@blamejs/exceptd-skills 0.20.1 → 0.21.1

package/skills/ai-c2-detection/skill.md

@@ -19,7 +19,7 @@ data_deps:
   - rfc-references.json
 atlas_refs:
   - AML.T0096
-  - AML.T0017
+  - AML.T0016
 attack_refs:
   - T1071
   - T1102
@@ -160,7 +160,7 @@ PROMPTSTEAL uses LLMs as live intelligence analysts for exfiltration targeting.
 | UK NCSC CAF | Principle C1 (Security Monitoring) + Principle C2 (Proactive Security Event Discovery) | Outcome-based monitoring language. NCSC's 2024 guidance on monitoring egress to SaaS APIs recommends behavioural baselining but the CAF outcome statements are satisfied by traditional endpoint and network monitoring. An organisation can meet C1 / C2 at Achieved level with zero AI-API egress baselining. |
 | UK NCSC Cyber Assessment Framework — sectoral profiles (Telecoms Security Code of Practice, Energy CAF profile) | Sector-specific monitoring obligations | Sectoral CAF profiles inherit C1/C2 outcomes; none enumerate AI API egress as an in-scope monitored channel. Telecoms operators meeting the TSA 2021 Code monitoring obligations have the same blind spot. |
 | AU ASD Essential 8 | Strategy: Application Control + User Application Hardening | Application Control (allowlisting) covers what runs locally; it does not cover what allowed applications connect to. A whitelisted browser or IDE making AI API calls passes Application Control while operating as a C2 channel. Essential 8 does not include an egress-control strategy. |
-| AU ASD ISM | ISM-1228 (event log monitoring) + ISM-0859 (network access controls) + ISM-1729 (data loss prevention) | Event-log monitoring assumes signature-or-rule detection over known malicious indicators. ISM-1729 DLP addresses outbound sensitive-data flows but is content-pattern based — AI-API egress with attacker-controlled prompts is data-flowing-to-a-trusted-vendor from the DLP perspective. |
+| AU ASD ISM | ISM-1228 (event analysis) + ISM-1416 (software firewall restricting outbound connections) + ISM-2159 (agentic AI tool invocations and external requests centrally logged) | ISM-1416 restricts outbound connections to approved applications and services, and an AI API is usually approved, so traffic to it passes. ISM-2159 logs what an organization's own agents send, not what malware on the host sends to the same API. ISM-1228 event analysis has no indicator that separates an attacker's prompts from legitimate use of a trusted vendor. |
 | AU APRA CPS 234 | Para 27(b) (capability to detect and respond to information security incidents in a timely manner) | "Timely" detection capability. APRA CPS 234 attestations are satisfied by SIEM/SOC capability over traditional indicators. AI-as-C2 detection capability is not a CPS 234 examined control. |
 
 ---
@@ -334,9 +334,8 @@ level: medium
 
 | ID | Source | Technique | C2 Relevance | Gap Flag — Which Detection Control Fails |
 |---|---|---|---|---|
-| AML.T0096 | ATLAS v2026.09 | LLM API as covert C2 / LLM Integration Abuse | Direct: SesameOp encodes commands and exfiltrated data in prompt and completion fields against api.openai.com, api.anthropic.com, generativelanguage.googleapis.com. AI provider domain is the relay, not the attacker C2 endpoint. | NIST-800-53-SC-7 (Boundary Protection) — AI provider domains are allowlisted in most enterprise egress for legitimate developer and product use, so boundary inspection cannot distinguish benign developer prompts from C2-encoded prompts. See SC-7 entry in `data/framework-control-gaps.json` — real requirement is SDK-level prompt logging with identity binding, anomaly detection on prompt-shape and token-volume, and an allowlist that enumerates the sanctioned business reason per identity. Boundary-only SC-7 evidence is incomplete for any org with AI API access in production. |
-| AML.T0017 | ATLAS v2026.09 | Discover ML Model Ontology — adversary maps the deployed LLM's family, system-prompt structure, guardrail surface via inference-API probing | PROMPTFLUX queries public LLMs to generate per-execution evasion code; PROMPTSTEAL uses LLMs to prioritise exfiltration targets — both depend on first discovering what the target model will answer. The inference API is the discovery surface. | NIST-800-53-SI-3 fails — there is no static signature for code generated per-event by a public LLM. NIST-800-53-SI-4 fails as commonly deployed — no AI-API behavioural baseline per process/identity. |
-| AML.T0016 | ATLAS v2026.09 | Obtain Capabilities: Develop Capabilities — adversary use of inference APIs to generate / refine malware, evasion, phishing payloads | PROMPTFLUX and PROMPTSTEAL both consume public LLMs as a real-time capability-development service. The inference API is doing weaponization work for the adversary. | NIST-800-53-SI-3 fails for the same reason. SC-7 boundary control treats the AI provider as allowlisted SaaS. |
+| AML.T0096 | ATLAS v2026.09 | AI Service API (LLM API as covert C2) | Direct: SesameOp encodes commands and exfiltrated data in prompt and completion fields against api.openai.com, api.anthropic.com, generativelanguage.googleapis.com. AI provider domain is the relay, not the attacker C2 endpoint. | NIST-800-53-SC-7 (Boundary Protection) — AI provider domains are allowlisted in most enterprise egress for legitimate developer and product use, so boundary inspection cannot distinguish benign developer prompts from C2-encoded prompts. See SC-7 entry in `data/framework-control-gaps.json` — real requirement is SDK-level prompt logging with identity binding, anomaly detection on prompt-shape and token-volume, and an allowlist that enumerates the sanctioned business reason per identity. Boundary-only SC-7 evidence is incomplete for any org with AI API access in production. |
+| AML.T0016 | ATLAS v2026.09 | Obtain Capabilities (generative AI): adversary use of public inference APIs to generate or refine malware, evasion and phishing payloads | PROMPTFLUX queries public LLMs to generate per-execution evasion code, and PROMPTSTEAL uses LLMs to prioritize exfiltration targets. Both consume public LLMs as a real-time capability service, so the inference API does weaponization work for the adversary. | NIST-800-53-SI-3 fails because there is no static signature for code a public LLM generates per event. NIST-800-53-SI-4 fails as commonly deployed because there is no AI-API behavioral baseline per process or identity. SC-7 boundary control treats the AI provider as allowlisted SaaS. |
 | T1071 | ATT&CK | Application Layer Protocol (C2) | AI C2 traffic is standard HTTPS REST to api.openai.com or equivalent. Application-protocol C2 detection that looks for DGA, unusual TLS, or beaconing does not fire. | SC-7 boundary control sees only the destination domain (allowlisted) — no protocol anomaly to alert on. Detection requires identity-bound prompt content inspection, which SC-7 as written does not require. |
 | T1102 | ATT&CK | Web Service (C2 via legitimate web service) | AI API endpoints are exactly the "legitimate web service used as C2" pattern that T1102 describes — but at scale and pre-allowlisted in nearly every enterprise. | SOC 2 CC7 anomaly-detection control: AI API traffic shares the SaaS blind spot — typically not baselined per process or identity. ISO 27001 A.8.16 monitoring activities: no guidance for AI-API-shaped traffic. |
 | T1568 | ATT&CK | Dynamic Resolution | AI provider responses can carry encoded instructions that dynamically determine the next-hop behaviour for the malware (effectively model-mediated dynamic resolution of the next attacker instruction). | No standard DNS-tunnelling or DGA detection applies — the "resolution" happens inside an HTTPS payload to a trusted endpoint. SC-7 cannot see it without SDK-level prompt + response logging. |
@@ -407,7 +406,7 @@ For each flagged identity from Steps 2–4, pull the corresponding host-event ti
 
 ### Step 7: Produce findings
 
-For every identity flagged in Step 2, every prompt flagged in Step 3, every SesameOp shape match in Step 4, and every correlation in Step 6, write a finding mapped to AML.T0096 / AML.T0017 / T1071 / T1102 / T1568 with the specific evidence and the SC-7 / SI-3 / SI-4 / CC7 / A.8.16 gap that allowed it to land.
+For every identity flagged in Step 2, every prompt flagged in Step 3, every SesameOp shape match in Step 4, and every correlation in Step 6, write a finding mapped to AML.T0096 / AML.T0016 / T1071 / T1102 / T1568 with the specific evidence and the SC-7 / SI-3 / SI-4 / CC7 / A.8.16 gap that allowed it to land.
 
 ---
 

package/skills/ai-risk-management/skill.md

@@ -29,6 +29,7 @@ atlas_refs:
   - AML.T0051
   - AML.T0096
   - AML.T0017
+  - AML.T0013
 attack_refs: []
 framework_gaps:
   - ISO-IEC-42001-2023-clause-6.1.2
@@ -68,7 +69,7 @@ AI governance moved from voluntary to mandatory between 2024 and 2026. The trans
 
 The gap on the ground is severe and the same in every jurisdiction the maintainers have spot-checked through Q2 2026: most organisations deploying LLMs, agents, RAG pipelines, and AI-augmented developer tooling have **zero governance artefact specific to AI**. They assume general security policies, the existing risk register, the existing vendor management programme, and the existing incident response playbook cover AI by inheritance. They do not. Concretely:
 
-- The risk register has no entry for prompt injection (AML.T0051), AI-as-C2 (AML.T0096), or AI-assisted exploit development against the organisation (AML.T0016 + AML.T0017).
+- The risk register has no entry for prompt injection (AML.T0051), AI-as-C2 (AML.T0096), or AI-assisted exploit development against the organisation (AML.T0017).
 - The vendor management programme treats AI providers as ordinary SaaS suppliers and accepts a SOC 2 Type II as evidence of AI-specific control adequacy — even though SOC 2 has no AI-specific criteria.
 - The incident response playbook does not enumerate AI-specific incident classes (model exfiltration, training-data poisoning, agent compromise via MCP server, RAG corpus contamination, AI vendor breach affecting derived embeddings).
 - The data inventory does not include vector embedding stores, model weights, or LLM prompt/response logs as classified data assets.
@@ -117,9 +118,9 @@ Governance failure surfaces as exploitable threat. The TTPs below are the diagno
 | ATLAS ID | Technique | Governance failure that exposes it | Where the gap appears in the AIMS |
 |---|---|---|---|
 | AML.T0051 | LLM Prompt Injection | No prompt/response logging, no semantic monitoring, no AI use-case-level risk treatment decision | ISO/IEC 23894 clause 7 risk treatment register has no entry; OWASP LLM01 control unowned. CWE-1426 (improper validation of generative AI output) is the root-cause class. |
-| AML.T0096 | LLM Integration Abuse (covert C2) | No baseline of normal AI API traffic per principal; AI API egress treated as trusted internal traffic | NIST AI RMF MEASURE 2.5 not operationalised; SesameOp-class detection absent from SOC playbooks. |
-| AML.T0017 | Discover ML Model Ontology — adversary reconnaissance of deployed model family / guardrails | No inference-API rate / shape baseline; model-registry RBAC absent; system-prompt extraction queries undetected | NIST AI RMF MEASURE 2.5 not requiring per-identity inference monitoring; AIMS lacks a probing-detection control. |
-| AML.T0016 | Obtain Capabilities: Develop Capabilities (adversary AI-assisted exploit / payload development) | No threat-intelligence ingestion path for AI-discovered vulnerabilities; patch SLAs sized for human-speed exploit development | EU AI Act Art. 9 RMS not iterating on the input that 41% of 2025 zero-days are AI-discovered (per `ai-attack-surface` and `zeroday-lessons.json`). |
+| AML.T0096 | AI Service API (covert C2) | No baseline of normal AI API traffic per principal; AI API egress treated as trusted internal traffic | NIST AI RMF MEASURE 2.5 not operationalised; SesameOp-class detection absent from SOC playbooks. |
+| AML.T0013 | Discover AI Model Ontology: adversary reconnaissance of deployed model family / guardrails | No inference-API rate / shape baseline; model-registry RBAC absent; system-prompt extraction queries undetected | NIST AI RMF MEASURE 2.5 not requiring per-identity inference monitoring; AIMS lacks a probing-detection control. |
+| AML.T0017 | Develop Capabilities (adversary AI-assisted exploit / payload development) | No threat-intelligence ingestion path for AI-discovered vulnerabilities; patch SLAs sized for human-speed exploit development | EU AI Act Art. 9 RMS not iterating on the input that 41% of 2025 zero-days are AI-discovered (per `ai-attack-surface` and `zeroday-lessons.json`). |
 
 Supporting weakness classes consumed from `data/cwe-catalog.json`:
 - **CWE-1426** — improper validation of generative AI output. The governance correlate: every AI use case must declare what output validation is performed and who owns it.
@@ -140,7 +141,7 @@ Adversary capability versus organisational governance maturity is the relevant a
 |---|---|---|---|
 | Low (off-the-shelf prompt injection per AML.T0051) | Exploitable today. Bypass rates >85% against SOTA defences (per `ai-attack-surface`). No detection. | Exploitable. Risk register names the threat; no detection or response capability deployed. | Detection latency: minutes-to-hours. Response playbook bound to incident class. |
 | Medium (AI-as-C2 per AML.T0096, SesameOp pattern) | Exploited last quarter by definition — no AI API logging, no baseline. | Detection-blind: AI traffic logged but no behavioural baseline. | Behavioural baseline + correlation with host activity per `ai-attack-surface` Step 4. |
-| High (AI-assisted exploit development per AML.T0016, Copy Fail-class) | Patch SLA structurally inadequate; live-patch capability absent. | Patch SLA sized for human-speed exploit development. | RWEP-driven prioritisation (`lib/scoring.js`), live-patch SLA <4h for KEV+PoC+AI-discovered class. |
+| High (AI-assisted exploit development per AML.T0017, Copy Fail-class) | Patch SLA structurally inadequate; live-patch capability absent. | Patch SLA sized for human-speed exploit development. | RWEP-driven prioritisation (`lib/scoring.js`), live-patch SLA <4h for KEV+PoC+AI-discovered class. |
 | Frontier (training pipeline poisoning, supply-chain compromise of model weights — AML.T0020 catalogue) | No AI supplier risk register; vendor SOC 2 accepted as adequate. | AI vendor register exists; no 4th-party (AI-of-AI) coverage. | EU AI Act Art. 10 data governance + Art. 72 adversarial testing operationalised; vendor adversarial-test attestations required contractually. |
 
 Reference incident inputs to the matrix: vendor advisories from Anthropic, OpenAI, Google DeepMind, Microsoft across 2024–2026; the emergent agentic-attack patterns observed through 2025–2026 disclosed in coordinated-vulnerability programmes per `coordinated-vuln-disclosure`; the AI-as-C2 evidence base referenced in `ai-c2-detection`; the prompt-injection-RCE and MCP-RCE CVE evidence referenced in `ai-attack-surface`.

package/skills/api-security/skill.md

@@ -26,7 +26,7 @@ data_deps:
   - rfc-references.json
 atlas_refs:
   - AML.T0096
-  - AML.T0017
+  - AML.T0013
 attack_refs:
   - T1190
   - T1078
@@ -82,7 +82,7 @@ APIs are now the integration substrate of every non-trivial system. The mid-2026
 
 1. **AI-API rate-limit abuse / denial-of-wallet** — a stolen API key or compromised internal service burns the organisation's spend cap on a model endpoint. GPT-class and Claude-class token costs at production volume run to five-to-six figures per day per workload — a key exfiltrated on Friday and abused over a weekend is a real budget event.
 2. **Prompt-injection-as-C2** — user-controlled content reaches an LLM-fronted internal API and exfiltrates data through the model's response channel (the model becomes the covert C2 channel). Hand-off to `ai-c2-detection` for SesameOp-class detection patterns.
-3. **Model extraction via inference rate (AML.T0017 — Discover ML Model Ontology)** — high-volume queries against a hosted model are used to reconstruct the model's behaviour, system prompt, guardrail surface, or training-data signal. Detected at egress only by per-identity rate-and-shape monitoring, not by request count alone.
+3. **Model extraction via inference rate (AML.T0013, Discover AI Model Ontology)** — high-volume queries against a hosted model are used to reconstruct the model's behaviour, system prompt, guardrail surface, or training-data signal. Detected at egress only by per-identity rate-and-shape monitoring, not by request count alone.
 
 **MCP transport runs over HTTP/SSE.** Anthropic's **Model Context Protocol** (MCP) — the de-facto agent-to-tool protocol adopted across the industry through 2025 — uses HTTP and Server-Sent Events as its transport. That means MCP traffic is API traffic and inherits every API attack surface: auth, rate limiting, schema validation, BOLA on tool calls, SSRF if a tool fetches URLs. Hand-off to `mcp-agent-trust` for MCP-specific semantics; the API-security posture is foundational.
 
@@ -121,7 +121,7 @@ APIs are now the integration substrate of every non-trivial system. The mid-2026
 | UK NCSC CAF | Principle B2 (Identity and Access Control), B4 (System Security), C1 (Security Monitoring) | Outcome-based assessment. CAF outcomes are silent on BOLA / BFLA / BOPLA as testable surfaces and silent on AI-API egress baselining. An organisation can achieve CAF outcomes at Achieved level with zero per-object authorisation testing and zero AI-API consumer monitoring. NCSC API Security Guidance (2024) recommends per-object scoping but is not a CAF outcome statement. |
 | UK FCA / PRA SS1/21 (Operational Resilience) + CBEST | Important Business Service tolerance + threat-led pen testing | CBEST scenario libraries lag adversary capability 12-18 months and rarely include BOLA/BFLA-by-AI-agent or AI-API-as-C2 test cases. An FCA-attested operational-resilience programme can be "compliant" with zero exercised coverage of agentic API exploitation. |
 | AU ASD Essential 8 | Strategy: Restrict Administrative Privileges + Application Control + MFA | None of the eight strategies address API-level authorisation (per-object scoping, per-field scoping) or AI-API egress monitoring. Essential 8 ML3 attestation does not bind any API security control surface. |
-| AU ASD ISM | ISM-1228 (event log monitoring) + ISM-1546 (MFA on privileged access) + ISM-1808 (cloud consumer responsibilities) | Event-log monitoring assumes traditional indicators; BOLA / BFLA exploitation produces authenticated, authorised log entries with attacker-supplied object IDs. ISM-1808 cloud-consumer language does not address AI-API consumer scope. |
+| AU ASD ISM | ISM-1817 (authentication and authorization of clients calling internet-facing network APIs) + ISM-1228 (event analysis) + ISM-1569 (shared responsibility model with suppliers) | ISM-1817 requires authorization as well as authentication, but at the level of the client and the API, not of each object a request names, so BOLA / BFLA exploitation passes it and produces authenticated, authorized log entries with attacker-supplied object IDs that ISM-1228 event analysis sees as normal. ISM-1569's shared responsibility model does not assign object-level authorization in a consumed AI API to either party. |
 | AU APRA CPS 234 + CPS 230 | Para 27 (information security capability) + CPS 230 ICT-service-provider obligations | "Proportional capability" language. APRA-regulated entities meet CPS 234 attestation with traditional API gateway + WAF posture; per-object authorisation testing depth and AI-API consumer monitoring are not examined capability classes. CPS 230 third-party-arrangements obligations do not enumerate AI-API providers as in-scope material service providers. |
 
 ---
@@ -133,10 +133,10 @@ APIs are now the integration substrate of every non-trivial system. The mid-2026
 | T1190 | Exploit Public-Facing Application | Direct exploit of an exposed API endpoint — BOLA via mutated object ID, SSRF via "fetch URL" parameter, mass-assignment via injected JSON field | CWE-287, CWE-862, CWE-863, CWE-918, CWE-1188 | Partial — ASVS V13 covers REST; gaps for GraphQL/gRPC/WebSocket specifics and per-object scoping |
 | T1078 | Valid Accounts | Stolen API token / OAuth refresh token / leaked service-account key reused against the API; key-exfil-then-abuse pattern dominant for AI-API rate-limit abuse | CWE-287, CWE-200 | Partial — NIST-800-53-AC-2 manages account lifecycle but not per-object authz, not key rotation cadence for AI-API keys |
 | T1567 | Exfiltration Over Web Service | Sensitive data egressed via a legitimate API channel — AI-API response stream as covert C2; OAuth-token-scoped exfil over the org's own API | CWE-200, CWE-918 | Missing — no framework mandates per-identity egress baselining; D3-NTA is the operational control (see Defensive Countermeasure Mapping) |
-| AML.T0096 | AI Service Exploitation (AI-API as covert C2) | LLM API used as a covert command-and-control / exfil channel — prompt content carries instructions; response carries staged data | CWE-77, CWE-200 | Missing in NIST/ISO; hand-off to `ai-c2-detection` |
-| AML.T0017 | Discover ML Model Ontology (inference-API probing for system-prompt, guardrail, model-family signal) | High-volume queries against a hosted model used to reconstruct behaviour, guardrail surface, or training-data signal | CWE-200 | Missing — detected only by per-identity rate-and-shape monitoring at egress |
+| AML.T0096 | AI Service API (AI-API as covert C2) | LLM API used as a covert command-and-control / exfil channel — prompt content carries instructions; response carries staged data | CWE-77, CWE-200 | Missing in NIST/ISO; hand-off to `ai-c2-detection` |
+| AML.T0013 | Discover AI Model Ontology (inference-API probing for system-prompt, guardrail, model-family signal) | High-volume queries against a hosted model used to reconstruct behaviour, guardrail surface, or training-data signal | CWE-200 | Missing — detected only by per-identity rate-and-shape monitoring at egress |
 
-CWE root-causes referenced as a set (per `cwe_refs` in frontmatter, all resolved against `data/cwe-catalog.json`): CWE-287 (Improper Authentication), CWE-862 (Missing Authorization — BFLA root cause), CWE-863 (Incorrect Authorization — BOLA root cause), CWE-918 (SSRF — API7), CWE-200 (Information Exposure — BOPLA contributor), CWE-352 (CSRF — cookie-auth APIs + WebSocket CSWSH), CWE-22 (Path Traversal — API parameter sinks), CWE-77 (Command Injection — API parameter to shell), CWE-1188 (Insecure Default Initialization — default-open API state). ATT&CK Enterprise techniques (T1190, T1078, T1567) resolve against `data/attack-techniques.json`; the AML.T0096 (AI service exploitation) and AML.T0017 (model-ontology discovery) entries resolve against `data/atlas-ttps.json`. Cross-reference every BOLA / BFLA finding against the `CWE-863` / `CWE-862` entries in `data/cwe-catalog.json` for the canonical weakness description used in operator briefings.
+CWE root-causes referenced as a set (per `cwe_refs` in frontmatter, all resolved against `data/cwe-catalog.json`): CWE-287 (Improper Authentication), CWE-862 (Missing Authorization — BFLA root cause), CWE-863 (Incorrect Authorization — BOLA root cause), CWE-918 (SSRF — API7), CWE-200 (Information Exposure — BOPLA contributor), CWE-352 (CSRF — cookie-auth APIs + WebSocket CSWSH), CWE-22 (Path Traversal — API parameter sinks), CWE-77 (Command Injection — API parameter to shell), CWE-1188 (Insecure Default Initialization — default-open API state). ATT&CK Enterprise techniques (T1190, T1078, T1567) resolve against `data/attack-techniques.json`; the AML.T0096 (AI service API) and AML.T0013 (model-ontology discovery) entries resolve against `data/atlas-ttps.json`. Cross-reference every BOLA / BFLA finding against the `CWE-863` / `CWE-862` entries in `data/cwe-catalog.json` for the canonical weakness description used in operator briefings.
 
 ---
 
@@ -156,7 +156,7 @@ CWE root-causes referenced as a set (per `cwe_refs` in frontmatter, all resolved
 | API10 Unsafe Consumption of Third-Party APIs | Burp, custom integration fuzz | Egress allowlist; per-third-party threat model | Yes — agentic frameworks chain via third-party trust | Variable; transitive RCE chains via consumed AI-API or SaaS API are high | Emergent class through 2025–2026; AI-API consumption dominant subtype |
 | AI-API rate-limit abuse / denial-of-wallet | Stolen-key abuse scripts; trivial automation | Per-identity + per-cost-unit egress quotas; budget alarms | Yes — fully automated | Direct USD loss — measurable per incident | High when keys leak; common via committed secrets, third-party breach, browser-extension exfil |
 | AML.T0096 prompt-injection-as-C2 | Custom payload corpora; Promptfoo, Garak | Output guardrails, egress baselining (D3-NTA) | Yes — adaptive injection succeeds >85% against SOTA guardrails per 2026 meta-analysis | Emergent category | Active operational reality; hand-off to `ai-c2-detection` |
-| AML.T0017 Discover ML Model Ontology (inference-API probing) | High-volume inference scripts; query-shape diversity tooling | Per-identity rate-and-shape monitoring at egress | Yes — agentic query diversification | Emergent | Active in adversarial-ML research; bleeding into production where hosted models expose probability vectors |
+| AML.T0013 Discover AI Model Ontology (inference-API probing) | High-volume inference scripts; query-shape diversity tooling | Per-identity rate-and-shape monitoring at egress | Yes — agentic query diversification | Emergent | Active in adversarial-ML research; bleeding into production where hosted models expose probability vectors |
 
 ---
 
@@ -206,7 +206,7 @@ Wire-level RFC mappings cited below resolve against `data/rfc-references.json` (
 7. **GraphQL query-complexity limits.** Depth limit, breadth (alias) limit, complexity-cost calculator with budget per query, persisted-query allowlist for production clients. **Introspection disabled in production.**
 8. **gRPC reflection disabled in production.** mTLS for service-to-service; per-method authorisation (BFLA in gRPC terms is per-method); deadline propagation enforced; max-message-size bounded.
 9. **WebSocket origin validation at upgrade + CSRF / sender-constrained token thereafter.** Per-message authorisation if the channel multiplexes operations across resources; rate-limit per connection AND per identity (one identity cannot fan out across many connections to bypass).
-10. **MCP transport audit (hand-off to `mcp-agent-trust`) and AI-API egress map (hand-off to `ai-c2-detection`).** Document every MCP server and every AI-API destination. Per-destination quota with explicit USD cap; per-identity rate-and-shape baseline; D3-NTA egress monitoring fed to SIEM. AI-API keys treated as the most sensitive credential class — rotation cadence ≤ 30 days, automated key-leak scanning on commits. The egress map cross-references the AML.T0096 / AML.T0017 catalog entries in `data/atlas-ttps.json` so that egress-baseline rules can be authored against the canonical TTP IDs rather than ad-hoc local names.
+10. **MCP transport audit (hand-off to `mcp-agent-trust`) and AI-API egress map (hand-off to `ai-c2-detection`).** Document every MCP server and every AI-API destination. Per-destination quota with explicit USD cap; per-identity rate-and-shape baseline; D3-NTA egress monitoring fed to SIEM. AI-API keys treated as the most sensitive credential class — rotation cadence ≤ 30 days, automated key-leak scanning on commits. The egress map cross-references the AML.T0096 / AML.T0013 catalog entries in `data/atlas-ttps.json` so that egress-baseline rules can be authored against the canonical TTP IDs rather than ad-hoc local names.
 
 ---
 

package/skills/attack-surface-pentest/skill.md

@@ -132,7 +132,7 @@ Pen testers must emulate both classical and AI-class chains. The table below map
 | Initial Access | T1133 (External Remote Services) | AML.T0010 (AI Supply Chain Compromise) — malicious MCP server installed by developer | PTES scoping templates do not require MCP server enumeration |
 | Execution | T1059 (Command and Scripting Interpreter) | AML.T0051 → tool-use call invoking shell/code execution in agent context | NIS2 Art.21 patch-mgmt language assumes binary exploit; semantic-input exploit lives outside |
 | Persistence | T1078 (Valid Accounts) | AML.T0018 / AML.T0010 — poisoned dependency planting valid creds | TIBER-EU scenario libraries lag this by 12–18 months |
-| Command and Control | T1071 (Application Layer Protocol) | AML.T0096 (LLM Integration Abuse — AI API as C2, SesameOp pattern) | No major framework defines a control for AI-API egress as C2 |
+| Command and Control | T1071 (Application Layer Protocol) | AML.T0096 (AI Service API, AI API as C2, SesameOp pattern) | No major framework defines a control for AI-API egress as C2 |
 | Exfiltration | T1041 (Exfil Over C2 Channel) | AML.T0043 (Craft Adversarial Data) → vector-store retrieval forced to surface proprietary chunks | RAG corpus is not enumerated in classical ASM |
 | Defense Evasion | T1027 (Obfuscated Files or Information) | AML.T0051 with adaptive payload generation per attempt | Pen test reports that show "no anomalies" against AI-generated payloads understate evasion |
 

package/skills/cloud-iam-incident/skill.md

@@ -42,7 +42,7 @@ framework_gaps:
   - SOC2-CC6-Access-Key-Leak-Public-Repo
   - AWS-Security-Hub-Coverage-Gap
   - UK-CAF-B2-Cloud-IAM
-  - AU-ISM-1546-Cloud-Service-Account
+  - AU-ISM-1685-Cloud-Service-Account
 rfc_refs:
   - RFC-8693
   - RFC-7519
@@ -129,7 +129,7 @@ The playbook `cloud-iam-incident` operationalises this skill into a seven-phase
 | DORA | Art. 6-9 — ICT Risk-Management Framework | Identify, protect, detect, respond, and recover for ICT risk | Principle-based. Cloud-IAM specifics are not enumerated in the binding articles; ESAs may publish Level-2/3 guidance over time. |
 | UK CAF | B2 — Identity and Access Control | Outcome that access to networks and information systems is controlled in line with the essential function's risk | Outcome-based on credential-lifecycle hygiene. Cloud-IAM specifics not enumerated against B2 evidence. Captured in `data/framework-control-gaps.json#UK-CAF-B2-Cloud-IAM`. |
 | AU Essential 8 | Strategy 4 — Multi-Factor Authentication (E8 M.4) | MFA on privileged and internet-facing accounts | Covers human-principal MFA. Cloud service-account access keys, OIDC federation tokens, and SAML assertions are bearer credentials that bypass MFA. |
-| AU ISM | ISM-1546 — MFA for privileged users and remote access | AU-government information-security baseline | Covers human-principal MFA. Cloud non-human principals out of scope. Captured in `data/framework-control-gaps.json#AU-ISM-1546-Cloud-Service-Account`. |
+| AU ISM | ISM-1685 (credentials for break glass, local administrator and service accounts are long, unique, unpredictable and managed) and ISM-1173 (MFA for privileged users) | AU-government information-security baseline | ISM-1173 covers human privileged users only. ISM-1685 covers service-account credentials, but a long, unique cloud access key still works from anywhere once it leaks, and platform-issued managed-identity tokens have no credential for the organization to manage. Captured in `data/framework-control-gaps.json#AU-ISM-1685-Cloud-Service-Account`. |
 | PCI DSS 4.0 | Req. 7-8 — Access Control + Identification | Access-control objectives generically | Cloud-IAM-specific requirements not enumerated. |
 | HIPAA | 164.312(a)(1) — Access Control | Technical safeguard for ePHI access | Generic access-control framing. Cloud-IAM specifics out of scope. |
 | AWS Security Hub | Foundational Security Best Practices | AWS-native posture tool | Coverage-based. Findings reflect configuration drift, not behavioural compromise. Captured in `data/framework-control-gaps.json#AWS-Security-Hub-Coverage-Gap`. |

package/skills/cloud-security/skill.md

@@ -24,6 +24,7 @@ data_deps:
 atlas_refs:
   - AML.T0010
   - AML.T0017
+  - AML.T0013
 attack_refs:
   - T1078
   - T1530
@@ -132,7 +133,7 @@ Cloud is where AI runs. Every consequential AI service — OpenAI, Anthropic, Go
 | Cloud-facing application | T1190 — Exploit Public-Facing Application | ATT&CK Enterprise | API Gateway / Load Balancer / managed-WAF-bypass; managed-database exposure (RDS / SQL DB / Cloud SQL public IP); container-registry public image abuse; Lambda / Cloud Functions / Azure Functions endpoint exploit | NIST 800-53 SC-7 perimeter assumption inadequate; CSA CCM AIS-04 and IVS-08 partial; CWE-1188 (Insecure Default Initialization) |
 | Cloud-credential exposure | T1552 — Unsecured Credentials (incl. T1552.001 Files, T1552.005 Cloud Instance Metadata API, T1552.007 Container API) | ATT&CK Enterprise | IMDSv1 SSRF on EC2 / GCE; static cloud credentials in git / images / env vars; container API and kubeconfig theft; workload-identity-federation trust-policy abuse | CWE-798 (hardcoded credentials), CWE-200; NIST 800-53 IA-5 method-neutral |
 | AI model registry / cloud-hosted model | AML.T0010 — AI Supply Chain Compromise | ATLAS v2026.09 | Bedrock / SageMaker custom model from poisoned upstream; Azure ML model registry tampering; Vertex Model Garden mirror tampering; HF model pulled into Bedrock / SageMaker / Vertex with weights backdoor | CSA CCM CCC-09 (vendor / supply chain) silent on model-supply-chain specifics; SLSA / in-toto / Sigstore for models still maturing |
-| Cloud inference API abuse / model extraction | AML.T0017 — Discover ML Model Ontology (inference-API probing for system-prompt, guardrail, model-family signal against cloud-hosted endpoints); AML.T0016 — Obtain Capabilities: Develop Capabilities (downstream weaponization) | ATLAS v2026.09 | Programmatic query of Bedrock / Azure OpenAI / Vertex endpoint to extract model behaviour, training-data inference, system-prompt leakage | No cloud-specific ATLAS control mapping for inference-API rate-limit / anomaly detection; chain to `ai-attack-surface` |
+| Cloud inference API abuse / model extraction | AML.T0013, Discover AI Model Ontology (inference-API probing for system-prompt, guardrail, model-family signal against cloud-hosted endpoints); AML.T0017, Develop Capabilities (downstream weaponization) | ATLAS v2026.09 | Programmatic query of Bedrock / Azure OpenAI / Vertex endpoint to extract model behaviour, training-data inference, system-prompt leakage | No cloud-specific ATLAS control mapping for inference-API rate-limit / anomaly detection; chain to `ai-attack-surface` |
 
 **Note on ATT&CK Enterprise cloud-platform sub-techniques.** ATT&CK Enterprise has cloud-platform-specific matrices (IaaS, SaaS, Office 365, Azure AD / Entra ID, Google Workspace). T1078.004 (Cloud Accounts), T1552.005 (Cloud Instance Metadata API), T1552.007 (Container API), T1190 with cloud-service variants, T1530 with managed-storage variants are the most operationally relevant. The frontmatter pins the parent IDs; analysis should descend to the sub-technique appropriate to the cloud(s) in scope.
 

package/skills/compliance-theater/skill.md

@@ -87,10 +87,10 @@ Each theater pattern below maps to one or more attacker TTPs in `data/atlas-ttps
 | Patch Management Theater (Pattern 1) | T1068 (Exploitation for Privilege Escalation), T1203 (Exploitation for Client Execution) | Public PoC + KEV + AI-accelerated weaponization compresses the exploitation window inside the SLA |
 | Network Segmentation Theater — IPsec (Pattern 2) | T1190 (Exploit Public-Facing Application) targeting the IPsec kernel subsystem | The control's cryptographic mechanism is the attack surface |
 | Access Control Theater — AI Agents (Pattern 3) | AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak), T1059 (Command and Scripting Interpreter) | Authorized service account executes attacker-chosen actions; no identity boundary is crossed |
-| Incident Response Theater — AI Pipeline (Pattern 4) | AML.T0020 (Training Data Poisoning), AML.T0096 (LLM Integration Abuse as C2), AML.T0010 (AI Supply Chain Compromise) | Detection triggers do not exist, so documented IR procedures have no input |
+| Incident Response Theater — AI Pipeline (Pattern 4) | AML.T0020 (Training Data Poisoning), AML.T0096 (AI Service API as C2), AML.T0010 (AI Supply Chain Compromise) | Detection triggers do not exist, so documented IR procedures have no input |
 | Change Management Theater — AI Models (Pattern 5) | AML.T0018 (Manipulate AI Model), AML.T0020 | Externally-managed model updates bypass operator change control entirely |
 | Vendor/Third-Party Risk Theater — AI APIs (Pattern 6) | AML.T0010 (AI Supply Chain Compromise) | MCP servers and LLM APIs sit outside the vendor-management scope |
-| Security Awareness Theater — AI Phishing (Pattern 7) | T1566 (Phishing), AML.T0016 (Obtain Capabilities: Develop Capabilities — misuse of public AI APIs for payload crafting) | AI-generated content evades grammar/style heuristics and template-matching detectors |
+| Security Awareness Theater — AI Phishing (Pattern 7) | T1566 (Phishing), AML.T0016 (Obtain Capabilities, misuse of public AI APIs for payload crafting) | AI-generated content evades grammar/style heuristics and template-matching detectors |
 
 Source-of-truth TTP catalog: `data/atlas-ttps.json` (pinned to MITRE ATLAS v2026.09, September 2026). Any theater claim in an assessment must cite at least one TTP ID from that catalog or an ATT&CK Enterprise ID — claims without a mapped TTP are orphaned controls and are rejected.
 
@@ -394,10 +394,10 @@ This skill produces theater findings, not control prescriptions. The mapping bel
 | 1 Patch Management (CISA KEV SLA breach) | T1068 (Exploitation for Privilege Escalation) | `D3-KBPI` + `D3-SCA` | Kernel-Based Process Isolation + System Call Analysis | `kernel-lpe-triage` |
 | 2 Network Segmentation (IPsec compromised subsystem) | T1190 (Exploit Public-Facing Application) | `D3-NI` | Network Isolation (non-IPsec data path) | `framework-gap-analysis` (SC-8 / SC-28 lag) |
 | 3 Access Control (AI agent prompt injection) | AML.T0051 (LLM Prompt Injection) | `D3-IOPR` + `D3-CSPP` | Input/Output Profiling + Client-server Payload Profiling | `ai-attack-surface` |
-| 4 Incident Response (AI-specific playbook absence) | AML.T0096 (LLM Integration Abuse — C2), AML.T0051 | `D3-NTA` + `D3-IOPR` | Network Traffic Analysis + Input/Output Profiling | `ai-c2-detection` + `incident-response-playbook` |
+| 4 Incident Response (AI-specific playbook absence) | AML.T0096 (AI Service API, C2), AML.T0051 | `D3-NTA` + `D3-IOPR` | Network Traffic Analysis + Input/Output Profiling | `ai-c2-detection` + `incident-response-playbook` |
 | 5 Change Management (Model version drift) | AML.T0018 (Manipulate AI Model), AML.T0020 (Training Data Poisoning) | `D3-FAPA` + `D3-EFA` | File Access Pattern Analysis + Executable File Analysis | `mlops-security` |
 | 6 Vendor Management (AI APIs + MCP servers without DPA) | AML.T0010 (AI Supply Chain Compromise) | `D3-EAL` + `D3-EFA` | Executable Allowlisting + Executable File Analysis | `mcp-agent-trust` + `supply-chain-integrity` |
-| 7 Security Awareness (AI-generated phishing absent from simulations) | AML.T0016 (Develop Capabilities — payload generation), T1566 (Phishing) | `D3-MFA` + `D3-CSPP` | Multi-factor Authentication (passkey class) + Client-server Payload Profiling (gateway) | `email-security-anti-phishing` + `identity-assurance` |
+| 7 Security Awareness (AI-generated phishing absent from simulations) | AML.T0016 (Obtain Capabilities, payload generation), T1566 (Phishing) | `D3-MFA` + `D3-CSPP` | Multi-factor Authentication (passkey class) + Client-server Payload Profiling (gateway) | `email-security-anti-phishing` + `identity-assurance` |
 
 **Defense-in-depth posture:** every theater finding produced by this skill must cite the downstream skill that owns the remediation. A theater finding with no routing target is incomplete — the operator receives a gap with no closure path. Where a theater pattern names multiple D3FEND techniques, the downstream skill is the authority on which combinations satisfy defence-in-depth for the operator's environment.
 

package/skills/coordinated-vuln-disclosure/skill.md

@@ -106,7 +106,7 @@ This skill is meta — it is the upstream input pipeline that feeds the downstre
 |---|---|
 | `data/cve-catalog.json` | **Downstream product.** Every CVE in this catalog is the output of a CVD process (someone's, somewhere). When this org receives a report covering one of its own products, the resulting CVE enters this catalog via the same schema. |
 | `data/zeroday-lessons.json` | **Downstream consumer.** Every disclosed CVE feeds the zero-day learning loop run by `zeroday-gap-learn`. A CVD program with no entries here is not learning from its own disclosures. |
-| `data/atlas-ttps.json` (MITRE ATLAS v2026.09) | **Lookup for AI-class disclosures.** When a report covers an AI vulnerability, map the attack mechanism to an ATLAS TTP (e.g., AML.T0051 LLM Prompt Injection, AML.T0096 LLM Plugin Compromise) for advisory tagging. |
+| `data/atlas-ttps.json` (MITRE ATLAS v2026.09) | **Lookup for AI-class disclosures.** When a report covers an AI vulnerability, map the attack mechanism to an ATLAS TTP (e.g., AML.T0051 LLM Prompt Injection, AML.T0110 AI Agent Tool Poisoning) for advisory tagging. |
 | `data/framework-control-gaps.json` | **Lookup for regulator-notification routing.** Each disclosure intersects one or more framework controls; this skill writes new gaps when a disclosure exposes one. |
 | `data/cwe-catalog.json` | **Required taxonomy for advisories.** Per CVE-Numbering-Authority practice, every CVE advisory cites a CWE. `CWE-1357 Reliance on Insufficiently Trustworthy Component` is invoked for supply-chain disclosures (MCP servers, AI dependencies); other CWEs per the specific class. |
 | `data/d3fend-catalog.json` | **Defensive mapping for advisory recommendations.** Advisories that recommend mitigations should cite D3FEND IDs so blue teams can map the recommendation to existing control surfaces. See Defensive Countermeasure Mapping section. |

package/skills/decompression-dos/skill.md

@@ -36,7 +36,7 @@ framework_gaps:
   - NIST-800-53-SI-2
   - NIS2-Art21-network-security
   - UK-CAF-B4
-  - AU-ISM-1556
+  - AU-ISM-1240
 cwe_refs:
   - CWE-409
   - CWE-1333

package/skills/dlp-gap-analysis/skill.md

@@ -26,7 +26,7 @@ data_deps:
   - global-frameworks.json
 atlas_refs:
   - AML.T0096
-  - AML.T0017
+  - AML.T0024
   - AML.T0051
 attack_refs:
   - T1567
@@ -128,8 +128,8 @@ A DLP gap analysis that maps only to NIST 800-53 SC-7, ISO 27001:2022 A.8.16, HI
 
 | ID | Source | Technique | DLP Relevance | Gap Flag — Which DLP Control Fails |
 |---|---|---|---|---|
-| AML.T0096 | ATLAS v2026.09 | AI API as Covert C2 Channel | Direct: prompt and completion bodies as covert exfil. The same SesameOp pattern that is a C2 channel is also a DLP exfil channel — prompts encode payloads against allowlisted AI provider domains. Cross-references `DLP-CHAN-LLM-PROMPT` and `DLP-CHAN-LLM-CONTEXT` in `data/dlp-controls.json`. | Legacy email/web/USB DLP (`DLP-CHAN-EMAIL-OUT`, `DLP-CHAN-WEB-UPLOAD`, `DLP-CHAN-USB-REMOVABLE`) sees nothing. AI-aware DLP (`DLP-CHAN-LLM-PROMPT`) is the only effective control category. SC-7 boundary controls allowlist the AI provider domain — no protocol or destination anomaly fires. |
-| AML.T0017 | ATLAS v2026.09 | Discover ML Model Ontology | Indirect but DLP-relevant: model inversion and membership-inference attacks against embedding stores and fine-tuned models extract training-corpus content (which is itself a protected surface — see `DLP-SURFACE-TRAINING-DATA`, `DLP-SURFACE-EMBEDDING-STORE`). | No legacy DLP control category exists. Modern controls: embedding-similarity classification at retrieval boundary (`DLP-CLASS-EMBEDDING-MATCH`), differential-privacy fine-tuning, query-rate limits on inference APIs. None of these are named in any compliance framework. |
+| AML.T0096 | ATLAS v2026.09 | AI Service API | Direct: prompt and completion bodies as covert exfil. The same SesameOp pattern that is a C2 channel is also a DLP exfil channel — prompts encode payloads against allowlisted AI provider domains. Cross-references `DLP-CHAN-LLM-PROMPT` and `DLP-CHAN-LLM-CONTEXT` in `data/dlp-controls.json`. | Legacy email/web/USB DLP (`DLP-CHAN-EMAIL-OUT`, `DLP-CHAN-WEB-UPLOAD`, `DLP-CHAN-USB-REMOVABLE`) sees nothing. AI-aware DLP (`DLP-CHAN-LLM-PROMPT`) is the only effective control category. SC-7 boundary controls allowlist the AI provider domain — no protocol or destination anomaly fires. |
+| AML.T0024 | ATLAS v2026.09 | Exfiltration via AI Inference API | Indirect but DLP-relevant: model inversion and membership-inference attacks against embedding stores and fine-tuned models extract training-corpus content (which is itself a protected surface — see `DLP-SURFACE-TRAINING-DATA`, `DLP-SURFACE-EMBEDDING-STORE`). | No legacy DLP control category exists. Modern controls: embedding-similarity classification at retrieval boundary (`DLP-CLASS-EMBEDDING-MATCH`), differential-privacy fine-tuning, query-rate limits on inference APIs. None of these are named in any compliance framework. |
 | AML.T0051 | ATLAS v2026.09 | LLM Prompt Injection | Direct: prompt-injection-induced data extraction. A malicious document in a RAG corpus or a poisoned tool output (MCP) coerces the model into emitting protected content in a subsequent response. Cross-references `DLP-CHAN-LLM-CONTEXT` and `DLP-CHAN-MCP-TOOL-ARG`. | Egress-side classification on model output catches some cases but is fundamentally retroactive. Retrieval-time classification (`DLP-SURFACE-RAG-CORPUS`) and MCP tool-call argument inspection (`DLP-CHAN-MCP-TOOL-ARG`) are the primary controls. No compliance framework names either. |
 | T1567 | ATT&CK | Exfiltration Over Web Service | LLM and AI API endpoints are exactly the "legitimate web service used for exfil" pattern, pre-allowlisted in nearly every enterprise. | SC-7 sees only the destination domain (allowlisted). SDK-level prompt logging with identity binding is the only practical control. |
 | T1530 | ATT&CK | Data from Cloud Storage Object | Includes vector stores and model registries — embedding stores (Pinecone, Weaviate, Qdrant, pgvector, Vertex AI Matching Engine) and model artifacts in cloud object stores are 2026's high-value crown-jewel surface. See `DLP-SURFACE-EMBEDDING-STORE` and `DLP-SURFACE-TRAINING-DATA`. | Cloud DLP scanning of object stores is mature for files but not for vector indexes — index payloads are not classifiable as files. Vector-store-native ACL audit is the practical control. |

package/skills/exploit-scoring/skill.md

@@ -62,7 +62,7 @@ RWEP exists because the exploit development cycle has compressed. The factors th
 | UK NCSC CAF | Principle B4 (System Security) — vulnerability and patch management contributing outcomes | Outcome-based: "Vulnerabilities are identified and addressed appropriately" | Outcome language permits CVSS-only prioritization. No requirement to factor KEV listing, public-PoC availability, or AI-discovery into the remediation cadence. NCSC Vulnerability Management Guidance (2024) recommends but does not require exploit-availability weighting. |
 | UK Cyber Essentials Plus | Patch management criterion | Critical/High patches within 14 days | CVSS-anchored 14-day window. No factor for CISA KEV / public PoC. Tighter than NIST/PCI but still framework-lag-vulnerable for AI-accelerated 4-hour weaponization. |
 | AU ASD Essential 8 | Patch Operating Systems ML1–ML3 | ML3: 48h for OS vulns "with working exploit" | Closest to adequate — at least incorporates exploit availability. Still does not model AI-discovery, KEV, blast radius, or live-patch availability. 48h window remains long for AI-accelerated weaponization. |
-| AU ASD ISM | Control ISM-1493 (vulnerability management) + ISM-1144 (patching frequency) | Risk-based patching aligned to vendor severity / exploitability | "Exploitability" not operationalized as KEV / public-PoC / AI-discovery factors. Risk-based language permits CVSS-only ranking in practice. |
+| AU ASD ISM | ISM-1143 (patch management processes) + ISM-1876 and ISM-1877 (48-hour windows) | Patching timeframes keyed to the vendor's critical rating or a working exploit | A working exploit is the only exploitability factor the windows name; KEV listing, exploitation in the wild and AI-assisted discovery are not, and a vendor's "critical" rating is usually CVSS-derived. |
 | FedRAMP Continuous Monitoring | Vuln scan cadence + CVSS-band remediation | Monthly scans, CVSS-banded SLAs | Cadence-based detection plus CVSS-banded remediation cannot respond inside the AI-accelerated exploit window. |
 
 Across all of these, the framework lag is the same shape: **CVSS-as-risk-proxy.** RWEP is the operational corrective layer.
@@ -76,7 +76,7 @@ This skill is meta — it does not pin to a single TTP class. RWEP is the cross-
 | Catalog | Role for RWEP |
 |---|---|
 | `data/cve-catalog.json` | Source of factor values: CISA KEV flag, PoC availability, AI-discovery flag, active-exploitation status, patch and live-patch availability per CVE |
-| `data/atlas-ttps.json` (MITRE ATLAS v2026.09) | Provides the AI/ML TTP context where AI-discovery and AI-acceleration factors apply (e.g., AML.T0016 Obtain Capabilities: Develop Capabilities, AML.T0017 Discover ML Model Ontology) |
+| `data/atlas-ttps.json` (MITRE ATLAS v2026.09) | Provides the AI/ML TTP context where AI-discovery and AI-acceleration factors apply (e.g., AML.T0016 Obtain Capabilities, AML.T0017 Develop Capabilities) |
 | `data/exploit-availability.json` | Authoritative PoC + KEV + last-verified date snapshot — drives factor freshness |
 | `data/zeroday-lessons.json` | Closes the loop: zero-day's lesson entry feeds back the framework gap that RWEP's score implied |
 
@@ -378,7 +378,7 @@ RWEP scores priority; this section maps the priority bands to the D3FEND defensi
 | 50–74 | Exploit-likely class | `D3-FCR` | File Content Rules | Endpoint — content-based detection of exploit payloads in transit |
 | 25–49 (vendor patch available, no PoC) | Patchable, not yet weaponized | `D3-EAL` | Executable Allowlisting | Managed endpoint — reduce exposure surface during the routine-patch window |
 | 25–49 | Patchable | `D3-EI` | Execution Isolation | Endpoint / container — sandbox the vulnerable component until patch deploys |
-| AI-accelerated multiplier (any band with AML.T0016 capability development) | PROMPTFLUX-class evasion | `D3-NTA` | Network Traffic Analysis | Network egress — detect AI-API queries from unexpected processes |
+| AI-accelerated multiplier (any band with AML.T0016 / AML.T0017 capability use) | PROMPTFLUX-class evasion | `D3-NTA` | Network Traffic Analysis | Network egress — detect AI-API queries from unexpected processes |
 | AI-accelerated multiplier | AML.T0051 prompt-injection-driven exploitation chain | `D3-IOPR` + `D3-CSPP` | Input/Output Profiling + Client-server Payload Profiling | SDK / gateway — content-aware inspection of prompt+completion at the model boundary |
 
 **Defense-in-depth posture:** the RWEP band sets the timeline; D3FEND sets the technique set. A 4-hour timeline (RWEP 90+) without a deployed `D3-KBPI` or `D3-SCA` capability is a compliance gap, not an operational one — the timeline cannot be met. Operators reporting "RWEP 90 patched within 4 hours" must also report which D3FEND technique provided coverage during the pre-patch window; an unpatched 4-hour exposure window with no compensating defensive technique is the same outcome as a 30-day SLA breach.

package/skills/framework-gap-analysis/skill.md

@@ -81,7 +81,7 @@ This skill maps framework controls to attacker TTPs on demand rather than static
 | NIST 800-53 SC-8/SC-28 vs. Dirty Frag | T1190 (Exploit Public-Facing Application) via IPsec subsystem | Cryptographic control is the attack surface |
 | NIST 800-53 SI-2 vs. Fragnesia (Dirty Frag sequel) | T1068 (Exploitation for Privilege Escalation) via XFRM ESP-in-TCP skb coalesce | Patch SLA assumes patches close bug families; the Dirty Frag patch introduced this sibling bug |
 | NIST 800-53 AC-2 vs. prompt injection | AML.T0051 (LLM Prompt Injection), AML.T0054 | Authorized identity executes attacker intent |
-| NIST 800-53 SI-3 vs. AI-generated malware | AML.T0016 (adversary Develop Capabilities — payload generation), AML.T0018 | Signature-based detection has zero coverage |
+| NIST 800-53 SI-3 vs. AI-generated malware | AML.T0016 (adversary Obtain Capabilities, payload generation), AML.T0018 | Signature-based detection has zero coverage |
 | ISO 27001 A.8.8 vs. CISA KEV class | T1068, T1203 | "Appropriate timescales" undefined for AI-accelerated weaponization |
 | SOC 2 CC6 vs. prompt injection | AML.T0051 | Authorization model has no prompt-level granularity |
 | PCI DSS 6.3.3 vs. AI-accelerated weaponization | T1068, T1190 | One-month window predates AI-assisted exploit development |
@@ -395,8 +395,8 @@ Every Framework Lag Declaration this skill produces names the missing control. T
 | AML.T0051 | AC-2 / CC6 | `D3-CSPP` | Client-server Payload Profiling | LLM gateway — gateway-layer inspection when SDK-side `D3-IOPR` is not deployable |
 | AML.T0010 (AI Supply Chain Compromise) — CVE-2026-30615 MCP class | A.5.19 / SA-12 vendor management as MCP trust boundary | `D3-EAL` | Executable Allowlisting | Managed endpoint — only sanctioned MCP servers and IDE assistants execute on developer workstations |
 | AML.T0010 | A.5.19 / SA-12 | `D3-EFA` | Executable File Analysis | Endpoint — pre-execution analysis of MCP server binaries and AI-assistant plugins |
-| AML.T0016 (Develop Capabilities — AI-generated payloads) — PROMPTFLUX class | SI-3 signature-based malware protection | `D3-PA` | Process Analysis | Endpoint — behavioral detection of in-process LLM-query patterns that signature engines cannot see |
-| AML.T0096 (LLM Integration Abuse — C2) — SesameOp class | SI-4 / CC7 anomaly detection without AI-API baseline | `D3-NTA` | Network Traffic Analysis | Network egress — per-identity baseline of model-API destinations |
+| AML.T0016 (Obtain Capabilities, AI-generated payloads), PROMPTFLUX class | SI-3 signature-based malware protection | `D3-PA` | Process Analysis | Endpoint — behavioral detection of in-process LLM-query patterns that signature engines cannot see |
+| AML.T0096 (AI Service API, C2), SesameOp class | SI-4 / CC7 anomaly detection without AI-API baseline | `D3-NTA` | Network Traffic Analysis | Network egress — per-identity baseline of model-API destinations |
 | T1190 (Exploit Public-Facing Application) — Dirty Frag IPsec | SC-8 / SC-28 cryptographic-control compensating-control claim | `D3-NI` | Network Isolation | Network — segmentation that does not depend on the compromised IPsec subsystem |
 | AML.T0020 (Training Data Poisoning) | NIS2 Art. 21 AI-pipeline integrity | `D3-FAPA` | File Access Pattern Analysis | Data tier — RAG-corpus and training-data access-pattern baselining |
 

package/skills/global-grc/skill.md

@@ -229,11 +229,11 @@ Introduced to the House of Commons on 2025-11-12; through Lords stages during Ju
 
 The Australian ISM is the most frequently updated major framework — monthly updates give it the shortest lag of any national framework. Key controls relevant to 2026:
 
-- **ISM-1623**: Patch operating systems and applications within 48 hours when exploits exist (closest to RWEP-aligned patching in any national framework)
-- **ISM-1694**: Employ application control to prevent execution of malicious code
-- **ISM-1691**: Configure Microsoft Office macro settings (relevant for AI document processing pipelines)
+- **ISM-1876 and ISM-1877**: Patch online services and the operating systems of internet-facing servers and network devices within 48 hours of release when the vendor rates a vulnerability critical or a working exploit exists, at every Essential Eight maturity level. Browsers, office suites, email clients and workstation operating systems get 48 hours only at Maturity Level Three (ISM-1692, ISM-1696).
+- **ISM-0843**: Implement application control on workstations (ISM-1490 extends it to internet-facing servers from Maturity Level Two).
+- **ISM-1488**: Block Microsoft Office macros in files that originate from the internet (relevant for AI document processing pipelines).
 
-**ISM strength:** 48-hour patching for exploited vulnerabilities is the best standard practice in any national framework. Aligns with ASD Essential 8 Maturity Level 3.
+**ISM strength:** 48-hour patching for exploited vulnerabilities is the best standard practice in any national framework. It applies to internet-facing systems at every Essential Eight maturity level, and to workstations at Maturity Level Three.
 
 **ISM gap:** No specific controls for AI pipeline security, MCP trust boundaries, or prompt injection as of mid-2026 monthly updates.
 
@@ -434,10 +434,10 @@ D3FEND references from `data/d3fend-catalog.json`. This skill produces jurisdict
 | Prompt injection as access-control failure | AML.T0051 (LLM Prompt Injection) | `D3-IOPR` + `D3-CSPP` | Input/Output Profiling + Client-server Payload Profiling | `ai-attack-surface` |
 | MCP/agent tool trust boundaries | AML.T0010 (AI Supply Chain Compromise) | `D3-EAL` + `D3-EFA` | Executable Allowlisting + Executable File Analysis | `mcp-agent-trust` |
 | AI pipeline integrity (model versioning + behavioural regression) | AML.T0018 (Manipulate AI Model), AML.T0020 (Training Data Poisoning) | `D3-FAPA` + `D3-EFA` | File Access Pattern Analysis + Executable File Analysis | `mlops-security` |
-| AI-as-C2 detection | AML.T0096 (LLM Integration Abuse — C2) | `D3-NTA` + `D3-OTF` | Network Traffic Analysis + Outbound Traffic Filtering | `ai-c2-detection` |
+| AI-as-C2 detection | AML.T0096 (AI Service API, C2) | `D3-NTA` + `D3-OTF` | Network Traffic Analysis + Outbound Traffic Filtering | `ai-c2-detection` |
 | Live kernel patching as required capability | T1068 (Exploitation for Privilege Escalation) | `D3-KBPI` + `D3-SCA` | Kernel-Based Process Isolation + System Call Analysis | `kernel-lpe-triage` |
 | CISA KEV-indexed patch SLAs | T1190 (Exploit Public-Facing Application) | `D3-NI` | Network Isolation for the unpatched window | `exploit-scoring` + `kernel-lpe-triage` |
-| AI-generated phishing detection update requirement | T1566 (Phishing), AML.T0016 (Develop Capabilities) | `D3-MFA` + `D3-CSPP` | Multi-factor Authentication (passkey class) + Client-server Payload Profiling | `email-security-anti-phishing` |
+| AI-generated phishing detection update requirement | T1566 (Phishing), AML.T0016 (Obtain Capabilities) | `D3-MFA` + `D3-CSPP` | Multi-factor Authentication (passkey class) + Client-server Payload Profiling | `email-security-anti-phishing` |
 | RAG pipeline security | AML.T0051, AML.T0020 | `D3-IOPR` + `D3-FAPA` | Input/Output Profiling + File Access Pattern Analysis | `rag-pipeline-security` |
 | Post-quantum cryptography migration mandate | T1040 (Network Sniffing), T1557 (Adversary-in-the-Middle) — harvest-now-decrypt-later | `D3-MENCR` + `D3-FE` | Message Encryption (PQC-hybrid KEM) + File Encryption (PQC-wrapped envelope) | `pqc-first` |
 
@@ -502,7 +502,7 @@ Every applicable framework has at least one structural gap against mid-2026 thre
 | EU | EU CRA Annex I | "No known exploitable vulnerabilities" is a strict obligation but the conformity-assessment regime is new; market-surveillance authorities have limited tooling to test against ATLAS or KEV catalogs. |
 | UK | NCSC CAF v4.0 Principles A–D | Principle-based, deliberately not prescriptive; currency of interpretation depends on the individual assessor. v4.0 added secure software development/maintenance coverage and automated-decision-making outcomes under B4.a/B4.b, plus an ETSI Securing AI reference — the first AI-relevant content in any UK regulatory assessment framework. Still no contributing outcome naming prompt injection, MCP/agent tool trust, RAG pipeline integrity, or AI-as-C2. |
 | UK | Cyber Essentials Plus | 14-day high-risk patch SLA — better than NIST but still insufficient for KEV-class deterministic LPE. No AI-tool coverage. |
-| AU | ASD ISM-1623 / Essential 8 ML3 | 48-hour patch window for known-exploit vulnerabilities is the best operational standard in any national framework — but does not mandate live-patching capability and has no AI-pipeline controls. |
+| AU | ASD ISM-1877 and ISM-1696 / Essential 8 | 48-hour patch window for known-exploit vulnerabilities is the best operational standard in any national framework — but does not mandate live-patching capability and has no AI-pipeline controls. |
 | AU | APRA CPS 234 | "Commensurate with vulnerabilities and threats" — requires the regulated entity to keep its own threat catalog current. No CPS 234 controls mention AI surfaces explicitly. |
 | SG | MAS TRM (2021, updates) | 1-month critical patch SLA still in force; AI governance handled in a parallel document (FEAT) with incomplete bridge to TRM technical controls. |
 | IN | CERT-In Directions | 6-hour notification is fastest globally for the trigger set listed, but the trigger set predates the AI-mediated attack patterns now common — categorisation of an AI-mediated breach against the listed 20+ trigger types is interpretive. |
@@ -512,7 +512,7 @@ Every applicable framework has at least one structural gap against mid-2026 thre
 | Global | CSA CCM v4 AIS / STA | AIS controls predate the LLM/MCP attack surface; STA covers supply chain but not AI-plugin trust boundaries. AI Controls supplement (2025) is not yet integrated into CCM v4 core. |
 | US (for contrast) | NIST 800-53 SI-2, AC-2, SC-7 | 30-day patch window; no prompt-injection control; perimeter-centric SC-7 boundary protection misses AI-API egress. Cited here only to show parity with the global frameworks — US controls are not adequate either. |
 
-Universal lag: every jurisdiction except Australia (ISM-1623) lacks an operationally testable patch-SLA for KEV-class deterministic LPE. Every jurisdiction lacks AI-pipeline-integrity controls in force as of mid-2026. The EU AI Act will be the first, but not until Art. 15 applies — 2027-12-02 for Annex III systems, 2028-08-02 for Annex I — following the Digital Omnibus deferral. The UK is marginally ahead in practice: NCSC CAF v4.0 B4.a/B4.b carry automated-decision-making outcomes a regulator can assess today, though they are not AI-pipeline-integrity controls in the full sense.
+Universal lag: every jurisdiction except Australia (ISM-1877 for internet-facing systems at every maturity level, ISM-1696 for workstations at Maturity Level Three) lacks an operationally testable patch-SLA for KEV-class deterministic LPE. Every jurisdiction lacks AI-pipeline-integrity controls in force as of mid-2026. The EU AI Act will be the first, but not until Art. 15 applies — 2027-12-02 for Annex III systems, 2028-08-02 for Annex I — following the Digital Omnibus deferral. The UK is marginally ahead in practice: NCSC CAF v4.0 B4.a/B4.b carry automated-decision-making outcomes a regulator can assess today, though they are not AI-pipeline-integrity controls in the full sense.
 
 **Expanded jurisdictional coverage (per `data/global-frameworks.json`).** The EU/UK/AU/ISO baseline is no longer sufficient — the catalog tracks 21+ jurisdictions and the cross-border data-flow obligations are where most of the operational lag now lives:
 
@@ -545,9 +545,9 @@ A summary of the multi-jurisdiction control surface vs. the high-priority TTPs f
 | LLM C2 abuse (SesameOp) | AML.T0096 | None | All — no jurisdiction has a control for AI-API as C2 |
 | Poison Training Data | AML.T0020 | EU AI Act Art. 10 (data and data governance for high-risk AI) | All others |
 | LLM Jailbreak | AML.T0054 | None — same gap as AML.T0051 | All |
-| Discover ML Model Ontology | AML.T0017 | None — adversary reconnaissance against deployed models, no mapped control | All |
-| Obtain Capabilities: Develop Capabilities (AI-assisted weaponization) | AML.T0016 | None — adversary capability, not directly controllable | All |
-| Privilege escalation (T1068) | ATT&CK T1068 | AU ISM-1623 / Essential 8 ML3 (48h patch with exploit) | EU (no specific SLA), UK (14d generic), SG (30d), JP, IN, CA |
+| Discover AI Model Ontology | AML.T0013 | None — adversary reconnaissance against deployed models, no mapped control | All |
+| Develop Capabilities (AI-assisted weaponization) | AML.T0017 | None — adversary capability, not directly controllable | All |
+| Privilege escalation (T1068) | ATT&CK T1068 | AU ISM-1696 / Essential 8 ML3 (48h patch with exploit) | EU (no specific SLA), UK (14d generic), SG (30d), JP, IN, CA |
 | Exploit public-facing app (T1190) | ATT&CK T1190 | AU Essential 8 (patching applications) | All — none address AI-mediated T1190 like CVE-2025-53773 |
 | Phishing (T1566) | ATT&CK T1566 | None updated for AI-generated content | All — phishing guidance generally pre-AI-baseline |
 

package/skills/idp-incident-response/skill.md

@@ -43,7 +43,7 @@ framework_gaps:
   - ISO-27001-2022-A.5.16-Federated
   - SOC2-CC6-OAuth-Consent
   - UK-CAF-B2-IdP-Tenant
-  - AU-ISM-1559-IdP
+  - AU-ISM-1685-IdP
   - NIS2-Art-21-Federated-Identity
   - DORA-Art-19-IdP-4h
   - OFAC-Sanctions-Threat-Actor-Negotiation
@@ -110,7 +110,7 @@ Agentic AI is the emerging structural problem on top. AI agents operating on beh
 | ISO/IEC 27001:2022 | A.5.16 (Identity Management) + A.5.17 (Authentication Information) | Static identity lifecycle and credential protection | Captured in `data/framework-control-gaps.json#ISO-27001-2022-A.5.16-Federated`. A.5.16/A.5.17 cover static identity state (was the account provisioned, was MFA enrolled, was the password rotated). Federated-state transitions (OAuth consent grants, cross-tenant access settings, federated-trust modification) are not enumerated as a distinct control class. |
 | SOC 2 | CC6 (Logical and Physical Access Controls) | Authentication, authorization, and access controls for human users and service accounts | Captured in `data/framework-control-gaps.json#SOC2-CC6-OAuth-Consent`. CC6 treats the authenticated session as the access boundary. OAuth consent grants federate scope outside the authenticated-session boundary; the consenting user authenticated correctly, the third-party app's onward calls are authorized by the grant, and CC6 audit evidence shows nothing anomalous. The dominant 2024-2026 IdP-pivot pattern is invisible to CC6 audit evidence. |
 | UK NCSC CAF | B2.b (Identity and Access Control) | Outcome-based identity and access control for the essential function | Captured in `data/framework-control-gaps.json#UK-CAF-B2-IdP-Tenant`. B2.b is assessed against the IdP tenant's published authentication outcomes; the IdP-tenant control plane (who modified the tenant configuration itself) is outside the outcome's typical evidence surface. A compromised tenant continues to produce compliant outcomes until the attacker abandons stealth. |
-| AU ISM | ISM-1559 (Privileged Account Credential Management) + ISM-1546 (MFA for Privileged Users) | Privileged credential storage, rotation, monitoring + MFA for human-initiated privileged authentication | Captured in `data/framework-control-gaps.json#AU-ISM-1559-IdP`. ISM-1559 reaches privileged credentials at the system layer; IdP-tenant control-plane operations are outside the evidence path. ISM-1546 covers human-initiated authentication; IdP control-plane operations performed by management-API tokens never cross the human-MFA gate. |
+| AU ISM | ISM-1685 (credentials for break glass, local administrator and service accounts are long, unique, unpredictable and managed) + ISM-1173 (MFA for privileged users) | Management of privileged and service credentials, and MFA for human privileged authentication | Captured in `data/framework-control-gaps.json#AU-ISM-1685-IdP`. ISM-1685 reaches credentials on the systems an organization runs; control-plane operations in the identity provider tenant are outside the evidence it collects. ISM-1173 covers human privileged users, and control-plane operations performed with management-API tokens never pass a human MFA step. |
 | AU Essential 8 | Strategy 4 — Multi-factor authentication (E8 M.4) | MFA on privileged and internet-facing accounts | E8 M.4 defends the interactive authentication flow. IdP-tenant control-plane operations performed via management-API tokens, OAuth client credentials, or workload identity federation never cross the MFA gate. Compliance-theater test: count admin-action audit events over the last 30 days, partition by service-token vs human-MFA-session origin; if service tokens dominate, M.4 compliance is paper. |
 | EU NIS2 | Art.21(2)(j) + Art.23 | Cryptography + access control + 24-hour incident notification | Captured in `data/framework-control-gaps.json#NIS2-Art-21-Federated-Identity`. The supporting implementing acts do not enumerate federated-identity control-plane operations. IdP-provider tenants serving essential entities are in scope but the evidence model lags. Art.23 24-hour clock fires on IdP incidents but the tenant-operator-to-essential-entity notification chain is undefined for IdP-class incidents. |
 | EU DORA | Art.19 (Major-ICT-related-incident notification) | 4-hour initial / 72-hour intermediate / one-month final notification for major ICT incidents | Captured in `data/framework-control-gaps.json#DORA-Art-19-IdP-4h`. Art.19 does not specify IdP-tenant compromise as a distinct incident class; financial entities relying on a CSP-hosted IdP frequently classify IdP incidents under Art.28 concentration risk and miss the Art.19 4-hour clock. |