@blamejs/exceptd-skills 0.21.13 → 0.21.14

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.21.14 — 2026-09-28
+
+14 skills stated CVSS, RWEP, KEV, public-exploit or AI-discovery values for catalog CVEs that disagreed with the catalog, and now match it. The cloud-IAM incident skill listed runc CVE-2024-21626 and the xz backdoor CVE-2024-3094 as KEV-listed with RWEP 88 and 70; CISA has listed neither, and the catalog scores them 35 and 45. The Dirty Frag and Fragnesia CVEs (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) now read as AI-assisted discoveries with RWEP 53, 47 and 35, where several skills said they were human-discovered and scored 38, 32 and 20; a KEV listing would take Fragnesia to 60, and confirmed exploitation to 80. The security maturity tiers now place the Dirty Frag pair in the Practical tier, which covers RWEP 30 and above. The Windsurf MCP entry (CVE-2026-30615) reads CVSS 8.0 throughout, and CVE-2026-45321 reads as KEV-listed on 2026-05-27 rather than pending. The exploit-scoring factor breakdown for the Windsurf MCP entry gave its public exploit 10 points and its blast radius 20, so its rows summed to 15 against a stated RWEP of 35; they now read 20 and 30.
+
+A new predeploy gate, `scripts/check-skill-catalog-facts.js`, compares every skill table row, prose line and parenthesized CVE list ("CVE-2026-43284 (Dirty Frag ESP/IPsec, 53, CVSS 8.8)") that states one of these values for a catalog CVE with `data/cve-catalog.json`, and fails when they disagree or when a line states a score for several CVEs outside per-CVE parentheses. It also compares each row of an RWEP factor table under a heading that names one CVE with that CVE's `rwep_factors`.
+
 ## 0.21.13 — 2026-09-28
 
 472 catalog and zero-day lesson texts on 337 entries no longer quote raw catalog field names as prose. An evidence text that read "KEV-listed 2024-11-18 with active_exploitation confirmed, poc_available true, RWEP 82" now reads "CISA added it to its Known Exploited Vulnerabilities catalog on 2024-11-18. Active exploitation is confirmed, a proof of concept is available, and the entry carries an RWEP score of 82", and "patch_required_reboot is false" now reads "applying the fix does not require a reboot". The rewritten texts include 324 lesson evidence and control texts, 44 `live_patch_notes`, 37 `poc_description` and 15 `rwep_correction_note` fields. Four indicators on CVE-2026-31431, CVE-2026-46300 and CVE-2026-39987 now test for a version "in the affected version range listed for this entry". The RWEP factor breakdowns in `rwep_notes` still use the scoring formula's field names.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-29T00:53:16.565Z",
+  "generated_at": "2026-09-29T05:15:50.959Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "04d3d604468a2688e45b55b5604d442b81e7f1f32b06c5ae6afbe5ea96cd7923",
+    "manifest.json": "de9184697ed6593cde0bb16f3be6a99297e3cbd2fdc1e4a4eaaa94cdfb75ff74",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
@@ -17,26 +17,26 @@
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
     "data/zeroday-lessons.json": "2862a4be526374cca633cc47f034b70e1988bb28ebaa22314174b9b3a36a27b2",
-    "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
-    "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
+    "skills/kernel-lpe-triage/skill.md": "8cbc65dab6b50b01bdddb8f042f360ebf3bb4f2d38ee7f4d4e9c080d179ca95b",
+    "skills/ai-attack-surface/skill.md": "8419f1792c9fe66666afd364d8e593cb3a48096e12563efba109e8a94a8fcada",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
-    "skills/framework-gap-analysis/skill.md": "f3bac33a0ffce7a26ecf56410b0f0c1dad1c721239de2d9cb5a8bb624889bf4f",
-    "skills/compliance-theater/skill.md": "a56a5ea0585c6c0fd5a15f7db4dd7142b87c539f0fa63376b5828953bdb7110c",
-    "skills/exploit-scoring/skill.md": "b92709bc6a55ee39a89c6c08ab6e03d7244176957fc7b314bb6d8a823d10bdc8",
+    "skills/framework-gap-analysis/skill.md": "27024d6dc79627befd621d4e8d0cd05ce78f76291a1d5c60d8dd337cbc6d9eb6",
+    "skills/compliance-theater/skill.md": "6aa6bbd11a57471ba53622d64d07b219571f1fc767198f9c2ffccfc6e14104fd",
+    "skills/exploit-scoring/skill.md": "59473887bc7b2a21de657729db3202a3f20521dbf1010fa38290f797b1b873ae",
     "skills/rag-pipeline-security/skill.md": "a26e53f99919ee920e2233924738503e6300d5857289caba01db7f70a2057250",
     "skills/ai-c2-detection/skill.md": "fdc616f274738977d0a643fb516ae0b5e540a719be68bbdb2bd2ef08a6fa65f2",
-    "skills/policy-exception-gen/skill.md": "abdc725a1f7c0e919118ff63a6cf818c544a2debe8c3570a8d8abfd9acd9f1e4",
-    "skills/threat-model-currency/skill.md": "13668235ae4207fe6ab741e59de88772304788e43f0026e0aaafb239ba20b8ef",
+    "skills/policy-exception-gen/skill.md": "072aeac64d77b7d0d65e2882c60b0980e5883dd0e27f9cd7b62c0f26cbbb835f",
+    "skills/threat-model-currency/skill.md": "058b67901e836c20f8730d0c09eabb4bd9600ee0b720d8b6a48bcee5fb08cb7e",
     "skills/global-grc/skill.md": "d3c381b0389e3fa90c2eef9c6c950d6f1af418364ab4a1a60ebf09c1441c984d",
-    "skills/zeroday-gap-learn/skill.md": "c51360a0353201de7438a2f045bfb291102ceed93ea44a2f4d86aa1c8bd2d465",
+    "skills/zeroday-gap-learn/skill.md": "7733233b8eef00b4592d9ad4336cbd815250565bcd54c4b476fbdfe9a73ad9c8",
     "skills/pqc-first/skill.md": "78f562a7caff7a994389a80478962dbe31258ec8960e6cefa2b18bc22b5535eb",
     "skills/skill-update-loop/skill.md": "44ee82f3166c72ac0fb1b5fe441e265201042ea6737d24dd1944d5ab27f91719",
-    "skills/security-maturity-tiers/skill.md": "2e8ffedb22bef2f76a8b5afb425480cf815ffec64063d809ba4f6eb78f03e411",
+    "skills/security-maturity-tiers/skill.md": "b5046e711003123bf2ec31c1ddc51281ae1349747ea65a7d787287a5d33aefb2",
     "skills/researcher/skill.md": "e1d1eb28feb248c31e9365dd4380706385eac5015f6ded1729a5e3e31ee0ee32",
     "skills/attack-surface-pentest/skill.md": "06e52ab2c50f8b9899c8ede117db116ad014fde954d9f0f903e3bda52dc8a393",
     "skills/fuzz-testing-strategy/skill.md": "ee1f001258f19f7c1ca8b82de67abb79bb16002fb92e40581fd074279e17c6ab",
     "skills/dlp-gap-analysis/skill.md": "3b7590c14612a86da06b8ef211f5e19105c5dab6abab97b45c6783c8bbc21564",
-    "skills/supply-chain-integrity/skill.md": "6de2d1b2426019f5f026162216e0ae673b5f186441781aac91e64c22e987b5d2",
+    "skills/supply-chain-integrity/skill.md": "f7694c0a0e335f98631afb7e414baab0528e68830cfd02be9d76075ee50899fa",
     "skills/defensive-countermeasure-mapping/skill.md": "e182f3130fe78e403db6c81c24757bc81dfbc86997e0b5f304f05d5572f7abb2",
     "skills/identity-assurance/skill.md": "86649aa573bde5b2ef2456a77d2fbfa9d1b623a4ef1326dd7a7ab384d0419307",
     "skills/ot-ics-security/skill.md": "4c85b1caf2e8bcb3683a3d98ba8f3cc58b656d3ec8dd88b86e2f70e9ecd4710f",
@@ -46,19 +46,19 @@
     "skills/ai-risk-management/skill.md": "6d4fc768022e9df97d1c06e539fd69f7ba43d5e0cd6d4282171f24282ccd5097",
     "skills/sector-healthcare/skill.md": "59d5c4d5a1727b071ae1dac93a057c5b5507744b73c9126ac1e1218926c260fa",
     "skills/sector-financial/skill.md": "256aa802341dc8dcfed587cdde94c58ee8ad628f313d20305f6f46cc26bd896a",
-    "skills/sector-federal-government/skill.md": "9b836c4c140c2fbd9ce0c5b900cb344c8f45d4e5fabdbb23ff7a95887445f68f",
+    "skills/sector-federal-government/skill.md": "b6357b23119374ea5caed2873babbf8d158da0a54fc566e3c5c8559a28b7b79d",
     "skills/sector-energy/skill.md": "4a61701fd57fa6b1382ebdfd5ba9f259d5b6f81fd9c67b35cff2ce422238ecbe",
     "skills/sector-telecom/skill.md": "f5065bdda938602dd4a1ab9de14984a657762fcfd818372dfc0df81fd7986cee",
     "skills/api-security/skill.md": "e99c0d1421ca0ee85bce4d538b382da20105adf33a4336bcd630e65ff7f7f0ba",
     "skills/cloud-security/skill.md": "ef21acca3da5b23b15dede1d1fb5f2caf0b8e65afb83acbeb7346863caebf63d",
-    "skills/container-runtime-security/skill.md": "36d7e93fbacd9d797dd1127cd1db0a60d1793745d1b310d0ac3a198d8ba8f563",
+    "skills/container-runtime-security/skill.md": "28b075b44c53b88d09a52770f9160a139afa530124cf3762636a9f3e7a36b8cc",
     "skills/mlops-security/skill.md": "40b84e3034bc07bff52bfd6295308b6d7dca3b7dc072dc52c407af8b661bb23a",
     "skills/incident-response-playbook/skill.md": "8c35ee344df0902409918ab0520e87c4e24141e4a3efb3121e96bbeabf11d96b",
     "skills/ransomware-response/skill.md": "23883384128e7f6d24d8d533eaa4a92c8ed03cd7a62e1e9991d5ca6f726672c9",
     "skills/email-security-anti-phishing/skill.md": "0965eca982e8fc633b85e70c0ba6becb8c0f5ee7bdd0be96ad73a9a222bb8816",
     "skills/age-gates-child-safety/skill.md": "cd4abcbe200f8ab589ae6c06cba1c6ee46144ba83624c6bd69e3559678ea4e9b",
-    "skills/cloud-iam-incident/skill.md": "36312db2ffd776e57d0d0e6dafbef008784be87aeab58fb4ee8ae92d0c4f0bdf",
-    "skills/idp-incident-response/skill.md": "529c6f3970bf3003d4b866ca0d2846c8ec501c65b76fa0029b93c3b560d52973",
+    "skills/cloud-iam-incident/skill.md": "102a79be85d08b60b5550f50775201ca499577909842f740a9140fc82b6d159d",
+    "skills/idp-incident-response/skill.md": "c08f53ec55f8a2704008e8c289f9a66bd3e7f7d47a7b0a246f22ecfcaacaa7f4",
     "skills/vc-wallet-trust/skill.md": "802dada75d934c9ab322246f650eb2eac9e2f72c1f094b0cebcfa605b56108a5",
     "skills/mail-server-hardening/skill.md": "0554e23457851ac1cdb3b8217fae902789798db1bbc67c5f4cf1df6fd265cf15",
     "skills/network-trust/skill.md": "d1c2fd6ce0bd74e508a41a61c8618cc5c979eaea2702ca97003ce46ba8c9dfa8",
@@ -107,7 +107,7 @@
     "handoff_dag_nodes": 51,
     "summary_cards": 51,
     "section_offsets_skills": 51,
-    "token_budget_total_approx": 442647,
+    "token_budget_total_approx": 442850,
     "recipes": 8,
     "jurisdiction_clocks": 29,
     "did_ladders": 8,

package/data/_indexes/activity-feed.json

@@ -5,6 +5,104 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "kernel-lpe-triage",
+      "path": "skills/kernel-lpe-triage/skill.md",
+      "note": "Assess Linux kernel LPE exposure — Copy Fail, Dirty Frag, Fragnesia, live-patch vs. reboot remediation paths, framework gap declarations"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "ai-attack-surface",
+      "path": "skills/ai-attack-surface/skill.md",
+      "note": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.09 with explicit framework gap flags"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "framework-gap-analysis",
+      "path": "skills/framework-gap-analysis/skill.md",
+      "note": "Feed a framework control ID and threat scenario — receive the gap between what the control covers and what current TTPs require"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "compliance-theater",
+      "path": "skills/compliance-theater/skill.md",
+      "note": "Detect where an organization passes an audit but remains exposed — seven documented compliance theater patterns with specific detection tests"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "exploit-scoring",
+      "path": "skills/exploit-scoring/skill.md",
+      "note": "Real-World Exploit Priority (RWEP) scoring — CVSS plus KEV, PoC, AI-acceleration, blast radius, live-patch factors"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "policy-exception-gen",
+      "path": "skills/policy-exception-gen/skill.md",
+      "note": "Generate defensible policy exceptions for architectural realities — ephemeral infra, AI pipelines, ZTA, no-reboot patching, with compensating controls and auditor-ready justification"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "threat-model-currency",
+      "path": "skills/threat-model-currency/skill.md",
+      "note": "Score how current an org's threat model is against 2026 reality — 14-item checklist, currency percentage, prioritized update roadmap"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "zeroday-gap-learn",
+      "path": "skills/zeroday-gap-learn/skill.md",
+      "note": "Run the zero-day learning loop — CVE to attack vector to control gap to framework gap to new control requirement"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "security-maturity-tiers",
+      "path": "skills/security-maturity-tiers/skill.md",
+      "note": "Three-tier implementation roadmap — MVP you can ship today, practical best practices usable now, overkill gold standard for defense-in-depth"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "supply-chain-integrity",
+      "path": "skills/supply-chain-integrity/skill.md",
+      "note": "Supply-chain integrity for mid-2026 — SLSA L3+, in-toto attestations, Sigstore signing, SBOM (CycloneDX/SPDX), VEX via CSAF 2.0, AI-generated code provenance, model weights as supply-chain artifacts"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "sector-federal-government",
+      "path": "skills/sector-federal-government/skill.md",
+      "note": "Federal government + defense contractor cybersecurity for mid-2026 — FedRAMP Rev5, CMMC 2.0, EO 14028, NIST 800-171/172 CUI, FISMA, M-22-09 federal Zero Trust, OMB M-24-04 AI risk, CISA BOD/ED; cross-jurisdiction NCSC UK, ENISA EUCC, AU PSPF, IL government cyber methodology"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "container-runtime-security",
+      "path": "skills/container-runtime-security/skill.md",
+      "note": "Container + Kubernetes runtime security for mid-2026 — CIS K8s Benchmark, NSA/CISA Hardening, Pod Security Standards, Kyverno/Gatekeeper admission, Sigstore policy-controller, eBPF runtime detection (Falco/Tetragon), AI inference workload hardening"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "cloud-iam-incident",
+      "path": "skills/cloud-iam-incident/skill.md",
+      "note": "Cloud-IAM incident response for AWS / GCP / Azure — account takeover, IAM role assumption abuse, access-key compromise, cross-account assume-role chains, federated-trust attacks (IAM Identity Center / Workload Identity Federation / Azure managed identity), IMDS metadata exfiltration, and Snowflake-AA24-class IdP-to-cloud credential reuse"
+    },
+    {
+      "date": "2026-09-28",
+      "type": "skill_review",
+      "artifact": "idp-incident-response",
+      "path": "skills/idp-incident-response/skill.md",
+      "note": "Identity-provider incident response for mid-2026 — Okta, Entra ID, Auth0, Ping, OneLogin tenant compromise, federated-trust abuse, OAuth app consent abuse, Midnight Blizzard and Scattered Spider TTPs against the IdP control plane"
+    },
     {
       "date": "2026-09-28",
       "type": "catalog_update",
@@ -37,13 +135,6 @@
       "schema_version": "1.0.0",
       "entry_count": 199
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "ai-attack-surface",
-      "path": "skills/ai-attack-surface/skill.md",
-      "note": "Comprehensive AI/ML attack surface assessment mapped to MITRE ATLAS v2026.09 with explicit framework gap flags"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -51,27 +142,6 @@
       "path": "skills/mcp-agent-trust/skill.md",
       "note": "Enumerate MCP trust boundary failures — tool allowlisting, signed manifests, bearer auth, zero-interaction RCE"
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "framework-gap-analysis",
-      "path": "skills/framework-gap-analysis/skill.md",
-      "note": "Feed a framework control ID and threat scenario — receive the gap between what the control covers and what current TTPs require"
-    },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "compliance-theater",
-      "path": "skills/compliance-theater/skill.md",
-      "note": "Detect where an organization passes an audit but remains exposed — seven documented compliance theater patterns with specific detection tests"
-    },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "exploit-scoring",
-      "path": "skills/exploit-scoring/skill.md",
-      "note": "Real-World Exploit Priority (RWEP) scoring — CVSS plus KEV, PoC, AI-acceleration, blast radius, live-patch factors"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -86,27 +156,6 @@
       "path": "skills/ai-c2-detection/skill.md",
       "note": "Detect adversary use of AI APIs as covert C2 — SesameOp pattern, PROMPTFLUX/PROMPTSTEAL behavioral signatures, response playbook"
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "policy-exception-gen",
-      "path": "skills/policy-exception-gen/skill.md",
-      "note": "Generate defensible policy exceptions for architectural realities — ephemeral infra, AI pipelines, ZTA, no-reboot patching, with compensating controls and auditor-ready justification"
-    },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "threat-model-currency",
-      "path": "skills/threat-model-currency/skill.md",
-      "note": "Score how current an org's threat model is against 2026 reality — 14-item checklist, currency percentage, prioritized update roadmap"
-    },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "zeroday-gap-learn",
-      "path": "skills/zeroday-gap-learn/skill.md",
-      "note": "Run the zero-day learning loop — CVE to attack vector to control gap to framework gap to new control requirement"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -114,13 +163,6 @@
       "path": "skills/skill-update-loop/skill.md",
       "note": "Meta-skill for keeping all exceptd skills current — fires on new CVEs and CISA KEV listings, ATLAS updates, framework changes, and forward_watch triggers, and scores each skill's currency"
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "security-maturity-tiers",
-      "path": "skills/security-maturity-tiers/skill.md",
-      "note": "Three-tier implementation roadmap — MVP you can ship today, practical best practices usable now, overkill gold standard for defense-in-depth"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -142,13 +184,6 @@
       "path": "skills/dlp-gap-analysis/skill.md",
       "note": "DLP gap analysis for mid-2026 — legacy DLP misses LLM prompts, MCP tool args, RAG retrievals, embedding-store exfil, and code-completion telemetry. Audit channels, classifiers, protected surfaces, enforcement actions, and evidence trails against modern threat reality and cross-jurisdictional privacy regimes"
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "supply-chain-integrity",
-      "path": "skills/supply-chain-integrity/skill.md",
-      "note": "Supply-chain integrity for mid-2026 — SLSA L3+, in-toto attestations, Sigstore signing, SBOM (CycloneDX/SPDX), VEX via CSAF 2.0, AI-generated code provenance, model weights as supply-chain artifacts"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -191,13 +226,6 @@
       "path": "skills/sector-financial/skill.md",
       "note": "Financial services cybersecurity for mid-2026 — EU DORA TLPT, PSD2 RTS-SCA, SWIFT CSCF v2026, NYDFS 23 NYCRR 500, FFIEC CAT, MAS TRM, APRA CPS 234, IL BoI Directive 361, OSFI B-13; Threat-Led Pen Testing schemes TIBER-EU + CBEST + iCAST"
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "sector-federal-government",
-      "path": "skills/sector-federal-government/skill.md",
-      "note": "Federal government + defense contractor cybersecurity for mid-2026 — FedRAMP Rev5, CMMC 2.0, EO 14028, NIST 800-171/172 CUI, FISMA, M-22-09 federal Zero Trust, OMB M-24-04 AI risk, CISA BOD/ED; cross-jurisdiction NCSC UK, ENISA EUCC, AU PSPF, IL government cyber methodology"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -219,13 +247,6 @@
       "path": "skills/cloud-security/skill.md",
       "note": "Cloud security for mid-2026 — CSPM/CWPP/CNAPP posture, CSA CCM v4, AWS/Azure/GCP shared responsibility, cloud workload identity federation, runtime security with eBPF, AI workloads on cloud"
     },
-    {
-      "date": "2026-09-18",
-      "type": "skill_review",
-      "artifact": "container-runtime-security",
-      "path": "skills/container-runtime-security/skill.md",
-      "note": "Container + Kubernetes runtime security for mid-2026 — CIS K8s Benchmark, NSA/CISA Hardening, Pod Security Standards, Kyverno/Gatekeeper admission, Sigstore policy-controller, eBPF runtime detection (Falco/Tetragon), AI inference workload hardening"
-    },
     {
       "date": "2026-09-18",
       "type": "skill_review",
@@ -384,13 +405,6 @@
       "path": "skills/email-security-anti-phishing/skill.md",
       "note": "Email security + anti-phishing for mid-2026 — SPF/DKIM/DMARC/BIMI/ARC/MTA-STS/TLSRPT, AI-augmented phishing (vishing, deepfake video, hyperpersonalized email), Business Email Compromise, secure email gateways"
     },
-    {
-      "date": "2026-05-15",
-      "type": "skill_review",
-      "artifact": "kernel-lpe-triage",
-      "path": "skills/kernel-lpe-triage/skill.md",
-      "note": "Assess Linux kernel LPE exposure — Copy Fail, Dirty Frag, Fragnesia, live-patch vs. reboot remediation paths, framework gap declarations"
-    },
     {
       "date": "2026-05-15",
       "type": "skill_review",
@@ -405,20 +419,6 @@
       "path": "skills/sector-telecom/skill.md",
       "note": "Telecom and 5G security for mid-2026 — Salt Typhoon, Volt Typhoon, CALEA / IPA-LI gateway compromise, signaling-protocol abuse (SS7 / Diameter / GTP), 5G N6 / N9 isolation, gNB / DU / CU integrity, OEM-equipment supply-chain compromise, AI-RAN / O-RAN security; FCC CPNI + 4-business-day notification, NIS2 Annex I telecom essential entities, UK TSA 2021 + Ofcom, AU SOCI / TSSR, GSMA NESAS, 3GPP TR 33.926 + TS 33.501, ITU-T X.805."
     },
-    {
-      "date": "2026-05-15",
-      "type": "skill_review",
-      "artifact": "cloud-iam-incident",
-      "path": "skills/cloud-iam-incident/skill.md",
-      "note": "Cloud-IAM incident response for AWS / GCP / Azure — account takeover, IAM role assumption abuse, access-key compromise, cross-account assume-role chains, federated-trust attacks (IAM Identity Center / Workload Identity Federation / Azure managed identity), IMDS metadata exfiltration, and Snowflake-AA24-class IdP-to-cloud credential reuse"
-    },
-    {
-      "date": "2026-05-15",
-      "type": "skill_review",
-      "artifact": "idp-incident-response",
-      "path": "skills/idp-incident-response/skill.md",
-      "note": "Identity-provider incident response for mid-2026 — Okta, Entra ID, Auth0, Ping, OneLogin tenant compromise, federated-trust abuse, OAuth app consent abuse, Midnight Blizzard and Scattered Spider TTPs against the IdP control plane"
-    },
     {
       "date": "2026-05-15",
       "type": "catalog_update",

package/data/_indexes/currency.json

@@ -24,8 +24,8 @@
     },
     {
       "skill": "ai-attack-surface",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 8,
@@ -78,8 +78,8 @@
     },
     {
       "skill": "cloud-iam-incident",
-      "last_threat_review": "2026-05-15",
-      "days_since_review": 0,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 11,
@@ -96,8 +96,8 @@
     },
     {
       "skill": "compliance-theater",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 0,
@@ -105,8 +105,8 @@
     },
     {
       "skill": "container-runtime-security",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 1,
@@ -159,8 +159,8 @@
     },
     {
       "skill": "exploit-scoring",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 0,
@@ -168,8 +168,8 @@
     },
     {
       "skill": "framework-gap-analysis",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 0,
@@ -204,8 +204,8 @@
     },
     {
       "skill": "idp-incident-response",
-      "last_threat_review": "2026-05-15",
-      "days_since_review": 0,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 11,
@@ -222,8 +222,8 @@
     },
     {
       "skill": "kernel-lpe-triage",
-      "last_threat_review": "2026-05-15",
-      "days_since_review": 0,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 4,
@@ -294,8 +294,8 @@
     },
     {
       "skill": "policy-exception-gen",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 4,
@@ -357,8 +357,8 @@
     },
     {
       "skill": "sector-federal-government",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 10,
@@ -393,8 +393,8 @@
     },
     {
       "skill": "security-maturity-tiers",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 4,
@@ -420,8 +420,8 @@
     },
     {
       "skill": "supply-chain-integrity",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 8,
@@ -429,8 +429,8 @@
     },
     {
       "skill": "threat-model-currency",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 5,
@@ -465,8 +465,8 @@
     },
     {
       "skill": "zeroday-gap-learn",
-      "last_threat_review": "2026-09-18",
-      "days_since_review": -126,
+      "last_threat_review": "2026-09-28",
+      "days_since_review": -136,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 4,