline, within hours of KEV listing, with that shutdown pre-authorized so an on-call engineer can take it without a change window. The tier must also be driven by configured role rather than by product name. Only appliances configured to serve the gateway SAML/formssso path reach the vulnerable nsppe code, so an asset inventory that records 'NetScaler present' cannot select the affected population — it has to record which virtual servers are published and which authentication paths they expose, or the compressed SLA fires against the wrong devices and misses the right ones.",
+        "evidence": "Citrix NetScaler ADC/Gateway, CISA KEV-listed 2023-07-19 with confirmed in-the-wild exploitation and a public PoC available. The packet's attack-vector record: an unauthenticated HTTP POST to /gwtest/formssso reaches the vulnerable nsppe parser — no credential and no prior foothold required — and CISA AA23-201A documented in-wild exploitation by Chinese state-sponsored actors against US critical-infrastructure organizations within weeks of disclosure. RWEP 80 / CVSS 9.8.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "PCI-DSS-4.0-6.3.3",
+          "NIS2-Art21-vulnerability-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "The nsppe stack overflow runs before authentication, which means a successful CVE-2023-3519 exploit generates no authentication event to find later and executes with the packet engine's privilege on the appliance. Upgrading to the fixed NetScaler build restores the SAML parser and says nothing about what was installed while the parser was broken. Any NetScaler that served the gateway formssso path from an untrusted network on a vulnerable build must therefore be dispositioned as compromised regardless of what a post-upgrade version scan reports: capture and diff the running configuration against the last known-good, inspect the appliance's web-served directories for files not shipped by the vendor, then rebuild from vendor media at the fixed version rather than upgrading in place, and rotate what the device held — SAML signing and session material, the LDAP/RADIUS bind accounts it authenticated against, the local administrative accounts, and any TLS private key stored on it. Version-based remediation evidence is specifically what fails here, because the attacker's artifacts are not versioned.",
+        "evidence": "Pre-authentication stack buffer overflow (CWE-787) in the NetScaler SAML processing path, reachable by an unauthenticated HTTP POST per the packet's attack-vector record. CISA KEV-listed 2023-07-19, active exploitation confirmed, public PoC available, patch available, RWEP 80. CISA AA23-201A documented state-sponsored exploitation of US critical-infrastructure organizations within weeks of disclosure — meaning estates that patched after that interval applied the fix to devices an adversary had already entered.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2024-1709": {
     "name": "ConnectWise ScreenConnect auth-bypass",
@@ -3057,7 +3104,39 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "low"
+    "ai_assist_factor": "low",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Fortinet's own follow-up on this CVE is the proof case for the control: devices compromised through sslvpnd before patching were left with read-only symlinks in the SSL-VPN language-file directory that continue to grant filesystem read access on fully patched firmware. For FortiOS and FortiProxy the remediation verdict therefore cannot be 'the appliance is on a fixed build'. Every appliance that exposed the SSL-VPN web surface while on a vulnerable build has to be triaged as a compromise: enumerate the SSL-VPN language-file directory and the other web-served paths for entries that are not vendor content, diff the running configuration against a known-good export, and where anything is found — or where the pre-patch exposure window cannot be bounded — reimage the appliance rather than upgrade in place, then rotate the local administrative credentials, API tokens, VPN user secrets, RADIUS and LDAP bind secrets, and any certificate material held on the device. A device whose exposure window predates the patch should be rebuilt even when the symlink hunt comes back clean, because the same code execution could place persistence somewhere the published hunt does not look.",
+        "evidence": "Fortinet FortiOS / FortiProxy, CISA KEV-listed 2024-02-09 with confirmed in-the-wild exploitation, public PoC available, RWEP 85 / CVSS 9.8. Per the packet's attack-vector record: an out-of-bounds write in the sslvpnd daemon's HTTP request handling, reachable by an unauthenticated crafted HTTP request to the SSL-VPN web surface; mass-scanning began within hours of the 2024-02-08 vendor disclosure; and Fortinet's 2025-04-11 follow-up advisory documented attackers who compromised devices before patching leaving read-only symlinks in the SSL-VPN language-file directory that grant persistent filesystem read on fully patched firmware — the packet states plainly that patch alone is insufficient.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Mass scanning for this bug started within hours of Fortinet's disclosure and KEV listing followed the next day, so the exposure window was shorter than every patch clock the citing controls grade against — and shorter even than the 7-day federal deadline attached to the KEV entry. The tier this CVE argues for: on a FortiGate or FortiProxy whose SSL-VPN web surface is reachable from the internet, the mitigation clock starts at vendor disclosure rather than at KEV listing or at scanner detection, and taking the SSL-VPN portal offline or restricting it to known client source ranges must be a pre-authorized action an on-call engineer can execute without waiting for a change window, since that is the only mitigation available in the interval between disclosure and a tested firmware upgrade. The tier also has to be written into the SLA policy explicitly for firewalls, which are routinely classified in an asset register as a security control rather than as an asset carrying its own patch obligation — a classification that leaves the single most exposed device in the estate on the slowest clock.",
+        "evidence": "FortiOS / FortiProxy SSL-VPN pre-authentication out-of-bounds write, CVSS 9.8, RWEP 85, public PoC available. The packet records mass-scanning beginning within hours of the 2024-02-08 vendor disclosure, CISA KEV listing on 2024-02-09 with a 7-day federal remediation deadline, and confirmed active exploitation — exploitation preceded the deadline the strictest citing framework would have set.",
+        "gap_closes": [
+          "PCI-DSS-4.0-6.3.3",
+          "DORA-Art-9"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "The post-patch symlink persistence this CVE is known for can only be scoped if the pre-patch exposure window can be bounded, and on FortiOS the record of that window lives on the device the attacker controlled. Exploitation is pre-authentication, so there is no login event to correlate against; the only signal is in the SSL-VPN portal request logs and the appliance's own session records, both of which sit on local storage within reach of code executing in sslvpnd. FortiGate and FortiProxy must therefore forward SSL-VPN portal request logs, administrative session logs and outbound session records to a collector in a separate trust zone — reached with credentials the appliance's administrators do not hold, on a management path the appliance cannot administer — with retention long enough to span the interval between a vendor disclosure and the estate finishing its upgrade cycle, which for this CVE meant covering a window that had already opened before the advisory published. Without that, the answer to 'was this appliance touched before we patched' is supplied by the appliance itself, and a device that was compromised is not a trustworthy witness to its own compromise.",
+        "evidence": "Unauthenticated code execution in the sslvpnd daemon on FortiOS / FortiProxy per the packet's attack-vector record, with no authentication step to generate a log event. CISA KEV-listed 2024-02-09, confirmed in-the-wild exploitation, public PoC available, RWEP 85. Fortinet's 2025-04-11 follow-up advisory established that compromise predating the patch persists onto patched firmware — so the forensic question is retrospective, and answering it requires telemetry that survived the compromise of the device that produced it.",
+        "gap_closes": [
+          "NIS2-Art21-network-security"
+        ]
+      }
+    ]
   },
   "CVE-2025-10585": {
     "name": "Google Chrome V8 Type Confusion Zero-Day (TAG-disclosed)",
@@ -6081,7 +6160,11 @@
         "name": "NPM-CI-IGNORE-SCRIPTS-DEFAULT",
         "description": "Equivalent posture for Bundler / Go: refuse postinstall / init-hook execution from new or recently-updated dependencies by default in CI.",
         "evidence": "MAL-2026-RUBYGEMS-BUFFERZONECORP-SLEEPER — Go module init hooks rewrote GOPROXY and go.sum.",
-        "gap_closes": []
+        "gap_closes": [
+          "NIS2-Art21-supply-chain",
+          "NIST-800-218-SSDF-PO.4.2",
+          "AU-Essential-8-App-Hardening"
+        ]
       }
     ],
     "compliance_exposure_score": {
@@ -6346,14 +6429,20 @@
         "name": "MCP-SERVER-CONFIG-ALLOWLIST",
         "description": "MCP server inventory + allowlist limits the adversarial-content surface that can reach the IDE agent.",
         "evidence": "CVE-2025-55319 — external MCP server messages were a documented delivery path.",
-        "gap_closes": []
+        "gap_closes": [
+          "OWASP-LLM-Top-10-LLM05",
+          "UK-CAF-B4"
+        ]
       },
       {
         "id": "NEW-CTRL-071",
         "name": "AI-DISCOVERY-CREDIT-IN-COMPLIANCE-EVIDENCE",
         "description": "Record AI-defender contribution.",
         "evidence": "CVE-2025-55319 — ZeroPath disclosure; framework attribution gap.",
-        "gap_closes": []
+        "gap_closes": [
+          "ISO-IEC-42001-AIMS-A.6.2.5",
+          "NIST-AI-RMF-MEASURE-2.7"
+        ]
       }
     ],
     "compliance_exposure_score": {
@@ -6927,7 +7016,29 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Upgrading the ScreenConnect server to the fixed build removes the traversal but not what the traversal already wrote. CVE-2024-1708 is an arbitrary file-write primitive: chained with the companion authentication bypass it plants a web shell in a ScreenConnect-served directory, and that file is application content rather than product code, so the vendor update leaves it in place and running. Any ScreenConnect instance that was reachable from an untrusted network on a vulnerable build must therefore be handled as compromised rather than as remediated: export the configuration, session history and extension inventory for forensics, rebuild the host from known-good media, reinstall at the fixed version, and rotate everything the server held or brokered — the relay/agent join material, the ScreenConnect administrative and integrated-identity accounts, and any credential a technician entered through a remote session during the exposure window. Deleting the one web shell that was found and then patching is not equivalent, because the same write primitive places files anywhere the service account can reach, and the read half of the traversal means configuration secrets on the host should be assumed disclosed.",
+        "evidence": "ConnectWise ScreenConnect, CISA KEV-listed 2026-04-28 with confirmed in-the-wild exploitation and a public PoC available. The packet's attack-vector record states the path traversal (CWE-22) lets an attacker write or read files outside the intended directory and was used with the companion authentication bypass to drop a web shell — i.e. attacker-planted files persist independently of the vendor patch. RWEP 83 against CVSS 7.5: the gap between the two is exactly the post-exploitation persistence that a base score for an information-disclosure-shaped traversal does not carry.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "CIS-Controls-v8-10.1"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-037",
+        "name": "FLEET-COMPROMISE-IR-PLAYBOOK",
+        "description": "ScreenConnect is a fleet control plane, not an ordinary web application: its access agents run with service-level privilege on every managed endpoint and execute what the server tells them to. An incident-response plan scoped to 'the ScreenConnect host' therefore has the wrong blast radius, because a web shell reached through this traversal gives the attacker the same command channel into the managed estate that the legitimate operator has. The playbook must be written and rehearsed before the event and must cover: revocation and re-issue of the relay/agent trust material so existing agent installations cannot be driven by attacker-held server identity; an audit of session, command and file-transfer history plus any extension or extension directory added since the exposure window opened; quarantine criteria for endpoints that received a session or a queued command during that window; and rotation of every credential used through a remote session, including the customer-side administrative accounts a technician authenticated with. Recovery timing must assume the ScreenConnect server itself is unavailable during the response, since it is the system being rebuilt.",
+        "evidence": "ConnectWise ScreenConnect path traversal, CISA KEV-listed 2026-04-28, active exploitation confirmed, public PoC available, RWEP 83. The packet records the traversal being used with the companion authentication bypass to drop a web shell on the server that brokers remote sessions to managed endpoints, which places every endpoint reachable from that server inside the incident scope rather than outside it.",
+        "gap_closes": [
+          "UK-CAF-D1"
+        ]
+      }
+    ]
   },
   "CVE-2025-29635": {
     "name": "D-Link DIR-823X Command Injection Vulnerability",
@@ -7762,7 +7873,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "A vendor patch for this Office document-parsing flaw exists and the CVE identifier dates to 2009, yet CISA added it to KEV on 2026-04-14 on the strength of current in-the-wild exploitation. Any remediation queue that sorts or ages by CVE publication date, by 'newly disclosed' status, or by scanner first-seen date buries a CVE-2009 entry beneath every current-quarter finding and it never reaches a patch window, which is exactly why the long-tail estate is still being exploited. The KEV listing date must start the clock instead of the CVE year: on 2026-04-14 every Office installation in the estate is re-evaluated against the fixed build inside the KEV SLA, and any Office build that cannot reach it is cut off from untrusted documents rather than risk-accepted by age. The distinguishing test: query the vulnerability queue for KEV-listed CVEs older than ten years and confirm they carry the same due date as a current-quarter KEV entry — a program whose SLA derives from disclosure age reports 'no overdue criticals' while an actively exploited 2009 Office flaw sits unremediated on the frozen estate.",
+        "evidence": "Packet: CVE-2009-0238, Microsoft Office Remote Code Execution, CWE-94 code injection in Office document parsing, exploitable by an attacker-controlled document for code execution in the Office process. CISA KEV-listed 2026-04-14, active_exploitation confirmed, CVSS 9.8, RWEP 77, poc_available true, patch_available true — the residual exposure is the long-tail unpatched estate, not an absent fix.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-120",
+        "name": "DOWNLOAD-PROVENANCE-ENFORCEMENT",
+        "description": "Exploitation here requires the victim to open an attacker-supplied Office document, so on an estate that has not yet reached the fixed build the delivery path is the only enforceable control. Require Mark-of-the-Web on every Office file arriving by mail, web download, or untrusted file share, and require MOTW-tagged documents to open in Protected View — an isolated, reduced-privilege render — instead of the full parsing path that carries the CWE-94 sink at the user's own process privilege. Provenance must survive the container: files extracted from an archive, mounted from an ISO or VHD, or renamed must inherit the tag rather than lose it, and 'Enable Editing' on externally sourced documents must be blocked by policy rather than left to the user. The distinguishing test: mail a MOTW-tagged spreadsheet nested inside a ZIP to a managed workstation, extract it, and confirm the extracted file still opens in Protected View — a user-application-hardening attestation that covers only macro and ActiveX/OLE settings still lets a provenance-stripped document reach the vulnerable parser with full user privileges.",
+        "evidence": "Packet attack vector: an attacker-controlled document reaching Microsoft Office's parser for code execution in the Office process (CWE-94). poc_available true and CISA-confirmed in-the-wild exploitation at the 2026-04-14 KEV listing. AU-Essential-8-App-Hardening (user application hardening) and NIST-800-53-AC-6 (least privilege) are both already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-AC-6"
+        ]
+      }
+    ]
   },
   "CVE-2026-32201": {
     "name": "Microsoft SharePoint Server Improper Input Validation Vulnerability",
@@ -7992,7 +8126,30 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Exchange Server is internet-facing by construction and this CWE-502 sink yields code execution on the mail server itself. A vendor patch exists and the CVE identifier dates to the 2023 cycle, while the KEV listing is 2026-04-13 — so an estate installing the fixed cumulative/security update in response to that listing is patching a host that stayed reachable and exploitable throughout the interval, with a public PoC in circulation. Treat any Exchange server that ran a vulnerable build during confirmed in-the-wild exploitation as compromised until proven otherwise: alongside patching, hunt the OWA/ECP virtual directories and the Exchange install tree for web shells and unexpected .aspx/.dll drops, export and diff transport rules, mailbox permissions, and journaling configuration against last known-good, and rotate the machine account, Exchange service accounts, and every credential that authenticated through the server during the exposure window. Patch-in-place restores the build number and leaves a resident implant and any stolen credential fully operative. The distinguishing test: open a closed Exchange remediation ticket and look for a post-patch persistence sweep and a credential-rotation record — a 'patched within SLA' closure carrying neither is paper remediation of a service that was already being exploited.",
+        "evidence": "Packet: CVE-2023-21529, Microsoft Exchange Server Deserialization of Untrusted Data (CWE-502) reachable by an attacker for remote code execution on the Exchange server. CISA KEV-listed 2026-04-13, active_exploitation confirmed, CVSS 9.8, RWEP 83, poc_available true, patch_available true. AU-Essential-8-Patch, NIST-800-53-SI-2, and NIS2-Art21-vulnerability-handling are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-Essential-8-Patch",
+          "NIS2-Art21-vulnerability-handling"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-040",
+        "name": "OWA-PER-REQUEST-SIEM-INGESTION",
+        "description": "A serialized object arriving in a request body or header is inert to file-based anti-malware — nothing is written to disk before the gadget chain runs inside the Exchange worker process — and it travels over a session that authentication logging records as ordinary, so the endpoint AV control credited for this server never had anything to detect. Ship Exchange's per-request IIS/OWA/ECP access logs (URI stem and query, method, request size, status, user agent, source address, responding backend) to a SIEM outside the Exchange trust zone with at least 90-day retention, and alert on POSTs to Autodiscover, ECP, and PowerShell endpoints with anomalous body sizes or from unexpected sources. Retention depth is the load-bearing part here: the KEV listing landed 2026-04-13 on a CVE from the 2023 cycle, so an investigation opened at patch time must be able to reach back into an exposure window that long. The distinguishing test: pick a date months before the current remediation and try to retrieve the full request line for a single OWA POST from the SIEM — if only the authentication event survives, the deserialization request that established the foothold is unrecoverable.",
+        "evidence": "Packet attack vector: CWE-502 deserialization of untrusted data reachable for remote code execution on the Exchange server; CISA KEV-listed 2026-04-13 with confirmed in-the-wild exploitation, poc_available true, RWEP 83, CVSS 9.8. CIS-Controls-v8-10.1 (Deploy and Maintain Anti-Malware Software) and UK-CAF-B4 (System security) are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2023-36424": {
     "name": "Microsoft Windows Out-of-Bounds Read Vulnerability",
@@ -8452,7 +8609,31 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-057",
+        "name": "BROWSER-MANAGED-UPDATE-NO-DEFERRAL",
+        "description": "The fix for this Dawn/WebGPU use-after-free reaches endpoints only as a browser security-channel release, so any managed update ring that pins a version or holds the security channel for staging leaves the sandbox-escape link of the chain live fleet-wide. Managed browser policy has to let the security channel land within 24h and force the relaunch that actually replaces the running GPU process — an updated binary on disk beside a browser session that has not been restarted is still executing the vulnerable Dawn code.",
+        "evidence": "KEV-listed 2026-04-01 with confirmed in-the-wild exploitation, a public PoC, and a patch available; the flaw is the sandbox-escape step used after the renderer is already compromised, so it is the link that converts a contained renderer bug into host code execution.",
+        "gap_closes": [
+          "AU-Essential-8-App-Hardening",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-018",
+        "name": "SCANNER-PAPER-COMPLIANCE-TEST",
+        "description": "A scan that reports the installed browser version as fixed does not prove this defect is gone. Dawn is Chromium's WebGPU implementation, so the same component ships inside Chromium-derived browsers and inside desktop applications that embed Chromium, each on its own update cadence and none of them moved by the browser's updater. The operational test: does the scan enumerate every Chromium-embedding runtime on the host as a separate versioned asset, record whether WebGPU is reachable in each, and read the version of the running process rather than the installed package?",
+        "evidence": "Patch available and KEV-listed 2026-04-01 with confirmed exploitation; the packet locates the flaw in Dawn/WebGPU rather than in a single vendor application, and exploitation requires prior renderer compromise, so the escape path only matters where a vulnerable Dawn build is actually loaded.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2"
+        ]
+      }
+    ]
   },
   "CVE-2026-3055": {
     "name": "Citrix NetScaler Out-of-Bounds Read Vulnerability",
@@ -11557,7 +11738,40 @@
     },
     "ai_discovered_zeroday": false,
     "ai_discovery_source": "vendor_research",
-    "ai_assist_factor": "none"
+    "ai_assist_factor": "none",
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "The perimeter SLA tier has to extend from the firewall to the console that programs it. Cisco Secure Firewall Management Center and Security Cloud Control firewall management push policy, access rules, intrusion configuration, and software to every managed sensor, so unauthenticated remote code execution on the management plane is equivalent to administrative control of the entire enforcement estate — a strictly larger blast radius than the same flaw on one appliance, and the reason a frameworks list that enumerates only firewalls, VPN concentrators, and load-balancers under-tiers this device. On the 2026-03-19 KEV listing the requirement is deployment of the fixed release within hours, or removal of the FMC/SCC management interface from any network segment an attacker can reach (management VRF, jump-host-only ACL), not the routine 14/30-day appliance window; for the SaaS-delivered SCC side, vendor remediation status must be obtained and recorded rather than assumed complete. The distinguishing test: from a general-purpose user VLAN, attempt to open the FMC management HTTPS interface — if it answers, the standard patch window is the only thing standing between an unauthenticated attacker and the firewall control plane.",
+        "evidence": "Packet: CVE-2026-20131, Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management, CWE-502 deserialization of untrusted data yielding unauthenticated remote code execution on the firewall management plane. CISA KEV-listed 2026-03-19, active_exploitation confirmed, CVSS 9.8, RWEP 83, poc_available true, patch_available true.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "FMC holds the administrative credentials, the sensor registration keys, and the policy source of truth for every firewall it manages, so unauthenticated code execution on it is a credential-and-configuration compromise of the enforcement fleet rather than a single-host incident — and with a public PoC and confirmed in-the-wild exploitation, an operator patching after 2026-03-19 cannot assume they got there first. The runbook for a KEV-listed, actively exploited FMC/SCC RCE must default to: export and diff the running policy against last known-good (added permit rules, disabled inspection, new remote-access or VPN entries, altered NAT), reimage FMC from vendor media at the fixed release instead of upgrading in place, re-register managed devices with new keys, and rotate FMC local admin, RADIUS/TACACS, and every device credential FMC stored. The distinguishing test: read the FMC incident procedure and check whether it ends at 'upgraded to fixed release' — with no policy diff and no sensor re-registration step, an attacker-inserted firewall rule survives the remediation and keeps the network open behind a device the audit now records as patched.",
+        "evidence": "Packet: unauthenticated remote code execution on the Cisco FMC / SCC firewall management plane via CWE-502 deserialization; CISA KEV-listed 2026-03-19 with active_exploitation confirmed, poc_available true, patch_available true, RWEP 83, CVSS 9.8. AU-Essential-8-Patch and NIS2-Art21-vulnerability-handling are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "NIS2-Art21-vulnerability-handling",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-031",
+        "name": "FIREWALL-EGRESS-TELEMETRY-SEPARATE-TRUST-ZONE",
+        "description": "In a Cisco Secure Firewall deployment FMC is both the target of this flaw and the event collector for the sensors it manages, so an attacker who reaches unauthenticated code execution on FMC lands on the box holding the connection, intrusion, and audit records that would evidence the intrusion — including FMC's own audit trail of the policy changes they make next. Where the deployment relies on FMC as the event store, that is a single-point forensic dependency on the compromised host. Forward FMC audit and syslog, plus the managed sensors' event streams, to a SIEM in a separate trust zone with separate credentials and a separate authentication path, and alert on FMC audit-log gaps, policy deployments not tied to a change ticket, and sensor event streams that go silent. The distinguishing test: simulate a total FMC outage and confirm the SIEM still holds the managed sensors' events for that window — if firewall telemetry exists only inside FMC, an exploited management plane produces no evidence at all, which is why the anti-malware control credited for this estate (unrunnable on the appliance in the first place) cannot substitute.",
+        "evidence": "Packet: CWE-502 deserialization yielding unauthenticated RCE on the Cisco FMC / SCC firewall management plane, CISA KEV-listed 2026-03-19 with confirmed in-the-wild exploitation and a public PoC (RWEP 83). CIS-Controls-v8-10.1 (Deploy and Maintain Anti-Malware Software) and UK-CAF-B4 (System security) are already recorded as insufficient controls citing this CVE.",
+        "gap_closes": [
+          "CIS-Controls-v8-10.1",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   },
   "CVE-2025-66376": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability",
@@ -26200,7 +26414,19 @@
     "ai_discovery_source": "human_researcher",
     "ai_assist_factor": "none",
     "new_control_requirements": [
-      "Enforce timely remediation of CISA KEV-listed RCE in Google Chrome and Chromium-based browsers before Chrome 149: KEV due-date as the binding SLA, not a 30-day default."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Enforce timely remediation of CISA KEV-listed RCE in Google Chrome and Chromium-based browsers before Chrome 149: KEV due-date as the binding SLA, not a 30-day default.",
+        "evidence": "CVE-2026-11645 — Chromium V8 out-of-bounds read/write, CISA KEV-listed with confirmed in-the-wild exploitation (RWEP 60). Browser fleets patch on a release cadence rather than a KEV clock, so the binding date is the KEV due date, not the next scheduled Chrome rollout.",
+        "gap_closes": [
+          "ISO-27001-2022-A.8.8",
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546",
+          "NIS2-Art21-vulnerability-handling",
+          "DORA-Art-9"
+        ]
+      }
     ],
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation"
@@ -26240,7 +26466,16 @@
     "ai_discovery_source": "human_researcher",
     "ai_assist_factor": "none",
     "new_control_requirements": [
-      "Enforce timely remediation of CISA KEV-listed Privilege Escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) and SD-WAN vSmart Controller across the affected 20: KEV due-date as the binding SLA, not a 30-day default."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Enforce timely remediation of CISA KEV-listed Privilege Escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) and SD-WAN vSmart Controller across the affected 20: KEV due-date as the binding SLA, not a 30-day default.",
+        "evidence": "CVE-2026-20245 — Cisco Catalyst SD-WAN Manager root command execution via improper output encoding, CISA KEV-listed with confirmed exploitation (RWEP 56). Network-management appliances sit outside the OS patch pipeline these controls assume, so the remediation tempo has to be stated for the appliance estate explicitly.",
+        "gap_closes": [
+          "AU-ISM-1546",
+          "DORA-Art-9"
+        ]
+      }
     ],
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation"
@@ -26590,7 +26825,18 @@
     "ai_discovery_source": "human_researcher",
     "ai_assist_factor": "none",
     "new_control_requirements": [
-      "Enforce timely remediation of CISA KEV-listed Access Control Bypass in Arista EOS - all release trains: KEV due-date as the binding SLA, not a 30-day default."
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "Enforce timely remediation of CISA KEV-listed Access Control Bypass in Arista EOS - all release trains: KEV due-date as the binding SLA, not a 30-day default.",
+        "evidence": "CVE-2026-7473 — Arista EOS tunnel-decapsulation access-control bypass via incomplete comparison, CISA KEV-listed with confirmed exploitation (RWEP 69), affecting all release trains. Arista states no software fix or upgrade path is planned, so patch_available is false: the only mitigation is MAC/IP access-control lists on the affected switches or upstream devices that drop unexpected tunnel types. The KEV deadline therefore has to be met by deploying and evidencing that ACL, which is precisely the documented-compensating-control limb of the SLA rather than a patch window.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "AU-ISM-1546",
+          "DORA-Art-9",
+          "UK-CAF-B4"
+        ]
+      }
     ],
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation"

package/lib/framework-gap.js

@@ -297,7 +297,25 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   const lessonEntry = Object.entries(lessons)
     .find(([id]) => id.toLowerCase() === scenario);
   const newControls = (lessonEntry && Array.isArray(lessonEntry[1].new_control_requirements))
-    ? lessonEntry[1].new_control_requirements.map(c => ({
+    ? lessonEntry[1].new_control_requirements
+      // Three catalog entries held a bare string where the schema expects a
+      // control object, which rendered as "- undefined undefined:" the moment
+      // this section started being shown. Emitting a malformed record is worse
+      // than omitting it, so drop anything the renderer cannot print.
+      //
+      // Every field the renderer interpolates has to be checked, not just the
+      // identifying one: guarding `id` alone still let `{ id: 'NEW-X' }` reach
+      // the output as "NEW-X undefined:", so the guard would have covered the
+      // bare-string case that prompted it and nothing else. The data itself is
+      // fixed; the catalog test fails on the shape so a malformed record cannot
+      // hide behind this filter.
+      .filter(c =>
+        c && typeof c === 'object' &&
+        typeof c.id === 'string' && c.id.trim() !== '' &&
+        typeof c.name === 'string' && c.name.trim() !== '' &&
+        typeof c.description === 'string' && c.description.trim() !== ''
+      )
+      .map(c => ({
         id: c.id,
         name: c.name,
         requirement: c.description,

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.19.4",
+  "version": "0.19.5",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-08-08T22:55:57.947Z",
+      "signed_at": "2026-08-09T03:51:59.487Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -133,7 +133,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "hnKY1LYEKUurrzJIFcvwCZpclpk/XT8fMVJeCKqzrpOpfgov2d3AciuiEky85PhREzAmYGFfk2sLRC6ayJ6UDw==",
-      "signed_at": "2026-08-08T22:55:57.949Z",
+      "signed_at": "2026-08-09T03:51:59.489Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -215,7 +215,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "uiJt3Oj0lSLr7Nm0OoM2qI/z/oAIAiPwMfP12s97jVYeA7xfOlU21fc7zidT/9YulunfaSjBSAlgv6paWmosBg==",
-      "signed_at": "2026-08-08T22:55:57.949Z",
+      "signed_at": "2026-08-09T03:51:59.490Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -269,7 +269,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "80LN540R3z/gcIMCF/8H6nh2V6xdudctYKE74Ve7bqecyPUQf2NfCA/8T9L18tIz7BTyBkiI/V5JcG4ClgNyCQ==",
-      "signed_at": "2026-08-08T22:55:57.949Z"
+      "signed_at": "2026-08-09T03:51:59.491Z"
     },
     {
       "name": "compliance-theater",
@@ -301,7 +301,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Tsat4OgtCJ6yGJQeIQnz+XTU11B8SLgbPe1zmb2UFOzxqlBnRoKeOzIVwFsv7wM0mP1bXQvQgFFpIOxN2VeTCQ==",
-      "signed_at": "2026-08-08T22:55:57.950Z"
+      "signed_at": "2026-08-09T03:51:59.491Z"
     },
     {
       "name": "exploit-scoring",
@@ -332,7 +332,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "zxsj3SExhBJ+A7UDZEI4uWl4OCbnn5+ddCRCalhlHKFyRML9fcB9qd1v9a+hDoeVJXGr/OBXHR3MdyD8XEhrDQ==",
-      "signed_at": "2026-08-08T22:55:57.950Z"
+      "signed_at": "2026-08-09T03:51:59.492Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -374,7 +374,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lrj8/nJWYzgeOYPF9Ax59A0mxCXWKKhH9QI+88KQNiKly0Hq+pA5wdtL0J9LY24YrVWmqEhpSHueGlj03UNOAA==",
-      "signed_at": "2026-08-08T22:55:57.951Z",
+      "signed_at": "2026-08-09T03:51:59.492Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -441,7 +441,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "nqqZUnu7ZocLNJKs3KJO6NnoC8MgmS1iGP9TGrv51e+trjqb4Gf2mAjCTe7pINFivWDK00A0ZHazaMAKKbaNCA==",
-      "signed_at": "2026-08-08T22:55:57.951Z",
+      "signed_at": "2026-08-09T03:51:59.493Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -482,7 +482,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "ZfFXIDjwGDwlZA30TOMPmNr0IK/sydbsiox7LYU0pGkaRlQW18/oSjkHZRgiQpP5yzQhuFsKdztA7Ec6BDQLAA==",
-      "signed_at": "2026-08-08T22:55:57.951Z",
+      "signed_at": "2026-08-09T03:51:59.494Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -517,7 +517,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "CtiEhtzaqg/hCGX1wmgEGq0O6o+UNf9RAM3xxn0rQVEkFt/IEmyYqsWd1qjpqMdp8kbEXgAsd816AwFwLYMaAA==",
-      "signed_at": "2026-08-08T22:55:57.952Z",
+      "signed_at": "2026-08-09T03:51:59.494Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -558,7 +558,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-08-05",
       "signature": "Eu2AnT4xyZH9n3OKjm5S9vaiHqUE+1N3oLAQbbt78OCp2HnAQMvqBkUn9rgl4Il7Il7yZW8N7c8hq3mkst+EAA==",
-      "signed_at": "2026-08-08T22:55:57.952Z",
+      "signed_at": "2026-08-09T03:51:59.495Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -600,7 +600,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "tlvk8q1fa1scoDsJMZnigCoRNO3dqoK03Ve8tuYE2/nPwAMAGlofHpoE0mI0BX4pPODPgCfSjzgKEUn6HkcZDw==",
-      "signed_at": "2026-08-08T22:55:57.953Z",
+      "signed_at": "2026-08-09T03:51:59.496Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -669,7 +669,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "DNXmzLVK71XI/b9mkIBw30KVdVV5Wc9/0o/pP35RkferqtvlsMHjj4WJpoGXpIu8/hJyuMJRQrV7pzfR68iIAg==",
-      "signed_at": "2026-08-08T22:55:57.953Z",
+      "signed_at": "2026-08-09T03:51:59.496Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -719,7 +719,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "AzyfBZd5bxpQpaFb/S5ZJI2/NjeACLuq/u8GzKHehhlggWUqILIrS4aJ6eXn0I3UBhuXRcNBBx1mXriCSmhQAA==",
-      "signed_at": "2026-08-08T22:55:57.954Z"
+      "signed_at": "2026-08-09T03:51:59.497Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -759,7 +759,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "8JHth6QjMcUuAD069/QvpMxgRMG+L/PVTE68/UdX9kG4SNA20ds7vHU15YzMNBmWWgiUvpLAE6hzctz1N7bWCg==",
-      "signed_at": "2026-08-08T22:55:57.954Z",
+      "signed_at": "2026-08-09T03:51:59.497Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -813,7 +813,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-08-08T22:55:57.954Z"
+      "signed_at": "2026-08-09T03:51:59.498Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -889,7 +889,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "GuHxmoEU97+lQfU11chYwXVQhSMpddU0OS1iLkYDmEJhBkHRWWaOa2emYJoVUBDB9v/PTKcFEuEraZwYg+8nCw==",
-      "signed_at": "2026-08-08T22:55:57.955Z"
+      "signed_at": "2026-08-09T03:51:59.499Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -950,7 +950,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "R2jcBorSMWFuZKHUugWEni9q/W7Qk73Kg0SztXlySYu9+D2Ee43gyYsUy0nSa0oCTS8pyuhFiFv2XN0EaweTBQ==",
-      "signed_at": "2026-08-08T22:55:57.955Z"
+      "signed_at": "2026-08-09T03:51:59.500Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -1028,7 +1028,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "uIQdYlbKIQw8qQRDeGnXv4D/wuPAvYFRzos3kqkyELx+v9rGmfmT7w5s1608lpJxXzGLIA7BSN2/wLJJAZmXCg==",
-      "signed_at": "2026-08-08T22:55:57.955Z"
+      "signed_at": "2026-08-09T03:51:59.500Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1112,7 +1112,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "4EMvqqcYHnM+9fmlS156Utl3T248EqHdiB89zVyW8+wUYHAU/VLUOr27JiiSmj5iZrdY5Prq7t9Hsk3LuVx5Aw==",
-      "signed_at": "2026-08-08T22:55:57.956Z"
+      "signed_at": "2026-08-09T03:51:59.501Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1169,7 +1169,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "W8kg2Okd/VF521VmeVFGK2TmXkFPycuwgYdyNxLU2fMN+sR9Aals/X+Xqr/prrGEsqWnZsCInSq1TYzFr0wiDg==",
-      "signed_at": "2026-08-08T22:55:57.956Z"
+      "signed_at": "2026-08-09T03:51:59.501Z"
     },
     {
       "name": "identity-assurance",
@@ -1243,7 +1243,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-08-08T22:55:57.956Z"
+      "signed_at": "2026-08-09T03:51:59.502Z"
     },
     {
       "name": "ot-ics-security",
@@ -1302,7 +1302,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "1PFZXMfQwM0dHsZQfo+rg5hJB00dfeOL41VA3J8gNF6cCUpplw9vQuZfODX/SwXI/WmDQwM9G2sd1X/i7LG9DA==",
-      "signed_at": "2026-08-08T22:55:57.957Z"
+      "signed_at": "2026-08-09T03:51:59.503Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1362,7 +1362,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "5b3J9mk/iEi6OzeC0O2hw/K/ofTrH8519l+ZUpK8gqB/v0XbDFceIIBPB8TQM8wCct5iG0Krb7OCDSIbU0jVBw==",
-      "signed_at": "2026-08-08T22:55:57.957Z"
+      "signed_at": "2026-08-09T03:51:59.503Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1416,7 +1416,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "fibgNRd+STEyN3ZlnIxJddfaOXISYosdjoxkQ/oNVTP3GKhN1A4c3Jh0HZPbhTdjhrbJM/mE5ufiIOs7+RCMCQ==",
-      "signed_at": "2026-08-08T22:55:57.957Z"
+      "signed_at": "2026-08-09T03:51:59.504Z"
     },
     {
       "name": "webapp-security",
@@ -1499,7 +1499,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "3qtC0X8QR9YufDfeL/AUiw3EeJwvSfSrUWojndEZVmeJ3MtM12I94OJmaQT1AWaTRWVa9f91owgLl6AgoTNVAA==",
-      "signed_at": "2026-08-08T22:55:57.958Z",
+      "signed_at": "2026-08-09T03:51:59.505Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1559,7 +1559,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-08-08T22:55:57.958Z"
+      "signed_at": "2026-08-09T03:51:59.505Z"
     },
     {
       "name": "sector-healthcare",
@@ -1626,7 +1626,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Z/lPfIH5ARAOoeR81ATj6lQlekZP/8tzg23Pr1H9BxxdQedRsLGDNVIHu81qNuoA7GNRRMtxXpwrS7fXbMh5Cw==",
-      "signed_at": "2026-08-08T22:55:57.959Z"
+      "signed_at": "2026-08-09T03:51:59.506Z"
     },
     {
       "name": "sector-financial",
@@ -1715,7 +1715,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "kPV8cEpIUAMKY2USvFxAn6JkkRMlBAM2mGLy6ViS9O3rv+3dsAgBqKgcBTBbuSoMZgY2KKruoG+SkrR3aoViAg==",
-      "signed_at": "2026-08-08T22:55:57.960Z"
+      "signed_at": "2026-08-09T03:51:59.507Z"
     },
     {
       "name": "sector-federal-government",
@@ -1792,7 +1792,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "CbxW5qhlaiqf+P3xIemSHlMz9OoWat2srh7F3+nAIsa0Y4nBr6WCXZXZlUUjrjptZ3Ny+Cw485HMLWRO9qbcBw==",
-      "signed_at": "2026-08-08T22:55:57.960Z"
+      "signed_at": "2026-08-09T03:51:59.508Z"
     },
     {
       "name": "sector-energy",
@@ -1866,7 +1866,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "lVHORFJzvkxNqJfT34inW28BzlA8dCWDfo0JS9tsiNW3PUxdijZS22g4GMbQJgaSKGv7F3ag5rWk75O+IChUAw==",
-      "signed_at": "2026-08-08T22:55:57.961Z"
+      "signed_at": "2026-08-09T03:51:59.509Z"
     },
     {
       "name": "sector-telecom",
@@ -1952,7 +1952,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-08-08T22:55:57.961Z"
+      "signed_at": "2026-08-09T03:51:59.509Z"
     },
     {
       "name": "api-security",
@@ -2031,7 +2031,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "hyLAsPCAkUkhNeaaFtgSg5XsKs2L8HuFoPka/Urzel54XPMQ0F3MwRD7j/ZURzIHQxvrAxmS3OCXEsBrgcFxAw==",
-      "signed_at": "2026-08-08T22:55:57.961Z",
+      "signed_at": "2026-08-09T03:51:59.510Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2126,7 +2126,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "MfijBq1nzlyPQWf5/EcTn5Xx7ThdZ9BT8/W/+daxhATfMSoSTrMn9pYh1R83Chr9n2ahQeMoPUkSxL7Cr9V3Dw==",
-      "signed_at": "2026-08-08T22:55:57.962Z"
+      "signed_at": "2026-08-09T03:51:59.511Z"
     },
     {
       "name": "container-runtime-security",
@@ -2198,7 +2198,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "QJ8RF3ifPFc0mr3gYkloHqg5nuYe1GS4h+xbKYDCkM+HbA3iTd5keJ59P2P3z8TwVdOt8XM8WOsx6aRUrFL0Cw==",
-      "signed_at": "2026-08-08T22:55:57.962Z",
+      "signed_at": "2026-08-09T03:51:59.511Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2279,7 +2279,7 @@
         "MITRE ATLAS v2026.07 (released June 2026) is additive over v2026.05 — it adds AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) and refreshes AML.T0054 (LLM Jailbreak), with no technique-ID removals. Earlier releases shipped the AML.T0010 sub-technique expansion and agentic-AI techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\") this forecast tracked. Forward watch: subsequent monthly ATLAS releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "e4uV8JvtEbC/lKGqJ6Y3ugEetF6aEv7R7CwJ/Y9N4thWNg8fconRcOPDS+045PW8xmcAqAbkSi+I4N1E6EPTAA==",
-      "signed_at": "2026-08-08T22:55:57.962Z"
+      "signed_at": "2026-08-09T03:51:59.512Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2353,7 +2353,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "asDHEy7Y2Bj4ikCkpP5MHRe33TIY8aQ1a+KN1UZgl89g9LyLcXzSg/weACafxJNzhOUkXnKBAtBrQIKW6p6nDQ==",
-      "signed_at": "2026-08-08T22:55:57.963Z"
+      "signed_at": "2026-08-09T03:51:59.512Z"
     },
     {
       "name": "ransomware-response",
@@ -2433,7 +2433,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "UTDsSMDvW5cpuSDBgZO5AzKowXWAR3WqeUeqyHXaikxslC6YBDL/gIojm9Km3/mgOS6pD5JKb/LLcfb4T/r4BQ==",
-      "signed_at": "2026-08-08T22:55:57.963Z"
+      "signed_at": "2026-08-09T03:51:59.513Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2501,7 +2501,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-08-08T22:55:57.963Z"
+      "signed_at": "2026-08-09T03:51:59.514Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2576,7 +2576,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "l/jeAAnb7H2GQzp1x05bsdZwzC0NNTBi3ZuiwgDly5EVSoikbnVWpx921bT5G3OPkx4dqs2PohlvTG0gLxCrAA==",
-      "signed_at": "2026-08-08T22:55:57.964Z"
+      "signed_at": "2026-08-09T03:51:59.514Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2656,7 +2656,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "vrMvYLdYJLlEAC8YvOb/g3LJ8gU1YmYewZ94J5AFgxxh2EiDyszqo3D/WVpt5NTrDSS/N5OgOf5Vwom/KGlMCA==",
-      "signed_at": "2026-08-08T22:55:57.964Z",
+      "signed_at": "2026-08-09T03:51:59.515Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2750,7 +2750,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-08-08T22:55:57.964Z",
+      "signed_at": "2026-08-09T03:51:59.516Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2822,7 +2822,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-08-08T22:55:57.965Z"
+      "signed_at": "2026-08-09T03:51:59.516Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2881,7 +2881,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-08-08T22:55:57.965Z"
+      "signed_at": "2026-08-09T03:51:59.517Z"
     },
     {
       "name": "network-trust",
@@ -2937,7 +2937,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-08-08T22:55:57.965Z"
+      "signed_at": "2026-08-09T03:51:59.518Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2992,7 +2992,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
-      "signed_at": "2026-08-08T22:55:57.965Z"
+      "signed_at": "2026-08-09T03:51:59.518Z"
     },
     {
       "name": "self-update-integrity",
@@ -3046,7 +3046,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-08-08T22:55:57.966Z"
+      "signed_at": "2026-08-09T03:51:59.519Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3104,7 +3104,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-08-08T22:55:57.966Z"
+      "signed_at": "2026-08-09T03:51:59.520Z"
     },
     {
       "name": "decompression-dos",
@@ -3162,7 +3162,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-08-08T22:55:57.966Z"
+      "signed_at": "2026-08-09T03:51:59.520Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3217,7 +3217,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-08-08T22:55:57.966Z"
+      "signed_at": "2026-08-09T03:51:59.521Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3272,11 +3272,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-08-08T22:55:57.967Z"
+      "signed_at": "2026-08-09T03:51:59.522Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "AKfV9CWcR3vzj8gXIpq76/+lHaka2UVFM0n/tPcxdWJjHMWddbOaObQRvMjyRh9/jdXQXw8uvrI7Z6BKuv5MDw=="
+    "signature_base64": "XKpTTy5N7cIABKP0ONcuNlVuDM/v//vU21G/0UH7hY2dZ+dEe2mjyH3WZ0gr+mZcrPqT0LX6MxS+1XnvBeaZDA=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.19.4",
+  "version": "0.19.5",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1025 CVEs / 232 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,7 +1,7 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:39690a6e-923e-46d5-b483-72282a0e499c",
+  "serialNumber": "urn:uuid:61454518-f9f7-41bc-bf78-d19c77c38b4a",
   "version": 1,
   "metadata": {
     "timestamp": "2026-08-08T00:00:00.000Z",
@@ -9,14 +9,14 @@
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.19.4"
+        "version": "0.19.5"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.4",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.5",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.19.4",
+      "version": "0.19.5",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1025 CVEs / 232 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.4",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.5",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4ef2a3fc4e88dbfdf286ca61af32628049f178d1f525e204fec3baeb622dd2a5"
+          "content": "6b388cfad4017eb60f9b8bcfee10344e63697aa390f64129f4b3d5394c1848c0"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.4"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.5"
         },
         {
           "type": "vcs",
@@ -124,11 +124,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6e0ba7961dc4fed4d9e18db5521fa38cd11e03be6a81689b94deb649c7519c84"
+          "content": "6b863a1ee687550eb946f79eb096cd1404dae638de0f3173e62c409801b54204"
         },
         {
           "alg": "SHA3-512",
-          "content": "295dd1023cd697f7a63586b84c07f43a9fec6a1c519b5e2cd3844dc403deab115b30110f4d645fa9076e8d0ec4c609a189b48516fbe653358d007ac063ee3779"
+          "content": "0418360a1562811f275fb999654c260b9bf1cece61a6e82d897ff6f1c0b74ec7cdd63b121cef6cedd610a5f909784b8fb1c461eb20282fb296b2d19b52d0e668"
         }
       ]
     },
@@ -949,11 +949,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9bc4f85c15d1618ef438a9221346c6913f823c5b8368acc2b2d5756c3a07c21e"
+          "content": "e71be5d0f356ce0d249b8b01f348553b48d80213e693955f1ea9615b56aec918"
         },
         {
           "alg": "SHA3-512",
-          "content": "43dac02cda23b8a73d857f474fe37e7754e61c57d5c882c06af239f6262fc5505b42181a88c44ebeaf5f5e79f0d73e01f39af27c418e92371193a06f2c22e220"
+          "content": "102cb5c0ec613002b4e9610fc07276e8fc605a602ff6594d4a170f164d473d2d498f80abf3c03ff941f8d637a9baa65703f6dbc0ef5f411e234be66e5fdfb367"
         }
       ]
     },
@@ -1444,11 +1444,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ea9bf984d82bc6704f254efc64f29b68e4849eb4b36dc03abefffe82553e295b"
+          "content": "a26461c4cb01e8c0863a1d87c530c88378fc31022fdfc2c0eae91abc948d3d5e"
         },
         {
           "alg": "SHA3-512",
-          "content": "ab49455842d2de7b7ad87129b46d343b96b2e50f032385b42335cb52cd5e03513bd2cf212c32ed5b188bda51c8a4925d991486ac7fe1b34bcdce6460124c2c32"
+          "content": "bd1bc3d4efd586d31bf7b2828ea04ad6a9eebde8e5e8c40b98b9ddf428d3e1a00b9aaf56e01fa118e6e5ddf88b49e1f89498c6ba33879fc2e702f60111a0aa85"
         }
       ]
     },
@@ -1954,11 +1954,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4f92a89e4b15843aed7516645c38e3eaec48993fe3043f74b98e97a42f2d38b4"
+          "content": "d8a29cea517d6283eb77e3dafcf4b762bae6c4c4ceb7175ec07d61704adb8410"
         },
         {
           "alg": "SHA3-512",
-          "content": "33cef53e15a6270cb030af5ac31eb7c875f613e720ef794f1a8d4540fe11112ff1f754a9711565aa27865a15e74ac35b74acd433e6445e61edd99c166362855c"
+          "content": "6801743b26ae4ca4e45497b56382cd06333e9fb3f1aac5aa63ad721d6b2fc1de4ea442986a31204aa2daa925413fa386227919ce4a88e7300ea975b0af6c5817"
         }
       ]
     },
@@ -2074,11 +2074,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "304331c5a4233174becbc9e73d9fafe4c781a0d2dbcf438a198bfd6e7f75c859"
+          "content": "764f320198bb93c4522940f64c0ebff4f1e676d0b18da7b5e5c584daa90ba83a"
         },
         {
           "alg": "SHA3-512",
-          "content": "2f6b0bc9b7f996370d228c6a59681b3394d859910e3437dac2769a3665af1b6fcda6ea195af6995fcbbd7ce2031bd065cd09c5427ea4aa0083db0d18a478a41a"
+          "content": "82df86ac7da06a6ae5b562a7adbc6afc0515f113e9bb15e6fb6b57393a1a68f75e965afa3ab7012cd7b41b8e120dc2766e02b9476c20526a0bf3a7aea142dd8c"
         }
       ]
     },