@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/scripts/backfill-theater-test.js

@@ -598,10 +598,10 @@ const TESTS = {
     evidence_required: ["tabletop execution log", "FCC notification draft", "cross-jurisdiction timing matrix"],
     verdict_when_failed: PAPER
   },
-  'AU-ISM-1556': {
-    claim: "Our telecom posture satisfies AU ISM control 1556 for signaling-protocol abuse.",
-    test: "Confirm signaling-anomaly baselines per PLMN-pair, gNB firmware hash attestation, and LI-gateway audit. Pull the past 90 days of signaling alerts; confirm triage records. Theater verdict if any of those streams is missing, or if signaling anomalies are unmonitored.",
-    evidence_required: ["signaling baseline document with PLMN-pair coverage", "gNB attestation telemetry", "alert-triage records"],
+  'AU-ISM-1173-Telecom-NMS': {
+    claim: "Privileged users of our telecom network management systems authenticate with multi-factor authentication, which satisfies ISM-1173.",
+    test: "List every administrative path into the network management system, element managers, operations support systems and lawful-intercept gateways, including OEM remote-support tunnels. For each, confirm the factor in use and whether it is phishing-resistant, and confirm no credential for it is shared through a mailbox or ticket. Theater verdict if any path accepts a password alone, if lawful-intercept operator accounts are not classified as privileged, or if a support tunnel's credential is shared.",
+    evidence_required: ["inventory of administrative paths with the authentication factor used on each", "privileged-role classification covering lawful-intercept gateway operators", "OEM remote-support credential handling record"],
     verdict_when_failed: PAPER
   },
   'GSMA-NESAS-Deployment': {
@@ -636,10 +636,10 @@ const TESTS = {
     evidence_required: ["IdP tenant inventory", "off-boarding/dormant alerting configuration", "claim-transformation review cadence document"],
     verdict_when_failed: PAPER
   },
-  'AU-ISM-1559-IdP': {
-    claim: "Our IdP posture satisfies AU ISM 1559 for identity provider security.",
-    test: "Confirm IdP token-signing certificate rotation alerting, claim-transformation change-control, management-API token TTL/scope/source-IP enforcement. Confirm the IdP is treated as critical-infrastructure-tier in the asset inventory. Theater verdict if IdP is in 'IT vendor' tier rather than critical-infrastructure tier.",
-    evidence_required: ["IdP control-plane monitoring rule export", "asset-tier classification record", "management-API token inventory"],
+  'AU-ISM-1685-IdP': {
+    claim: "Our identity provider's privileged and service credentials are managed, which satisfies ISM-1685.",
+    test: "Confirm alerting on token-signing certificate rotation, change control on claim transformations, and enforced lifetime, scope and source-address limits on management-API tokens. Confirm the identity provider is classified in the critical-infrastructure tier of the asset inventory. Theater verdict if it is classified as an ordinary IT vendor, or if management-API tokens have no lifetime or scope limit.",
+    evidence_required: ["identity provider control-plane monitoring rule export", "asset-tier classification record", "management-API token inventory with lifetime and scope"],
     verdict_when_failed: PAPER
   },
   'OFAC-Sanctions-Threat-Actor-Negotiation': {
@@ -666,8 +666,8 @@ const TESTS = {
     evidence_required: ["cross-account assume-role policy sample", "monitoring rule for chain depth", "external-ID enforcement evidence"],
     verdict_when_failed: PAPER
   },
-  'AU-ISM-1546-Cloud-Service-Account': {
-    claim: "Our cloud service-account posture satisfies AU ISM 1546.",
+  'AU-ISM-1685-Cloud-Service-Account': {
+    claim: "Our cloud service-account credentials are managed, which satisfies ISM-1685.",
     test: "Inventory cloud service accounts. Confirm short-lived OIDC tokens (workload identity federation) are used in preference to static keys; for any remaining static keys, confirm rotation policy ≤90 days and source-IP allowlisting. Theater verdict if static keys exist without rotation/IP-allowlisting, or if workload identity federation is available but not adopted.",
     evidence_required: ["cloud service-account inventory by auth method", "rotation policy document", "source-IP allowlist configuration"],
     verdict_when_failed: PAPER

package/scripts/builders/did-ladders.js

@@ -86,7 +86,7 @@ const LADDERS = [
   {
     id: "model-exfiltration",
     attack_class: "Model Weight / Training Data Exfiltration",
-    primary_ttps: ["AML.T0043", "AML.T0017"],
+    primary_ttps: ["AML.T0043", "AML.T0025"],
     layers: [
       { layer: "Storage", control: "Model weights in encrypted-at-rest object store; key access via KMS audit", source_skill: "mlops-security", d3fend: ["D3-FE", "D3-MENCR"] },
       { layer: "Access Control", control: "ML-engineer workstations get read-only via signed checkouts; production weights gated", source_skill: "identity-assurance", d3fend: ["D3-CBAN", "D3-MFA"] },

package/scripts/builders/theater-fingerprints.js

@@ -59,7 +59,7 @@ const PATTERN_CONTROL_MAP = {
       { framework: "NIST 800-53", control_id: "IR-4", note: "Incident handling — phases defined but not AI-class triggers" },
       { framework: "ISO 27001:2022", control_id: "A.5.24-A.5.28", note: "IR planning/preparation/reporting/response/learning" },
     ],
-    evidence: { campaign: "SesameOp", rationale: "AML.T0096 LLM Integration Abuse as C2 — no detection triggers exist, so IR procedures have no input" },
+    evidence: { campaign: "SesameOp", rationale: "AML.T0096 AI Service API as C2 — no detection triggers exist, so IR procedures have no input" },
     ttps: ["AML.T0020", "AML.T0096", "AML.T0010"],
     fast_test: "Search IR playbooks for 'prompt injection', 'model poisoning', 'AI agent', 'LLM', 'MCP server'. Zero matches = THEATER FLAG.",
   },

package/scripts/check-atlas-catalog-currency.js

@@ -8,15 +8,18 @@
  * MITRE. An id can therefore carry a name MITRE gives to a different technique,
  * or name a sub-technique that does not exist, and every gate stays green.
  *
- * Three things are compared, for the release named in `_meta.atlas_version`:
+ * Four things are compared, for the release named in `_meta.atlas_version`:
  *   1. every AML id in the catalog exists upstream
  *   2. every catalog name is the name upstream gives that id
  *   3. every AML sub-technique id named inside a `subtechniques` list exists
+ *   4. every tactic an entry lists is one upstream assigns to that technique; a
+ *      sub-technique with no tactics of its own is checked against its parent's
  *
  * Divergences recorded in tests/.atlas-divergence-baseline.json are reported and
  * allowed, so known work in progress does not block a release while any NEW
  * divergence does. An entry that has been repaired and is still in the baseline
- * is also an error, so the file shrinks instead of going stale.
+ * is also an error, so the file shrinks instead of going stale. Tactics have no
+ * baseline, so a wrong tactic always fails.
  *
  * Two naming conventions are accepted without a baseline entry, because they
  * render the same technique rather than a different one: a sub-technique may be
@@ -129,6 +132,38 @@ function parentNameOf(id, upstream) {
   return m ? upstream.get(m[1]) || null : null;
 }
 
+// Format 6 records each technique's tactics as `achieves` relationships in the
+// top-level `relationships` section. Returns technique id -> set of tactic names.
+function parseTactics(text, names) {
+  const out = new Map();
+  const at = text.indexOf("\nrelationships:");
+  if (at < 0) return out;
+  const re = /- source: (AML\.T[0-9.]+)\n\s+target: (AML\.TA[0-9]+)\n\s+relationship-type: achieves\b/g;
+  const rel = text.slice(at);
+  let m;
+  while ((m = re.exec(rel)) !== null) {
+    if (!out.has(m[1])) out.set(m[1], new Set());
+    out.get(m[1]).add(names.get(m[2]) || m[2]);
+  }
+  return out;
+}
+
+// The tactic values an entry lists that upstream does not assign to it. An
+// entry may list fewer tactics than upstream; it may not list a different one.
+// A sub-technique with no tactics of its own is checked against its parent's,
+// and an id upstream assigns no tactic to is not checked.
+function tacticProblems(id, tactic, tactics) {
+  const values = (Array.isArray(tactic) ? tactic : [tactic])
+    .map((t) => String(t == null ? "" : t).trim())
+    .filter(Boolean);
+  if (!values.length) return [];
+  const parent = /^(AML\.T\d+)\.\d+$/.exec(id);
+  const allowed = (tactics.get(id) && tactics.get(id).size ? tactics.get(id) : null) ||
+    (parent ? tactics.get(parent[1]) : null);
+  if (!allowed || !allowed.size) return [];
+  return values.filter((v) => !allowed.has(v)).map((v) => ({ id, ours: v, theirs: [...allowed].sort() }));
+}
+
 function readBaseline() {
   if (!fs.existsSync(BASELINE)) return { names: {}, missing_ids: [], missing_subtechniques: [] };
   try {
@@ -194,6 +229,13 @@ async function main() {
     }
   }
 
+  const upstreamTactics = parseTactics(release.text, upstream);
+  const wrongTactic = [];
+  for (const id of ids) {
+    if (!AML_ID.test(id) || !upstream.has(id)) continue;
+    wrongTactic.push(...tacticProblems(id, catalog[id].tactic, upstreamTactics));
+  }
+
   // Each allowance covers exactly one finding. A recorded name does not excuse a
   // sub-technique id, and a recorded sub-technique id does not excuse its
   // siblings, so a new bad id under an entry that already diverges still fails.
@@ -218,6 +260,7 @@ async function main() {
   for (const x of newMisnamed) problems.push(`${x.id} is named ${JSON.stringify(x.ours)}; ATLAS ${pin} names it ${JSON.stringify(x.theirs)}`);
   for (const x of newMissing) problems.push(`${x.id} (${JSON.stringify(x.ours)}) does not exist in ATLAS ${pin}`);
   for (const x of newMissingSub) problems.push(`${x.id} names sub-technique ${x.sub}, which does not exist in ATLAS ${pin}`);
+  for (const x of wrongTactic) problems.push(`${x.id} lists tactic ${JSON.stringify(x.ours)}; ATLAS ${pin} assigns ${x.theirs.map((t) => JSON.stringify(t)).join(", ")}`);
   for (const id of staleNames) problems.push(`${id} is recorded as a name divergence but now agrees with upstream; remove it from ${path.relative(ROOT, BASELINE)}`);
   for (const id of staleMissing) problems.push(`${id} is recorded as absent upstream but now resolves; remove it from ${path.relative(ROOT, BASELINE)}`);
   for (const sub of staleSubs) problems.push(`${sub} is recorded as absent upstream but is no longer named or now resolves; remove it from ${path.relative(ROOT, BASELINE)}`);
@@ -241,7 +284,7 @@ async function main() {
     return;
   }
 
-  emit(`[check-atlas-catalog-currency] PASS — every id and name agrees with ATLAS ${pin}, or is a recorded divergence`);
+  emit(`[check-atlas-catalog-currency] PASS — every id, name and tactic agrees with ATLAS ${pin}, or is a recorded divergence`);
 }
 
 if (require.main === module) {
@@ -253,4 +296,4 @@ if (require.main === module) {
 
 // Only the pieces that carry judgment are exported; `main` is the CLI and is
 // reached through the guard above.
-module.exports = { parseNames, isRenderingOf, parentNameOf };
+module.exports = { parseNames, isRenderingOf, parentNameOf, parseTactics, tacticProblems };

package/scripts/check-ism-control-references.js

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Checks every Australian ISM control the repository cites against the ISM
+ * release pinned in sources/index.json (`au_frameworks.ism.oscal_release`).
+ *
+ * Two things are compared:
+ *   1. every ISM-NNNN token in the shipped data, skills, library and scripts
+ *      names a control that exists in the release
+ *   2. every framework-control-gaps key of the form AU-ISM-NNNN carries
+ *      control_id ISM-NNNN, and its control_name begins with that control's
+ *      statement, so the key cannot describe a different control
+ *
+ * The release is ASD's own OSCAL catalog, fetched from
+ * github.com/AustralianCyberSecurityCentre/ism-oscal at the pinned tag and
+ * cached under .cache/upstream/ism/. With no cache and no network the check
+ * reports that it could not verify and exits 2.
+ *
+ * Usage: node scripts/check-ism-control-references.js [--json]
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+const https = require("node:https");
+
+const ROOT = path.resolve(__dirname, "..");
+const SOURCES = path.join(ROOT, "sources", "index.json");
+const REGISTRY = path.join(ROOT, "data", "framework-control-gaps.json");
+const CACHE_DIR = path.join(ROOT, ".cache", "upstream", "ism");
+const JSON_OUT = process.argv.includes("--json");
+
+// Paths scanned for citations, relative to the repository root. CHANGELOG.md
+// records past releases and is not scanned.
+const SCAN_ROOTS = ["data", "skills", "lib", "scripts", "AGENTS.md", "README.md", "ARCHITECTURE.md"];
+const SKIP_DIRS = new Set(["_indexes", "node_modules", "vendor"]);
+const SELF = path.relative(ROOT, __filename).split(path.sep).join("/");
+
+const PIN_SHAPE = /^v[0-9]{4}\.[0-9]{2}\.[0-9]+$/;
+// "ISM-" must not follow a letter or digit, so AU-ISM-1546 is read as a
+// citation and a name such as PRISM-1234 is not.
+const TOKEN = /(?<![A-Za-z0-9])ISM-([0-9]{4})\b/g;
+const REGISTRY_KEY = /^AU-ISM-([0-9]{4})(?:-|$)/;
+
+function emit(line) {
+  if (!JSON_OUT) process.stdout.write(line + "\n");
+}
+
+function fetchText(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    if (redirects > 5) return reject(new Error("too many redirects"));
+    const req = https.get(url, { headers: { "user-agent": "exceptd-ism-references" } }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return resolve(fetchText(res.headers.location, redirects + 1));
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+      }
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (c) => { body += c; });
+      res.on("end", () => resolve(body));
+    });
+    req.setTimeout(60000, () => req.destroy(new Error("timed out")));
+    req.on("error", reject);
+  });
+}
+
+async function loadRelease(pin) {
+  if (!PIN_SHAPE.test(pin)) throw new Error(`oscal_release ${JSON.stringify(pin)} is not a vYYYY.MM.N tag`);
+  const cached = path.join(CACHE_DIR, `ISM_catalog-${pin}.json`);
+  let text = null;
+  try { text = fs.readFileSync(cached, "utf8"); }
+  catch (e) { if (e.code !== "ENOENT") throw e; }
+  let source = "cache";
+  if (text === null) {
+    text = await fetchText(`https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/${pin}/ISM_catalog.json`);
+    source = "network";
+  }
+  const controls = parseControls(text);
+  const version = (JSON.parse(text).catalog.metadata || {}).version;
+  if (`v${version}` !== pin) throw new Error(`the catalog for ${pin} declares version ${JSON.stringify(version)}`);
+  if (source === "network") {
+    fs.mkdirSync(CACHE_DIR, { recursive: true });
+    fs.writeFileSync(cached, text);
+  }
+  return { controls, source };
+}
+
+// Map of "ISM-NNNN" to the control's statement, from an OSCAL catalog document.
+function parseControls(text) {
+  const out = new Map();
+  (function walk(g) {
+    for (const x of g.controls || []) {
+      const m = /^ism-([0-9]{4})$/.exec(x.id || "");
+      if (m) {
+        const st = (x.parts || []).find((p) => p.name === "statement");
+        out.set(`ISM-${m[1]}`, ((st && st.prose) || "").replace(/\s+/g, " ").trim());
+      }
+      walk(x);
+    }
+    for (const y of g.groups || []) walk(y);
+  })(JSON.parse(text).catalog || {});
+  return out;
+}
+
+// Every ISM-NNNN occurrence in a text, with its 1-based line number.
+function findTokens(text) {
+  const out = [];
+  const lines = text.split("\n");
+  lines.forEach((line, i) => {
+    let m;
+    TOKEN.lastIndex = 0;
+    while ((m = TOKEN.exec(line)) !== null) out.push({ id: `ISM-${m[1]}`, line: i + 1 });
+  });
+  return out;
+}
+
+// A registry entry keyed AU-ISM-NNNN must name ISM-NNNN and describe it. The
+// control_name may add a scope after the statement, as in
+// "... managed (identity provider tenant)".
+function registryProblems(key, entry, controls) {
+  const m = REGISTRY_KEY.exec(key);
+  if (!m) return [];
+  const id = `ISM-${m[1]}`;
+  const problems = [];
+  if (!controls.has(id)) {
+    problems.push(`${key}: ${id} does not exist in the pinned release`);
+    return problems;
+  }
+  if (entry.control_id !== id) problems.push(`${key}: control_id is ${JSON.stringify(entry.control_id)}, expected ${id}`);
+  const statement = controls.get(id).replace(/\.$/, "");
+  const name = String(entry.control_name || "");
+  if (!name.startsWith(statement)) {
+    problems.push(`${key}: control_name ${JSON.stringify(name)} does not begin with the statement of ${id}: ${JSON.stringify(statement)}`);
+  }
+  return problems;
+}
+
+function scanFiles() {
+  const files = [];
+  function walk(p) {
+    let st;
+    try { st = fs.statSync(p); } catch (e) { if (e.code === "ENOENT") return; throw e; }
+    if (st.isDirectory()) {
+      if (SKIP_DIRS.has(path.basename(p))) return;
+      for (const e of fs.readdirSync(p)) walk(path.join(p, e));
+    } else if (/\.(json|md|js)$/.test(p)) {
+      files.push(p);
+    }
+  }
+  for (const r of SCAN_ROOTS) walk(path.join(ROOT, r));
+  return files;
+}
+
+async function main() {
+  const sources = JSON.parse(fs.readFileSync(SOURCES, "utf8"));
+  const ism = ((sources.sources || sources).au_frameworks || {}).ism || {};
+  const pin = ism.oscal_release;
+  if (!pin) {
+    process.stderr.write("[check-ism-control-references] sources/index.json has no au_frameworks.ism.oscal_release\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  let release;
+  try {
+    release = await loadRelease(pin);
+  } catch (e) {
+    process.stderr.write(
+      `[check-ism-control-references] COULD NOT VERIFY: ${e.message}\n` +
+      "No citation was compared to anything, which is not the same as passing. " +
+      `Re-run with network access, or place ISM_catalog-${pin}.json under ${path.relative(ROOT, CACHE_DIR)}.\n`
+    );
+    process.exitCode = 2;
+    return;
+  }
+  emit(`[check-ism-control-references] ISM ${pin} (${release.source}): ${release.controls.size} controls`);
+
+  const problems = [];
+  let citations = 0;
+  for (const f of scanFiles()) {
+    const rel = path.relative(ROOT, f).split(path.sep).join("/");
+    if (rel === SELF) continue;
+    for (const t of findTokens(fs.readFileSync(f, "utf8"))) {
+      citations++;
+      if (!release.controls.has(t.id)) problems.push(`${rel}:${t.line}: ${t.id} does not exist in ISM ${pin}`);
+    }
+  }
+
+  const registry = JSON.parse(fs.readFileSync(REGISTRY, "utf8"));
+  let keys = 0;
+  for (const [key, entry] of Object.entries(registry)) {
+    if (key.startsWith("_") || !REGISTRY_KEY.test(key)) continue;
+    keys++;
+    problems.push(...registryProblems(key, entry, release.controls));
+  }
+
+  emit(`  citations checked: ${citations}   AU-ISM registry keys checked: ${keys}`);
+
+  if (JSON_OUT) {
+    process.stdout.write(JSON.stringify({ ok: problems.length === 0, pin, source: release.source, citations, registry_keys: keys, problems }, null, 2) + "\n");
+  }
+  if (problems.length) {
+    process.stderr.write(`[check-ism-control-references] FAIL: ${problems.length} problem(s) against ISM ${pin}:\n`);
+    for (const p of problems) process.stderr.write(`  - ${p}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  emit(`[check-ism-control-references] PASS: every ISM control cited exists in ${pin}, and every AU-ISM registry key describes the control it names`);
+}
+
+if (require.main === module) {
+  main().catch((e) => {
+    process.stderr.write(`[check-ism-control-references] ${e.stack || e.message}\n`);
+    process.exitCode = 2;
+  });
+}
+
+module.exports = { parseControls, findTokens, registryProblems };

package/scripts/check-test-count.js

@@ -6,8 +6,11 @@
  * diff-coverage gates cannot see.
  *
  * Counts DECLARATIONS statically across `tests/*.test.js` — `test(` and `it(`
- * with their `.only` / `.skip` variants. `describe(` is NOT counted: a container
- * is not a test. Blind spot: a test neutered in place still counts as one.
+ * with their `.only` variants. `describe(` is NOT counted: a container is not
+ * a test. `test.skip(`, and a declaration whose options on the same line set
+ * `skip` to `true` or to a string, are not counted, so a test disabled in place
+ * reads as a lost test. A conditional skip such as `{ skip: !HAS_KEY }` still
+ * counts, and so does a skip set on a later line of a multi-line options object.
  *
  * exit 0 at or above baseline minus tolerance, 1 when it drops further, 2 when
  * the baseline file is missing or malformed.
@@ -48,7 +51,10 @@ function countTests(filePath) {
     // Drop a trailing line comment too (`test('x'); // disabled`).
     const stripped = noStrings.replace(/\/\/.*$/, '').trim();
     if (!stripped) continue;
-    if (/(?<![A-Za-z0-9_$.])(?:test|it)(?:\.only|\.skip)?\s*\(/.test(stripped)) count++;
+    if (!/(?<![A-Za-z0-9_$.])(?:test|it)(?:\.only)?\s*\(/.test(stripped)) continue;
+    // String literals are blanked to '' above, so `skip: 'reason'` reads as `skip: ''`.
+    if (/\bskip\s*:\s*(?:true\b|''\s*[,}])/.test(stripped)) continue;
+    count++;
   }
   return count;
 }

package/scripts/predeploy.js

@@ -209,6 +209,15 @@ const GATES = [
     args: [path.join(ROOT, "scripts", "check-atlas-catalog-currency.js")],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
+  {
+    // Every ISM-NNNN citation must name a control in the pinned ism-oscal
+    // release, and every AU-ISM-NNNN registry key must describe that control.
+    // Fetches the release catalog on a cold cache; a tag is immutable.
+    name: "ISM control references (citations vs. the pinned ISM release)",
+    command: process.execPath,
+    args: [path.join(ROOT, "scripts", "check-ism-control-references.js")],
+    ciJobName: "Data integrity (catalog + manifest snapshot)",
+  },
 ];
 
 function runGate(gate) {

package/scripts/refresh-upstream-catalogs.js

@@ -537,14 +537,21 @@ async function refreshIcsAttack({ dry = false, cap = Infinity, _deps = {} } = {}
 
 const ATLAS_SRC = "https://raw.githubusercontent.com/mitre-atlas/atlas-navigator-data/main/dist/stix-atlas.json";
 
+// The STIX mirror trails ATLAS releases, so a phase can arrive under a slug
+// ATLAS has since renamed. Every slug a release has used for a tactic maps to
+// that tactic's current name: AML.TA0000 is AI Model Access and AML.TA0001 is
+// AI Attack Adaptation.
 function atlasTactic(phases) {
   const map = {
     "reconnaissance": "Reconnaissance", "resource-development": "Resource Development",
-    "initial-access": "Initial Access", "ml-model-access": "AI Model Access",
+    "initial-access": "Initial Access",
+    "ml-model-access": "AI Model Access", "ai-model-access": "AI Model Access",
     "execution": "Execution", "persistence": "Persistence",
     "privilege-escalation": "Privilege Escalation", "defense-evasion": "Defense Evasion",
     "credential-access": "Credential Access", "discovery": "Discovery",
-    "collection": "Collection", "ml-attack-staging": "AI Attack Staging",
+    "lateral-movement": "Lateral Movement", "collection": "Collection",
+    "ml-attack-staging": "AI Attack Adaptation", "ai-attack-staging": "AI Attack Adaptation",
+    "ai-attack-adaptation": "AI Attack Adaptation",
     "command-and-control": "Command and Control", "exfiltration": "Exfiltration",
     "impact": "Impact"
   };

package/scripts/release.js

@@ -563,15 +563,15 @@ function cmdRelease() {
   _section("verify npm");
   // npm accepts a publish before the registry serves it ("Your package is being
   // processed and may take a few minutes"), so `npm view` can report the
-  // previous version for a minute or two after release.yml succeeds. Poll for
-  // up to three minutes before reading a mismatch as a failed publish.
+  // previous version for several minutes after release.yml succeeds. Poll for
+  // up to ten minutes before reading a mismatch as a failed publish.
   var npmVersion = "";
-  for (var _n = 0; _n < 18; _n++) {
+  for (var _n = 0; _n < 60; _n++) {
     npmVersion = _capture("npm", ["view", PKG_NAME, "version"]).stdout;
     if (npmVersion === next) break;
-    if (_n < 17) {
+    if (_n < 59) {
       console.log("npm " + PKG_NAME + ": " + (npmVersion || "(unable to query)") +
-        ", waiting for " + next + " (" + (_n + 1) + "/18)");
+        ", waiting for " + next + " (" + (_n + 1) + "/60)");
       _spawn(process.execPath, ["-e", "setTimeout(function(){},10000)"], { stdio: "ignore" });
     }
   }
@@ -592,7 +592,7 @@ function cmdRelease() {
     throw new Error("release: scripts/verify-shipped-tarball.js missing — cannot verify the shipped artifact");
   }
 
-  // The workflow has finished and the registry has had three minutes, so an
+  // The workflow has finished and the registry has had ten minutes, so an
   // empty or mismatched version must not read as a completed release.
   if (npmVersion !== next) {
     throw new Error("release: npm shows " + (npmVersion || "(unable to query)") + " but expected " + next +

package/scripts/sync-manifest-metadata.js

@@ -6,11 +6,11 @@
  * Run it whenever frontmatter changes, then re-run sign-all — and, when a
  * cross-ref array changed, refresh-reverse-refs + build-indexes.
  *
- * `last_threat_review` and `forward_watch` MIRROR frontmatter exactly and sync
- * by replace. The cross-reference arrays are an enriched superset — the
- * manifest carries curated refs frontmatter does not — so they sync by UNION;
- * replacing them drops the curated refs build-indexes and refresh-reverse-refs
- * read. `description` is cached in the manifest but is not synced here.
+ * `description`, `last_threat_review` and `forward_watch` MIRROR frontmatter
+ * exactly and sync by replace. The cross-reference arrays are an enriched
+ * superset — the manifest carries curated refs frontmatter does not — so they
+ * sync by UNION; replacing them drops the curated refs build-indexes and
+ * refresh-reverse-refs read.
  *
  * Exit codes: 0 = wrote (or already in sync), 1 = a skill file was missing or
  * its frontmatter failed to parse.
@@ -23,7 +23,7 @@ const lint = require("../lib/lint-skills.js");
 const ROOT = path.resolve(__dirname, "..");
 const MANIFEST = path.join(ROOT, "manifest.json");
 
-const MIRRORED_SCALAR = ["last_threat_review"];
+const MIRRORED_SCALAR = ["description", "last_threat_review"];
 const MIRRORED_ARRAY = ["forward_watch"];
 // Union, never replace — a replace drops the manifest's curated refs.
 const MIRRORED_COVER = ["data_deps", "framework_gaps", "atlas_refs", "attack_refs", "rfc_refs", "cwe_refs", "d3fend_refs"];

package/skills/ai-attack-surface/skill.md

@@ -22,6 +22,7 @@ atlas_refs:
   - AML.T0096
   - AML.T0016
   - AML.T0017
+  - AML.T0013
   - AML.T0018
 attack_refs:
   - T1566
@@ -96,13 +97,13 @@ This is a supply chain attack surface. Every MCP server a user installs is a pot
 
 The implication: the time between a vulnerability's introduction into a codebase and its reliable exploitation has compressed from months or years to hours or days for AI-capable threat actors. Patch management SLAs designed for human-speed exploit development are structurally inadequate.
 
-**ATLAS ref:** AML.T0016 (Obtain Capabilities: Develop Capabilities)
+**ATLAS ref:** AML.T0017 (Develop Capabilities)
 
 ### 4. AI Credential Phishing Acceleration
 
 Credential theft driven by AI increased 160% in 2025. 82.6% of phishing emails now contain AI-generated content undetectable by grammar/style checks. Traditional phishing detection heuristics (poor grammar, unusual phrasing, template patterns) are no longer reliable detectors.
 
-**ATLAS ref:** AML.T0016 (Obtain Capabilities: Develop Capabilities — misuse of public AI APIs to generate phishing payloads)
+**ATLAS ref:** AML.T0016 (Obtain Capabilities), covering public AI APIs misused to generate phishing payloads
 
 ### 5. AI as Covert C2 — SesameOp
 
@@ -140,7 +141,7 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 
 ### 11. AI-Discovered + AI-Weaponized Supply-Chain Worms
 
-**CVE-2026-45321** — Mini Shai-Hulud TanStack npm worm (CVSS 9.6, ~150M weekly downloads across 42 @tanstack/* packages, CISA KEV pending). Disclosed 2026-05-11. The attack chain — Pwn-Request via `pull_request_target` on TanStack's bundle-size workflow, pnpm-store cache poisoning under the `actions/cache` key, and OIDC-token theft on the next main push — is engineering-grade and weaponizes three independently-benign primitives. While attribution (TeamPCP) records no AI-assisted exploit development for this specific instance, the worm pattern is exactly what AML.T0016-class capability-development now produces at AI cadence: chained CI/CD primitives that no individual component owner recognises as exploitable. Treat the @tanstack/* surface as an exemplar of the broader AML.T0010 (AI Supply Chain Compromise) threat applied to JS toolchains that the AI assistant ecosystem depends on.
+**CVE-2026-45321** — Mini Shai-Hulud TanStack npm worm (CVSS 9.6, ~150M weekly downloads across 42 @tanstack/* packages, CISA KEV pending). Disclosed 2026-05-11. The attack chain — Pwn-Request via `pull_request_target` on TanStack's bundle-size workflow, pnpm-store cache poisoning under the `actions/cache` key, and OIDC-token theft on the next main push — is engineering-grade and weaponizes three independently-benign primitives. While attribution (TeamPCP) records no AI-assisted exploit development for this specific instance, the worm pattern is exactly what AML.T0017-class capability development now produces at AI cadence: chained CI/CD primitives that no individual component owner recognises as exploitable. Treat the @tanstack/* surface as an exemplar of the broader AML.T0010 (AI Supply Chain Compromise) threat applied to JS toolchains that the AI assistant ecosystem depends on.
 
 ---
 
@@ -164,7 +165,7 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 | UK NCSC CAF | Principle A4 (Supply Chain), B2 (Identity and Access Control), B4 (System Security), C1 (Security Monitoring) | Outcome-based language. NCSC's 2024 guidance on securing AI systems and the DSIT AI Cyber Code of Practice (2025) name the attack classes at the principle level (prompt injection, model supply chain, monitoring), but the CAF outcome statements are unchanged. An organisation achieves CAF outcomes at Achieved level with zero MCP-trust controls and zero prompt-injection detection. |
 | UK DSIT AI Cyber Code of Practice (2025) | 13 principles for secure AI development and deployment | Principles-based. Names training-data integrity, model-deployment security, monitoring, and supply chain — but as principles, not testable controls. No technical floor for prompt-injection defence, MCP allowlisting, or AI-as-C2 detection. |
 | AU ASD Essential 8 | Strategy: Application Control + User Application Hardening + Restrict Administrative Privileges | Application Control (allowlisting) covers what runs locally; it does not cover AI-assistant tool-use chains where the AI agent dynamically composes the executed action. None of the eight strategies address prompt injection, model supply chain, or LLM-as-C2 channel. |
-| AU ASD ISM | ISM-1808 (cloud consumer responsibilities) + ISM-1728 (supply chain risk) + ISM-1228 (event monitoring) | ISM-1728 supply-chain control is scoped to traditional vendor classes; LLM APIs and MCP servers fall outside enumerated supply-chain categories. ISM-1228 event-log monitoring assumes signature-or-rule detection over known indicators — AI API egress as C2 and prompt-injection-coerced actions produce no traditional indicator. |
+| AU ASD ISM | ISM-2156, ISM-2157 and ISM-2158 (agentic AI: minimum tools, task-scoped authorization, retrieved content treated as untrusted) + ISM-1924 (prompt injection) + ISM-1452 (supply chain risk assessment) + ISM-1228 (event analysis) | The ISM names agentic AI directly, so the gap is narrower than a missing control. ISM-1452's supplier assessment gives no method for rating an LLM API or MCP server provider, and ISM-1228's event analysis has no indicator for AI API egress used as C2 or for an action a prompt injection coerced, because both produce ordinary, authorized traffic. |
 | AU Voluntary AI Safety Standard (10 guardrails, 2024) | Guardrails 5 (test and monitor), 6 (transparency), 8 (record-keeping) | Voluntary, principles-language. Operationally identical to the UK DSIT AI Cyber Code lag — names the right concerns at the principle layer without testable controls for prompt injection, MCP trust, or AI-as-C2 detection. |
 | AU APRA CPS 234 | Para 27 (information security capability proportional to vulnerabilities and threats) + APRA CPG 235 (managing data risk) | "Proportional" capability language. APRA-regulated entities deploying AI assistants meet CPS 234 attestation with traditional information-security capability; AI-specific attack surface is not an examined capability class. APRA Information Paper on AI (2024) names the risks at the supervisory level without altering CPS 234 obligations. |
 
@@ -176,12 +177,13 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 |---|---|---|---|---|
 | AML.T0054 | LLM Jailbreak | Missing in all major frameworks | No control covers adversarial-instruction injection that bypasses guardrails and coerces the model into attacker-chosen actions | CVE-2025-53773 (GitHub Copilot YOLO-mode RCE) |
 | AML.T0010 | AI Supply Chain Compromise | Partial (ISO A.8.30) | A.8.30 covers outsourced development; does not cover MCP server trust, package signing for AI tools | CVE-2026-30615 (Windsurf MCP) |
-| AML.T0096 | LLM Integration Abuse (C2) | Missing in all major frameworks | No framework has a control for AI API traffic as C2 channel | SesameOp campaign |
+| AML.T0096 | AI Service API (C2) | Missing in all major frameworks | No framework has a control for AI API traffic as C2 channel | SesameOp campaign |
 | AML.T0020 | Training Data Poisoning | Partial (NIST AI RMF) | NIST AI RMF identifies the risk; no specific technical control | Supply chain logistics model poisoning |
 | AML.T0043 | Craft Adversarial Data | Partial (SI-10) | SI-10 covers web input validation; not semantic injection in LLM prompts | RAG vector manipulation |
 | AML.T0051 | LLM Prompt Injection | Missing in all major frameworks | Zero controls in NIST, ISO, SOC 2, PCI for prompt injection | CVE-2025-53773, indirect injection via retrieved docs |
-| AML.T0017 | Discover ML Model Ontology | Partial (awareness only) | No framework requires monitoring for adversary mapping of deployed model family, guardrail surface, or system-prompt structure via inference-API probing | Reconnaissance step preceding PROMPTSTEAL-class targeting; AML-model registry exposure |
-| AML.T0016 | Obtain Capabilities: Develop Capabilities | Missing (misuse dimension) | Frameworks don't address adversary AI-assisted exploit development or use of public AI APIs to craft malware/phishing payloads | Copy Fail AI discovery (41% of 2025 0-days), PROMPTFLUX, PROMPTSTEAL, phishing generation |
+| AML.T0013 | Discover AI Model Ontology | Partial (awareness only) | No framework requires monitoring for adversary mapping of deployed model family, guardrail surface, or system-prompt structure via inference-API probing | Reconnaissance step preceding PROMPTSTEAL-class targeting; AML-model registry exposure |
+| AML.T0017 | Develop Capabilities | Missing (misuse dimension) | Frameworks don't address adversary AI-assisted exploit development | Copy Fail AI discovery (41% of 2025 0-days) |
+| AML.T0016 | Obtain Capabilities | Missing (misuse dimension) | Frameworks don't address adversary use of public AI APIs to craft malware/phishing payloads | PROMPTFLUX, PROMPTSTEAL, phishing generation |
 | AML.T0018 | Manipulate AI Model | Partial (NIST AI RMF) | No technical control requirements for model integrity verification | Training pipeline poisoning |
 
 ---
@@ -313,11 +315,11 @@ D3FEND v1.3.0+ references from `data/d3fend-catalog.json`. The AI attack surface
 
 | D3FEND ID | Name | Layer | Rationale (what it counters here) |
 |---|---|---|---|
-| `D3-IOPR` | Input/Output Profiling | SDK / application | SDK-level prompt and completion inspection — the foundational control for AML.T0051 (prompt injection), AML.T0096 (LLM C2), AML.T0054 (extraction). Without per-call I/O profiling, every detection step below is degraded. |
+| `D3-IOPR` | Input/Output Profiling | SDK / application | SDK-level prompt and completion inspection — the foundational control for AML.T0051 (prompt injection), AML.T0096 (LLM C2), AML.T0054 (jailbreak). Without per-call I/O profiling, every detection step below is degraded. |
 | `D3-CSPP` | Client-server Payload Profiling | LLM / MCP gateway | Gateway-layer inspection of tool-call args and prompt/completion bodies. Necessary when the AI client (mobile app, browser extension, IDE) cannot host `D3-IOPR` instrumentation in-process — the gateway becomes the only content-aware control. |
 | `D3-EAL` | Executable Allowlisting | Endpoint / managed host | Restricts which AI-tool binaries (IDE assistants, browser extensions, MCP servers) can execute on managed endpoints. Direct counter to AML.T0010 (ML supply-chain compromise) for tooling shipped as native binaries; precondition for managed-endpoint clipboard- and code-completion controls. |
 | `D3-FAPA` | File Access Pattern Analysis | Endpoint / data tier | Detects RAG-corpus and training-data abuse by pattern-matching the file-access shape of AML.T0018 (model poisoning at training time) and AML.T0020 (RAG retrieval abuse). Anchors the data-tier defence against poisoning that prompt-layer controls cannot see. |
-| `D3-NTA` | Network Traffic Analysis | Network egress | Per-identity baseline of model-API and MCP-server egress. Catches the AML.T0017 capability-development pattern (PROMPTFLUX-style rapid querying) and the AML.T0096 covert-C2 destination shape when SDK instrumentation is partial or missing. |
+| `D3-NTA` | Network Traffic Analysis | Network egress | Per-identity baseline of model-API and MCP-server egress. Catches the AML.T0016 generative-AI misuse pattern (PROMPTFLUX-style rapid querying) and the AML.T0096 covert-C2 destination shape when SDK instrumentation is partial or missing. |
 
 **Defense-in-depth posture:** `D3-EAL` is the prerequisite endpoint layer (only sanctioned AI clients run); `D3-FAPA` is the data-tier layer (RAG and training corpora); `D3-IOPR` and `D3-CSPP` are the content-aware application and gateway layers; `D3-NTA` is the network-observability backstop. Skills that recommend a single layer alone are flagged as incomplete during Analysis Procedure Step 7.