@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/lib/ttp-mapper.js

@@ -112,7 +112,7 @@ function universalGaps() {
     { gap: 'MCP/agent tool trust boundaries', no_framework_coverage: true },
     { gap: 'LLM prompt injection as access control failure', no_framework_coverage: true },
     { gap: 'AI-as-C2 detection and response', no_framework_coverage: true },
-    { gap: 'Live kernel patching as required capability', no_framework_coverage: true, closest: 'ASD ISM-1623 (48h)' },
+    { gap: 'Live kernel patching as required capability', no_framework_coverage: true, closest: 'ASD ISM-1877 and ISM-1696 (48h)' },
     { gap: 'Ephemeral infrastructure asset inventory alternatives', no_framework_coverage: true },
     { gap: 'AI-accelerated exploit weaponization in patch SLAs', no_framework_coverage: true },
     { gap: 'RAG pipeline integrity and retrieval security', no_framework_coverage: true },

package/manifest-snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-09-19T05:28:18.485Z",
+  "_generated_at": "2026-09-23T08:47:41.112Z",
   "atlas_version": "2026.09",
   "skill_count": 51,
   "skills": [
@@ -84,6 +84,7 @@
         "framework-control-gaps.json"
       ],
       "atlas_refs": [
+        "AML.T0013",
         "AML.T0016",
         "AML.T0017",
         "AML.T0018",
@@ -149,7 +150,7 @@
         "rfc-references.json"
       ],
       "atlas_refs": [
-        "AML.T0017",
+        "AML.T0016",
         "AML.T0096"
       ],
       "attack_refs": [
@@ -217,6 +218,7 @@
         "zeroday-lessons.json"
       ],
       "atlas_refs": [
+        "AML.T0013",
         "AML.T0017",
         "AML.T0051",
         "AML.T0096"
@@ -270,7 +272,7 @@
         "rfc-references.json"
       ],
       "atlas_refs": [
-        "AML.T0017",
+        "AML.T0013",
         "AML.T0096"
       ],
       "attack_refs": [
@@ -476,7 +478,7 @@
         "T1580"
       ],
       "framework_gaps": [
-        "AU-ISM-1546-Cloud-Service-Account",
+        "AU-ISM-1685-Cloud-Service-Account",
         "AWS-Security-Hub-Coverage-Gap",
         "CISA-Snowflake-AA24-IdP-Cloud",
         "FedRAMP-IL5-IAM-Federated",
@@ -538,6 +540,7 @@
       ],
       "atlas_refs": [
         "AML.T0010",
+        "AML.T0013",
         "AML.T0017"
       ],
       "attack_refs": [
@@ -761,7 +764,7 @@
         "T1499.001"
       ],
       "framework_gaps": [
-        "AU-ISM-1556",
+        "AU-ISM-1240",
         "NIS2-Art21-network-security",
         "NIST-800-53-SI-2",
         "UK-CAF-B4"
@@ -861,7 +864,7 @@
         "global-frameworks.json"
       ],
       "atlas_refs": [
-        "AML.T0017",
+        "AML.T0024",
         "AML.T0051",
         "AML.T0096"
       ],
@@ -1236,7 +1239,7 @@
         "T1606.002"
       ],
       "framework_gaps": [
-        "AU-ISM-1559-IdP",
+        "AU-ISM-1685-IdP",
         "DORA-Art-19-IdP-4h",
         "ISO-27001-2022-A.5.16-Federated",
         "NIS2-Art-21-Federated-Identity",
@@ -1295,7 +1298,8 @@
         "zeroday-lessons.json"
       ],
       "atlas_refs": [
-        "AML.T0017",
+        "AML.T0013",
+        "AML.T0024",
         "AML.T0051",
         "AML.T0096"
       ],
@@ -1419,7 +1423,7 @@
         "T1565.001"
       ],
       "framework_gaps": [
-        "AU-ISM-1556",
+        "AU-ISM-1815",
         "ISO-27001-2022-A.8.15",
         "NIS2-Art21-network-security",
         "NIST-800-53-SI-2",
@@ -1515,7 +1519,8 @@
       ],
       "atlas_refs": [
         "AML.T0010",
-        "AML.T0016",
+        "AML.T0053",
+        "AML.T0086",
         "AML.T0096"
       ],
       "attack_refs": [
@@ -1595,7 +1600,7 @@
       ],
       "atlas_refs": [
         "AML.T0010",
-        "AML.T0017",
+        "AML.T0013",
         "AML.T0018",
         "AML.T0020",
         "AML.T0043"
@@ -1668,7 +1673,7 @@
         "T1530"
       ],
       "framework_gaps": [
-        "AU-ISM-1556",
+        "AU-ISM-1268",
         "NIS2-Art21-network-security",
         "NIST-800-53-AC-3",
         "UK-CAF-B4"
@@ -1910,7 +1915,7 @@
         "T1565.001"
       ],
       "framework_gaps": [
-        "AU-ISM-1556",
+        "AU-ISM-1240",
         "NIS2-Art21-network-security",
         "NIST-800-53-SI-2",
         "UK-CAF-B4"
@@ -2224,7 +2229,7 @@
         "global-frameworks.json"
       ],
       "atlas_refs": [
-        "AML.T0017",
+        "AML.T0013",
         "AML.T0096"
       ],
       "attack_refs": [
@@ -2292,6 +2297,7 @@
         "global-frameworks.json"
       ],
       "atlas_refs": [
+        "AML.T0013",
         "AML.T0017",
         "AML.T0051"
       ],
@@ -2362,7 +2368,7 @@
         "global-frameworks.json"
       ],
       "atlas_refs": [
-        "AML.T0040"
+        "AML.T0010"
       ],
       "attack_refs": [
         "T1071",
@@ -2374,7 +2380,7 @@
       ],
       "framework_gaps": [
         "3GPP-TR-33.926",
-        "AU-ISM-1556",
+        "AU-ISM-1173-Telecom-NMS",
         "DORA-Art-21-Telecom-ICT",
         "FCC-CPNI-4.1",
         "FCC-Cyber-Incident-Notification-2024",
@@ -2485,7 +2491,7 @@
         "T1574"
       ],
       "framework_gaps": [
-        "AU-ISM-1556",
+        "AU-ISM-0298",
         "NIS2-Art21-network-security",
         "NIST-800-53-SR-11",
         "UK-CAF-B4"

package/manifest-snapshot.sha256

@@ -1 +1 @@
-2fe0a9f136473981799cb4ffdbb53390ff10a39576b9469fe04e206e692320f3  manifest-snapshot.json
+fc93d94869546bc25b5f8ed656b086634dba945f70a62296c4fda5aac4d93149  manifest-snapshot.json