@blamejs/exceptd-skills 0.21.13 → 0.21.15

package/scripts/check-skill-catalog-facts.js

@@ -0,0 +1,304 @@
+#!/usr/bin/env node
+"use strict";
+
+/**
+ * Skill catalog-facts gate. Exit 0 consistent, 1 when a skill states a CVE fact
+ * that differs from data/cve-catalog.json.
+ *
+ * A markdown table row is compared when the first cell that names a CVE names
+ * exactly one catalog CVE. Its cells are compared by column header: CVSS, RWEP, a KEV column (Yes/No, and the listing date when the
+ * cell gives one), a public-exploit column (Yes/No), and an AI column. An
+ * "AI-Discovered" column is compared with ai_discovered; an AI column that also
+ * covers acceleration, enablement or weaponization is compared with
+ * ai_discovered OR ai_assisted_weaponization. A prose line that names exactly one
+ * catalog CVE is compared on "RWEP <n>", "CVSS <n.n>", "KEV-listed <date>" and
+ * "not KEV-listed". On any line, the parentheses that follow a CVE id are read
+ * as that CVE's values, so a list such as "CVE-A (90), CVE-B (Dirty Frag, 38,
+ * CVSS 7.8)" is compared CVE by CVE. A cell or line that states no comparable value is skipped,
+ * and so is a CVE the catalog does not hold, a row whose CVE cell only points
+ * to one ("No vendor CVE; see CVE-..."), and a value the text marks as superseded.
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const ROOT = path.resolve(__dirname, "..");
+const CVE = /CVE-\d{4}-\d{4,}/g;
+const DATE = /\d{4}-\d{2}-\d{2}/;
+
+const splitRow = (line) => line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+const isDivider = (cells) => cells.every((c) => /^:?-{2,}:?$/.test(c));
+const uniqueCves = (text) => [...new Set(text.match(CVE) || [])];
+
+/** Leading Yes or No of a cell; anything else ("Partial", "varies") is not compared. */
+function yesNo(cell) {
+  if (/^yes\b/i.test(cell)) return true;
+  if (/^no\b/i.test(cell)) return false;
+  return null;
+}
+
+/**
+ * An AI cell's claim: a leading Yes/No, a declarative form the column counts as
+ * yes ("AI-discovered", "AI-weaponized"), or "Human-discovered" as no.
+ */
+function aiValue(cell, yesForm) {
+  const v = yesNo(cell);
+  if (v !== null) return v;
+  if (yesForm.test(cell)) return true;
+  if (/^human[- ](?:discovered|found)\b/i.test(cell)) return false;
+  return null;
+}
+
+/** The CVSS major version a text names ("CVSS 4.0", "CVSS v3.1"), or null. */
+function cvssVersion(vector) {
+  const m = /^CVSS:(\d)/.exec(vector || "");
+  return m ? m[1] : null;
+}
+
+function columnKind(header) {
+  const h = header.toLowerCase().replace(/[`*?]/g, "").trim();
+  if (/^cvss\b/.test(h)) return "cvss";
+  if (/^rwep\b/.test(h)) return "rwep";
+  if (/\bkev\b/.test(h)) return "kev";
+  if (/\bpoc\b|public exploit/.test(h)) return "poc";
+  if (/^ai[- ]discovered$/.test(h)) return "ai_discovered";
+  if (/^ai\b/.test(h)) return "ai_any";
+  return null;
+}
+
+/** A cell's text with Markdown emphasis and code marks removed. */
+const plain = (cell) => cell.replace(/[*_`]/g, "").trim();
+
+function compareCell(kind, raw, e, say) {
+  const cell = plain(raw);
+  if (kind === "cvss") {
+    const m = /^(\d{1,2}(?:\.\d)?)\b/.exec(cell);
+    if (m && Number(m[1]) !== e.cvss_score) say(`CVSS ${m[1]}, catalog ${e.cvss_score}`);
+  } else if (kind === "rwep") {
+    const m = /^(\d{1,3})(?![\d+–-]|\.\d)/.exec(cell);
+    if (m && Number(m[1]) !== e.rwep_score) say(`RWEP ${m[1]}, catalog ${e.rwep_score}`);
+  } else if (kind === "kev") {
+    const v = yesNo(cell);
+    if (v === null) return;
+    if (v !== Boolean(e.cisa_kev)) say(`KEV "${cell.slice(0, 40)}", catalog ${e.cisa_kev ? `listed ${e.cisa_kev_date}` : "not listed"}`);
+    else if (v) {
+      const d = DATE.exec(cell);
+      if (d && e.cisa_kev_date && d[0] !== e.cisa_kev_date) say(`KEV date ${d[0]}, catalog ${e.cisa_kev_date}`);
+    }
+  } else if (kind === "poc") {
+    // "Partial" is the catalog's own granular value for a conceptual or chain-only
+    // exploit, which it scores as poc_available true.
+    const v = /^partial\b/i.test(cell) ? true : yesNo(cell);
+    if (v !== null && v !== Boolean(e.poc_available)) say(`public exploit "${cell.slice(0, 40)}", catalog poc_available ${e.poc_available}`);
+  } else if (kind === "ai_discovered") {
+    const v = aiValue(cell, /^ai[- ](?:discovered|assisted)\b/i);
+    if (v !== null && v !== Boolean(e.ai_discovered)) say(`AI-discovered "${cell.slice(0, 40)}", catalog ai_discovered ${e.ai_discovered}`);
+  } else if (kind === "ai_any") {
+    const v = aiValue(cell, /^ai[- ](?:discovered|assisted|accelerated|enabled|weaponi[sz]ed)\b/i);
+    const expected = Boolean(e.ai_discovered) || Boolean(e.ai_assisted_weaponization);
+    if (v !== null && v !== expected) say(`AI "${cell.slice(0, 40)}", catalog ai_discovered ${e.ai_discovered} / ai_assisted_weaponization ${e.ai_assisted_weaponization}`);
+  }
+}
+
+/** A value the text marks as superseded ("the initial CVSS 9.8 was withdrawn"). */
+function historical(line, m) {
+  const before = line.slice(Math.max(0, m.index - 24), m.index);
+  const after = line.slice(m.index + m[0].length, m.index + m[0].length + 24);
+  return /\b(?:initial|original|previous(?:ly)?|earlier|former|prior)\s*$/i.test(before) || /^\s*(?:was|were|is)\s+(?:withdrawn|superseded|corrected|replaced)\b/i.test(after);
+}
+
+function compareProse(text, e, say) {
+  const line = plain(text);
+  for (const m of line.matchAll(/RWEP(?: score)?(?:\s*(?:of|is|=|:))?\s*(\d{1,3})(?![\d+–-]|\.\d)/gi)) {
+    if (historical(line, m)) continue;
+    if (Number(m[1]) !== e.rwep_score) say(`RWEP ${m[1]}, catalog ${e.rwep_score}`);
+  }
+  for (const m of line.matchAll(/CVSS(?:\s*v?(\d)(?:\.\d)?\b)?(?:\s*(?:score|base score))?(?:\s*(?:of|is|=|:))?\s*(\d{1,2}\.\d)\b/gi)) {
+    const version = m[1] || null;
+    if (version && version !== cvssVersion(e.cvss_vector)) continue;
+    if (historical(line, m)) continue;
+    if (Number(m[2]) !== e.cvss_score) say(`CVSS ${m[2]}, catalog ${e.cvss_score}`);
+  }
+  for (const m of line.matchAll(/\bKEV[- ]listed(?: on)? (\d{4}-\d{2}-\d{2})/g)) {
+    if (e.cisa_kev_date && m[1] !== e.cisa_kev_date) say(`KEV date ${m[1]}, catalog ${e.cisa_kev_date}`);
+    if (!e.cisa_kev) say(`says KEV-listed ${m[1]}, catalog not listed`);
+  }
+  if (/\bnot (?:yet )?(?:CISA )?KEV[- ]listed\b|\bnot (?:yet )?(?:on|in) (?:the )?(?:CISA )?KEV\b|\bKEV(?: listing)?:? pending\b|\bpending (?:CISA )?KEV\b/i.test(line) && e.cisa_kev) {
+    say(`says not KEV-listed, catalog listed ${e.cisa_kev_date}`);
+  }
+}
+
+/**
+ * Values in the parentheses that follow a CVE id, or that open with one, belong
+ * to that CVE: "CVE-X (Copy Fail, RWEP 90, CVSS 7.8)", "CVE-X (Dirty Frag, 38,
+ * CVSS 7.8)" or "(CVE-X, CVSS 7.8 / AV:L)". A bare 1-3 digit item is read as
+ * RWEP when the line mentions RWEP.
+ */
+const PER_CVE = /(CVE-\d{4}-\d{4,})\s*\(([^()]*)\)|\((CVE-\d{4}-\d{4,})[,;:]\s*([^()]*)\)/g;
+
+const UNATTRIBUTED = 'states a score for several CVEs outside per-CVE parentheses; write each as "CVE-X (name, RWEP n, CVSS n.n)"';
+
+/** A score statement: "RWEP 53", "CVSS 8.8", "**RWEP:** 53/100". */
+const SCORE = /RWEP(?: score)?\*{0,2}(?:\s*(?:of|is|=|:))?\*{0,2}\s*\d{1,3}(?![\d+–-]|\.\d)|CVSS(?:\s*v?\d(?:\.\d)?\b)?(?:\s*(?:score|base score))?\*{0,2}(?:\s*(?:of|is|=|:))?\*{0,2}\s*\d{1,2}\.\d\b|\b\d{1,3}\/100\b/i;
+
+function compareParentheticals(line, catalog, say) {
+  const rwepContext = /\bRWEP\b/i.test(line);
+  let found = 0;
+  for (const raw of line.matchAll(PER_CVE)) {
+    const m = raw[1] ? [raw[0], raw[1], raw[2]] : [raw[0], raw[3], raw[4]];
+    const e = catalog[m[1]];
+    if (!e) continue;
+    found++;
+    const inner = m[2];
+    const tell = (msg) => say(m[1], msg);
+    compareProse(inner, e, tell);
+    if (rwepContext && !/\bRWEP\b/i.test(inner)) {
+      for (const item of inner.split(/[,;]/).map((s) => s.trim())) {
+        if (/^\d{1,3}$/.test(item) && Number(item) !== e.rwep_score) tell(`RWEP ${item}, catalog ${e.rwep_score}`);
+      }
+    }
+  }
+  return found;
+}
+
+/** Factor-table row labels and the rwep_factors key each one scores. */
+const FACTOR_KEYS = [
+  [/^cisa kev$/, "cisa_kev"],
+  [/^poc public$|^public poc$/, "poc_available"],
+  [/^ai[- ](?:assisted|discovered|factor)$/, "ai_factor"],
+  [/^active exploitation$/, "active_exploitation"],
+  [/^blast radius$/, "blast_radius"],
+  [/^patch available$/, "patch_available"],
+  [/^live patch available$/, "live_patch_available"],
+  [/^reboot required$/, "reboot_required"],
+];
+
+/**
+ * A "Factor | Value | Points" row under a heading that names one catalog CVE:
+ * the points must equal that CVE's rwep_factors entry, and the RWEP row must
+ * equal its rwep_score.
+ */
+/** Factor rows whose Value cell states a catalog boolean, with how to read it. */
+const FACTOR_VALUES = [
+  [/^cisa kev$/, (e) => Boolean(e.cisa_kev), "cisa_kev"],
+  [/^poc public$|^public poc$/, (e) => Boolean(e.poc_available), "poc_available"],
+  [/^ai[- ]discovered$/, (e) => Boolean(e.ai_discovered), "ai_discovered"],
+  [/^ai[- ](?:assisted|factor)$/, (e) => Boolean(e.ai_discovered) || Boolean(e.ai_assisted_weaponization), "ai_discovered / ai_assisted_weaponization"],
+  [/^patch available$/, (e) => Boolean(e.patch_available), "patch_available"],
+  [/^live patch available$/, (e) => Boolean(e.live_patch_available), "live_patch_available"],
+  [/^reboot required$/, (e) => Boolean(e.patch_required_reboot), "patch_required_reboot"],
+];
+
+function compareFactorRow(cells, rawHeader, e, say) {
+  const pointsCol = rawHeader.findIndex((h) => /^\s*points\s*$/i.test(h));
+  if (pointsCol < 1) return false;
+  const label = (cells[0] || "").replace(/\*/g, "").trim().toLowerCase();
+  const valueCol = rawHeader.findIndex((h) => /^\s*value\s*$/i.test(h));
+  const valueRule = FACTOR_VALUES.find(([re]) => re.test(label));
+  if (valueCol > 0 && valueRule) {
+    const cell = plain(cells[valueCol] || "");
+    const v = /^partial\b/i.test(cell) && valueRule[2] === "poc_available" ? true : yesNo(cell);
+    if (v !== null && v !== valueRule[1](e)) say(`factor table ${cells[0].replace(/\*/g, "").trim()} value "${cell.slice(0, 40)}", catalog ${valueRule[2]} ${valueRule[1](e)}`);
+  }
+  const m = /^\*{0,2}\s*([+\-−]?\d{1,3})\b/.exec(cells[pointsCol] || "");
+  if (!m) return false;
+  const points = Number(m[1].replace("−", "-"));
+  if (/^rwep(?: total)?$/.test(label)) {
+    if (points !== e.rwep_score) say(`factor table RWEP ${points}, catalog ${e.rwep_score}`);
+    return true;
+  }
+  const hit = FACTOR_KEYS.find(([re]) => re.test(label));
+  if (!hit || !e.rwep_factors || typeof e.rwep_factors[hit[1]] !== "number") return false;
+  if (points !== e.rwep_factors[hit[1]]) say(`factor table ${cells[0].replace(/\*/g, "").trim()} ${points}, catalog rwep_factors.${hit[1]} ${e.rwep_factors[hit[1]]}`);
+  return true;
+}
+
+function checkSkill(file, catalog) {
+  const seen = new Set();
+  const failures = [];
+  const push = (msg) => { if (!seen.has(msg)) { seen.add(msg); failures.push(msg); } };
+  let compared = 0;
+  let header = null;
+  let rawHeader = null;
+  let sectionCve = null;
+  const lines = fs.readFileSync(file, "utf8").split(/\r?\n/);
+  lines.forEach((line, i) => {
+    const where = `${path.relative(ROOT, file).replace(/\\/g, "/")}:${i + 1}`;
+    if (/^#{1,6}\s/.test(line)) {
+      const headingIds = uniqueCves(line);
+      sectionCve = headingIds.length === 1 && catalog[headingIds[0]] ? headingIds[0] : null;
+    }
+    compared += compareParentheticals(line, catalog, (id, msg) => push(`${where} ${id}: ${msg}`));
+    if (/^\s*\|/.test(line)) {
+      const cells = splitRow(line);
+      if (header === null) { rawHeader = cells; header = cells.map(columnKind); return; }
+      if (isDivider(cells)) return;
+      if (sectionCve && uniqueCves(line).length === 0) {
+        if (compareFactorRow(cells, rawHeader, catalog[sectionCve], (msg) => push(`${where} ${sectionCve}: ${msg}`))) compared++;
+        return;
+      }
+      const idCell = cells.find((c) => uniqueCves(c).length > 0) || "";
+      if (/^(?:no|n\/a)\b/i.test(idCell) || /\bsee\s+CVE-/i.test(idCell)) return;
+      const ids = uniqueCves(idCell);
+      if (ids.length > 1) {
+        const known = ids.filter((id) => catalog[id]);
+        const scored = header.some((kind, k) => (kind === "cvss" || kind === "rwep") && /^\d/.test(plain(cells[k] || "")));
+        if (known.length && scored) push(`${where} ${ids.join(", ")}: ${UNATTRIBUTED}`);
+        return;
+      }
+      if (ids.length !== 1 || !catalog[ids[0]]) return;
+      const e = catalog[ids[0]];
+      compared++;
+      header.forEach((kind, k) => {
+        if (kind && cells[k] !== undefined) compareCell(kind, cells[k], e, (msg) => push(`${where} ${ids[0]}: ${msg}`));
+      });
+      return;
+    }
+    header = null;
+    const ids = uniqueCves(line);
+    if (ids.length > 1) {
+      const rest = plain(line.replace(PER_CVE, " "));
+      const m = SCORE.exec(rest);
+      if (ids.some((id) => catalog[id]) && m && !historical(rest, m)) push(`${where} ${ids.join(", ")}: ${UNATTRIBUTED}`);
+      return;
+    }
+    if (ids.length !== 1 || !catalog[ids[0]]) return;
+    compared++;
+    compareProse(line, catalog[ids[0]], (msg) => push(`${where} ${ids[0]}: ${msg}`));
+  });
+  return { failures, compared };
+}
+
+function check(skillsDir, catalog) {
+  const failures = [];
+  let compared = 0;
+  let files = 0;
+  for (const name of fs.readdirSync(skillsDir).sort()) {
+    const file = path.join(skillsDir, name, "skill.md");
+    if (!fs.existsSync(file)) continue;
+    files++;
+    const r = checkSkill(file, catalog);
+    failures.push(...r.failures);
+    compared += r.compared;
+  }
+  return { failures, compared, files };
+}
+
+function main() {
+  const skillsDir = process.argv[2] || path.join(ROOT, "skills");
+  const catalogFile = process.argv[3] || path.join(ROOT, "data", "cve-catalog.json");
+  const catalog = JSON.parse(fs.readFileSync(catalogFile, "utf8"));
+  const { failures, compared, files } = check(skillsDir, catalog);
+  if (failures.length) {
+    console.error("Skill catalog facts: FAIL");
+    for (const f of failures) console.error(`  ${f}`);
+    console.error(`\n${failures.length} skill ${failures.length === 1 ? "statement differs" : "statements differ"} from data/cve-catalog.json. Update the skill text to the catalog value.`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`Skill catalog facts: PASS — ${compared} CVE rows and lines across ${files} skills match data/cve-catalog.json`);
+}
+
+if (require.main === module) main();
+
+module.exports = { check, checkSkill, columnKind, yesNo };

package/scripts/predeploy.js

@@ -218,6 +218,14 @@ const GATES = [
     args: [path.join(ROOT, "scripts", "check-ism-control-references.js")],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
+  {
+    // A skill that states a CVE's CVSS, RWEP, KEV status, public-exploit or
+    // AI-discovery value must agree with data/cve-catalog.json.
+    name: "Skill catalog facts (skill CVE statements vs. the catalog)",
+    command: process.execPath,
+    args: [path.join(ROOT, "scripts", "check-skill-catalog-facts.js")],
+    ciJobName: "Data integrity (catalog + manifest snapshot)",
+  },
 ];
 
 function runGate(gate) {

package/skills/ai-attack-surface/skill.md

@@ -60,7 +60,7 @@ forward_watch:
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Chroma vector DB CWE-190 + CWE-362 chain by haehae; impacts RAG vector store integrity; track patch and downstream RAG advisory
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge overly permissive allowed list by Satoki Tsuji; AI training-stack supply-chain exposure; track patch and SBOM advisory
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM advisory
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # AI Attack Surface Assessment
@@ -141,7 +141,7 @@ AI-assisted reconnaissance is observed at 36,000 probes per second per campaign.
 
 ### 11. AI-Discovered + AI-Weaponized Supply-Chain Worms
 
-**CVE-2026-45321** — Mini Shai-Hulud TanStack npm worm (CVSS 9.6, ~150M weekly downloads across 42 @tanstack/* packages, CISA KEV pending). Disclosed 2026-05-11. The attack chain — Pwn-Request via `pull_request_target` on TanStack's bundle-size workflow, pnpm-store cache poisoning under the `actions/cache` key, and OIDC-token theft on the next main push — is engineering-grade and weaponizes three independently-benign primitives. While attribution (TeamPCP) records no AI-assisted exploit development for this specific instance, the worm pattern is exactly what AML.T0017-class capability development now produces at AI cadence: chained CI/CD primitives that no individual component owner recognises as exploitable. Treat the @tanstack/* surface as an exemplar of the broader AML.T0010 (AI Supply Chain Compromise) threat applied to JS toolchains that the AI assistant ecosystem depends on.
+**CVE-2026-45321** — Mini Shai-Hulud TanStack npm worm (CVSS 9.6, ~150M weekly downloads across 42 @tanstack/* packages, KEV-listed 2026-05-27). Disclosed 2026-05-11. The attack chain — Pwn-Request via `pull_request_target` on TanStack's bundle-size workflow, pnpm-store cache poisoning under the `actions/cache` key, and OIDC-token theft on the next main push — is engineering-grade and weaponizes three independently-benign primitives. While attribution (TeamPCP) records no AI-assisted exploit development for this specific instance, the worm pattern is exactly what AML.T0017-class capability development now produces at AI cadence: chained CI/CD primitives that no individual component owner recognises as exploitable. Treat the @tanstack/* surface as an exemplar of the broader AML.T0010 (AI Supply Chain Compromise) threat applied to JS toolchains that the AI assistant ecosystem depends on.
 
 ---
 

package/skills/cloud-iam-incident/skill.md

@@ -73,7 +73,7 @@ forward_watch:
   - AU ISM update enumerating cloud non-human-principal credential hygiene with explicit bearer-token TTL ceilings
   - DORA TLPT (JC 2024/40 RTS) first-cycle aggregate findings on cloud-account-compromise scenarios
   - AWS, GCP, and Azure shared-fate / shared-responsibility recalibration for federated-trust hygiene
-last_threat_review: "2026-05-15"
+last_threat_review: "2026-09-28"
 ---
 
 # Cloud IAM Incident Response (mid-2026)
@@ -164,11 +164,11 @@ The playbook `cloud-iam-incident` operationalises this skill into a seven-phase
 
 | Surface / CVE Class | CVSS | RWEP | CISA KEV | PoC Public | AI-Discovered | Active Exploitation | Patch / Mitigation Available | Sector-Aware Detection |
 |---|---|---|---|---|---|---|---|---|
-| CVE-2024-1709 ScreenConnect auth bypass (cloud-runtime adjacent) | 10.0 | 95 | Yes | Yes | n/a | Confirmed mass exploitation | Vendor patch | EDR + identity-protection |
-| CVE-2024-21626 runc container escape | 8.6 | 88 | Yes | Yes | n/a | Confirmed | Vendor patch | Container-runtime telemetry |
-| CVE-2024-3094 xz-utils supply-chain backdoor | 10.0 | 70 | Yes | Yes | No | Suspected | Vendor patch | SBOM-driven detection |
-| CVE-2026-20182 Cisco SD-WAN cloud-edge | 9.1 | 90 | Yes | Yes | Yes | Confirmed | Vendor patch | Network telemetry |
-| CVE-2026-30623 Anthropic MCP STDIO (cloud-hosted MCP servers) | 8.4 | 87 | Pending | Yes | Yes | Suspected | Vendor patch + config hardening | MCP-aware telemetry |
+| CVE-2024-1709 ScreenConnect auth bypass (cloud-runtime adjacent) | 10.0 | 75 | Yes (2024-02-22) | Yes | No | Confirmed mass exploitation | Vendor patch | EDR + identity-protection |
+| CVE-2024-21626 runc container escape | 8.6 | 35 | No | Yes | No | None recorded | Vendor patch | Container-runtime telemetry |
+| CVE-2024-3094 xz-utils supply-chain backdoor | 10.0 | 45 | No | Yes | No | Suspected | Vendor patch | SBOM-driven detection |
+| CVE-2026-20182 Cisco SD-WAN cloud-edge | 10.0 | 65 | Yes (2026-05-14) | No | No | Confirmed | Vendor patch | Network telemetry |
+| CVE-2026-30623 Anthropic MCP STDIO (cloud-hosted MCP servers) | 8.8 | 30 | No | Yes | No | Suspected | Vendor patch + config hardening | MCP-aware telemetry |
 | Leaked access key in public repo (Snowflake-AA24-class) | n/a (config) | high (exploited within minutes) | n/a | Documented at scale | n/a | Confirmed mass exploitation | Configuration hardening + key rotation + scraper-bot countermeasures | GitGuardian / Trufflehog firehose; behavioural detection on CreateAccessKey + key-use anomaly |
 | IMDSv1 SSRF / metadata exfil | n/a (design class) | high | n/a | Documented at scale | n/a | Confirmed ongoing | IMDSv2 enforcement | VPC Flow Logs + CloudTrail Insights |
 | OIDC trust-policy wildcard subject claim (fork-PR-to-takeover) | n/a (config class) | high | n/a | Demonstrated 2024-2026 | n/a | Suspected ongoing | Trust-policy tightening + per-environment OIDC trust | Trust-policy static analysis + assume-role telemetry |

package/skills/compliance-theater/skill.md

@@ -21,7 +21,7 @@ framework_gaps:
   - ALL-PROMPT-INJECTION-ACCESS-CONTROL
   - FedRAMP-Rev5-Moderate
   - CMMC-2.0-Level-2
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Compliance Theater Detection
@@ -102,16 +102,16 @@ The theater patterns most acutely under attack today are those backed by high-RW
 
 | Theater pattern | Evidence CVE | CVSS | RWEP tier | KEV | Public PoC | AI-accelerated | Live-patchable | Active exploitation |
 |---|---|---|---|---|---|---|---|---|
-| Patch Management Theater | CVE-2026-31431 (Copy Fail) | High | Critical | Yes | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
-| Vendor Management Theater (AI APIs / MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Partial | No | Yes (IDE update) | Suspected |
+| Patch Management Theater | CVE-2026-31431 (Copy Fail) | 7.8 | 90 | Yes (2026-05-01) | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
+| Vendor Management Theater (AI APIs / MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Yes | No | Yes (IDE update) | Suspected |
 | Access Control Theater (AI agents) | CVE-2025-53773 (Copilot YOLO-mode RCE) | 7.8 | 30 | No | Yes (demonstrated) | Yes (AI tooling enables) | Yes (SaaS push / IDE update) | Suspected |
-| Network Segmentation Theater (IPsec) | CVE-2026-43284 (Dirty Frag) | High | High | Pending | Partial | No | Limited (subsystem-dependent) | Suspected |
-| Patch Management Theater (Bug-Family Sequel) | CVE-2026-46300 (Fragnesia) | 7.8 | 20 (today) / 55+ on KEV | No (candidate) | Yes (one-liner vs /usr/bin/su) | No | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
+| Network Segmentation Theater (IPsec) | CVE-2026-43284 (Dirty Frag) | 8.8 | 53 | No | Yes (chain component) | Yes (AI-assisted discovery) | Limited (kpatch RHEL-only) | Suspected |
+| Patch Management Theater (Bug-Family Sequel) | CVE-2026-46300 (Fragnesia) | 7.8 | 35 (60 if KEV-listed) | No (candidate) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted discovery) | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
 | Incident Response Theater (AI pipeline) | SesameOp campaign + AML.T0096 | N/A | High | N/A | ATLAS-documented | Yes | N/A | Confirmed campaign |
 | Change Management Theater (AI models) | Continuous provider updates | N/A | Medium | N/A | N/A | N/A | N/A | Ongoing (uncontrolled) |
 | Security Awareness Theater (AI phishing) | AI-generated phishing baseline (82.6%) | N/A | High | N/A | Operational | Yes | N/A | Confirmed (industry-wide) |
 
-The first three rows (Critical / Critical / High RWEP with public PoC or active exploitation) are the most dangerous theater patterns to leave un-remediated. Pull authoritative scoring from `data/exploit-availability.json` and `data/cve-catalog.json` before producing the output.
+Rows with a high RWEP and a public PoC or confirmed exploitation, led by Copy Fail at RWEP 90, are the most dangerous theater patterns to leave un-remediated. Pull authoritative scoring from `data/exploit-availability.json` and `data/cve-catalog.json` before producing the output.
 
 ---
 

package/skills/container-runtime-security/skill.md

@@ -57,7 +57,7 @@ d3fend_refs:
   - D3-IOPR
 forward_watch:
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Container + Kubernetes Runtime Security (mid-2026)
@@ -145,7 +145,7 @@ CWE cross-walk (see `data/cwe-catalog.json`):
 | Class / CVE | CVSS | RWEP | CISA KEV | PoC Public | AI-Discovered | Active Exploitation | Patch / Mitigation | Admission-Detectable | Runtime-Detectable (Falco/Tetragon) |
 |---|---|---|---|---|---|---|---|---|---|
 | Host-kernel LPE as container escape — Copy Fail (CVE-2026-31431) | 7.8 | 90 (see `cve-catalog.json`) | Yes (2026-05-01, due 2026-05-15) | Yes — 732-byte script | Yes | Confirmed | Kernel patch + live-patch (kpatch/livepatch/kGraft) on supported distros; reboot rolling fleet on others | No (admission doesn't see kernel ops) | Yes — Falco/Tetragon catches the post-escape host operations; the in-kernel write itself is invisible to eBPF |
-| Container-runtime CVE class — runc CVE-2024-21626 ("LeakyVessels") family | 8.6 | varies (historical reference) | Yes (at time of disclosure) | Yes | No (manual disclosure) | Patched in modern fleets; brownfield self-managed clusters lag | runc / containerd / CRI-O upgrade | Partial — admission can require minimum runtime versions via node-feature labels | Yes — Tetragon can enforce SIGKILL on the abuse syscall sequence |
+| Container-runtime CVE class — runc CVE-2024-21626 ("LeakyVessels") family | 8.6 | 35 (see `cve-catalog.json`) | No | Yes | No (manual disclosure) | Patched in modern fleets; brownfield self-managed clusters lag | runc / containerd / CRI-O upgrade | Partial — admission can require minimum runtime versions via node-feature labels | Yes — Tetragon can enforce SIGKILL on the abuse syscall sequence |
 | Misconfigured PSS — `pod-security.kubernetes.io/enforce: privileged` on a workload namespace | n/a (class) | n/a | n/a | Trivial — `kubectl run --privileged` | Operator misconfig + AI-coding-assistant template drift | Routinely observed in incident response 2024–2026 | Set namespace label to `restricted`; remediate the workload | Yes — Kyverno PolicyReport + Kubescape surface this; PSA itself enforces on admit if label set |
 | Misconfigured RBAC — ServiceAccount with `create/patch` on `pods` or `secrets` cluster-wide | n/a (class) | n/a | n/a | Trivial — `can-i --list --as=system:serviceaccount:...` | Operator misconfig | Routinely observed | Replace wildcard ClusterRoles with scoped Roles; deny `automountServiceAccountToken: true` by default | Yes — Kyverno + OPA policies; kube-bench check | Yes — Falco detects token use from unexpected ServiceAccount |
 | Exposed kubelet 10250 / 10255 | n/a (class) | n/a | n/a | Trivial — Shodan / Censys queries; Peirates | n/a | Confirmed in self-managed / CI / lab clusters | Network policy default-deny; kubelet authentication + authorization; firewall | No (network-layer control) | Yes — Cilium L7 policy + Falco network rule |

package/skills/exploit-scoring/skill.md

@@ -21,7 +21,7 @@ attack_refs: []
 framework_gaps:
   - CWE-Top-25-2024-meta
   - CIS-Controls-v8-Control7
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Real-World Exploit Priority (RWEP) Scoring
@@ -91,11 +91,11 @@ How each RWEP factor maps to a real CVE in `data/cve-catalog.json`:
 | CVE | KEV | PoC | AI-Discovered | Active Exploitation | Blast Radius | Patch | Live Patch | RWEP | CVSS |
 |---|---|---|---|---|---|---|---|---|---|
 | CVE-2026-31431 (Copy Fail) | Yes | Yes (732-byte) | Yes | Confirmed | All Linux ≥ 4.14 (30) | Yes | Yes (kpatch/livepatch/kGraft) | 90 | 7.8 |
-| CVE-2026-43284 (Dirty Frag ESP/IPsec) | No | Yes (chain) | No | Suspected | IPsec-using systems (18) | Yes | RHEL-only kpatch | 38 | 7.8 |
-| CVE-2026-43500 (Dirty Frag RxRPC) | No | Yes (chain) | No | Suspected | RxRPC-loaded systems | Yes | Partial | 32 | 7.6 |
-| CVE-2026-46300 (Fragnesia) | No (likely candidate) | Yes (one-liner vs /usr/bin/su) | No | None observed | Linux >= 5.10 with esp4/esp6/rxrpc loaded (25) | Yes | Yes (kpatch / canonical-livepatch / KernelCare) | 20 | 7.8 |
-| CVE-2025-53773 (Copilot YOLO-mode RCE) | No | Yes (demonstrated) | Yes (AI tooling enables) | Suspected | GitHub Copilot users (15) | Yes (SaaS) | Yes (SaaS push) | 30 | 7.8 |
-| CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Partial | No | Suspected (supply-chain) | 150M+ downloads, local-vector + supply-chain prereq | Yes | Yes (IDE update) | 35 | 8.0 |
+| CVE-2026-43284 (Dirty Frag ESP/IPsec) | No | Yes (chain) | Yes (AI-assisted) | Suspected | IPsec-using systems (18) | Yes | RHEL-only kpatch | 53 | 8.8 |
+| CVE-2026-43500 (Dirty Frag RxRPC) | No | Yes (chain) | Yes (AI-assisted) | Suspected | RxRPC-loaded systems (12) | Yes | No | 47 | 7.6 |
+| CVE-2026-46300 (Fragnesia) | No (likely candidate) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted) | None observed | Linux >= 5.10 with esp4/esp6/rxrpc loaded (25) | Yes | Yes (kpatch / canonical-livepatch / KernelCare) | 35 | 7.8 |
+| CVE-2025-53773 (Copilot YOLO-mode RCE) | No | Yes (demonstrated) | No (AI-assisted weaponization) | Suspected | GitHub Copilot users (10) | Yes (SaaS) | Yes (SaaS push) | 30 | 7.8 |
+| CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Yes | No | Suspected (supply-chain) | 150M+ downloads, local-vector + supply-chain prereq (30) | Yes | Yes (IDE update) | 35 | 8.0 |
 
 Key reads: Copy Fail (RWEP 90, CVSS 7.8) and Windsurf MCP (RWEP 35, CVSS 8.0) sit at opposite ends of the exploitation-evidence axis — Copy Fail is the canonical case of CVSS under-prioritization (KEV + deterministic public PoC + AI-discovered + broad blast-radius dominate); Windsurf MCP is the canonical case of CVSS-vector blindness (the AV:L local-attack vector plus the supply-chain prerequisite throttle real exploitation rate even after CVSS was corrected from 9.8 to 8.0).
 
@@ -184,15 +184,15 @@ RWEP = min(100, max(0,
 |---|---|---|
 | CISA KEV | No | 0 |
 | PoC Public | Yes (chain component) | +20 |
-| AI-Assisted | No | 0 |
+| AI-Assisted | Yes (discovered with AI assistance, per Sysdig) | +15 |
 | Active Exploitation | Suspected | +10 (partial) |
 | Blast Radius | IPsec-using systems, kernel 5.x | +18 |
 | Patch Available | Yes | -15 |
 | Live Patch Available | No (kpatch RHEL-only — not broadly available) | 0 |
 | Reboot Required | Yes | +5 |
-| **RWEP** | | **38** |
+| **RWEP** | | **53** |
 
-**Interpretation:** No CISA KEV, suspected (not confirmed) exploitation, and no broad live-patch availability. RWEP 38 vs. CVSS-equivalent 78 — RWEP shows this is less urgent than CVSS suggests absent confirmed exploitation at scale. Critical contextual risk: any host using IPsec for compliance controls (SC-8/SC-28) cannot claim those controls as compensating controls while this CVE is unpatched — the exploit runs through the IPsec implementation.
+**Interpretation:** No CISA KEV, suspected (not confirmed) exploitation, and no broad live-patch availability. RWEP 53 vs. CVSS-equivalent 88 — RWEP shows this is less urgent than CVSS suggests absent confirmed exploitation at scale. Critical contextual risk: any host using IPsec for compliance controls (SC-8/SC-28) cannot claim those controls as compensating controls while this CVE is unpatched — the exploit runs through the IPsec implementation.
 
 ---
 
@@ -202,15 +202,17 @@ RWEP = min(100, max(0,
 |---|---|---|
 | CISA KEV | No (likely candidate within days of disclosure) | 0 |
 | PoC Public | Yes (one-line root shell vs /usr/bin/su) | +20 |
-| AI-Assisted | No (human-discovered by V12 security team) | 0 |
+| AI-Assisted | Yes (found by William Bowling of Zellic with the company's AI-agentic auditing tool) | +15 |
 | Active Exploitation | None observed | 0 |
 | Blast Radius | Linux >= 5.10 with esp4/esp6/rxrpc loaded | +25 |
 | Patch Available | Yes (testing on AlmaLinux / CloudLinux; upstream on netdev) | -15 |
 | Live Patch Available | Yes (kpatch / canonical-livepatch / KernelCare) | -10 |
 | Reboot Required | No (module-unload mitigation is non-reboot) | 0 |
-| **RWEP** | | **20** |
+| **RWEP** | | **35** |
+
+**Interpretation:** RWEP 35 today places Fragnesia in the standard-30-day patch band. Two factors will move this fast: (a) a CISA KEV listing adds +25 (RWEP 60 → 72-hour band), and (b) confirmed active exploitation adds another +20 (RWEP 80 → 24-hour band). Operators tracking RWEP should pre-stage the response now while the score is low so the KEV-listing event triggers an already-rehearsed playbook rather than a from-scratch decision. RWEP 35 vs. RWEP 90 for Copy Fail is the canonical "same CVSS band, different urgency" pair for 2026.
 
-**Interpretation:** RWEP 20 today places Fragnesia in the standard-30-day patch band. Two factors will move this fast: (a) a CISA KEV listing adds +25 (RWEP 45 → 7-day band), and (b) confirmed active exploitation adds another +20 (RWEP 65 → 72-hour band). Operators tracking RWEP should pre-stage the response now while the score is low so the KEV-listing event triggers an already-rehearsed playbook rather than a from-scratch decision. Critical operational insight: Fragnesia is the sibling bug introduced by the Dirty Frag patch, and the module-unload mitigation set (`blacklist esp4 / esp6 / rxrpc`) is identical to Dirty Frag's — operators already mitigated for CVE-2026-43284 / CVE-2026-43500 are already mitigated for Fragnesia at zero additional operational cost. RWEP 20 vs. RWEP 90 for Copy Fail is the canonical "same CVSS band, different urgency" pair for 2026.
+Critical operational insight: Fragnesia is the sibling bug introduced by the Dirty Frag patch, and the module-unload mitigation set (`blacklist esp4 / esp6 / rxrpc`) is identical to Dirty Frag's — operators already mitigated for CVE-2026-43284 / CVE-2026-43500 are already mitigated for Fragnesia at zero additional operational cost.
 
 ---
 
@@ -237,10 +239,10 @@ RWEP = min(100, max(0,
 | Factor | Value | Points |
 |---|---|---|
 | CISA KEV | No | 0 |
-| PoC Public | Partial | +10 |
+| PoC Public | Yes | +20 |
 | AI-Assisted | No | 0 |
 | Active Exploitation | Suspected (supply chain targeting) | +10 |
-| Blast Radius | 150M+ MCP-capable assistant downloads, local-vector + supply-chain prerequisite | +20 |
+| Blast Radius | 150M+ MCP-capable assistant downloads, local-vector + supply-chain prerequisite | +30 |
 | Patch Available | Yes | -15 |
 | Live Patch Available | Yes (IDE update) | -10 |
 | Reboot Required | No | 0 |

package/skills/framework-gap-analysis/skill.md

@@ -20,7 +20,7 @@ data_deps:
 atlas_refs: []
 attack_refs: []
 framework_gaps: []
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Framework Gap Analysis
@@ -96,11 +96,11 @@ This skill consumes the matrix produced upstream by the exploit-scoring skill. T
 
 | CVE | CVSS | RWEP | KEV | Public PoC | AI-accelerated | Live-patchable | Active exploitation |
 |---|---|---|---|---|---|---|---|
-| CVE-2026-31431 (Copy Fail) | High | Critical | Yes | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
-| CVE-2026-43284 (Dirty Frag) | High | High | Pending | Partial | No | Limited (subsystem-dependent) | Suspected |
-| CVE-2026-46300 (Fragnesia) | 7.8 | 20 (today) / 55+ on KEV | No (candidate) | Yes (one-liner vs /usr/bin/su) | No | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
+| CVE-2026-31431 (Copy Fail) | 7.8 | 90 | Yes (2026-05-01) | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
+| CVE-2026-43284 (Dirty Frag) | 8.8 | 53 | No | Yes (chain component) | Yes (AI-assisted discovery) | Limited (kpatch RHEL-only) | Suspected |
+| CVE-2026-46300 (Fragnesia) | 7.8 | 35 (60 if KEV-listed) | No (candidate) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted discovery) | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
 | CVE-2025-53773 (Copilot YOLO-mode RCE) | 7.8 | 30 | No | Yes (demonstrated) | Yes (AI tooling enables) | Yes (SaaS push / IDE update) | Suspected |
-| CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Partial | No | Yes (IDE update) | Suspected |
+| CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Yes | No | Yes (IDE update) | Suspected |
 
 When a gap analysis cites a CVE not in this matrix, the analyst must populate the row from `data/cve-catalog.json` before producing the declaration. A declaration without an evidence row is incomplete.
 

package/skills/idp-incident-response/skill.md

@@ -76,7 +76,7 @@ forward_watch:
   - NIS2 implementing-act revision enumerating federated-identity control-plane indicators
   - Cross-tenant access settings evolution at Entra ID — partner-tenant attestation cadence and revocation latency
   - PSD3 / PSR final text on agent-initiated payments and the IdP-mediated agent-attestation surface
-last_threat_review: "2026-05-15"
+last_threat_review: "2026-09-28"
 ---
 
 # Identity-Provider Incident Response (mid-2026)
@@ -149,9 +149,9 @@ Agentic AI is the emerging structural problem on top. AI agents operating on beh
 | Help-desk social engineering (Scattered Spider) | n/a (social engineering) | high (MGM USD 100M, Caesars USD 15M as public reference) | n/a | Demonstrated at scale | n/a (AI-augmented reconnaissance) | Confirmed ongoing 2022-2026 | Mitigation only — out-of-band identity verification, video-callback to previously-registered number, knowledge-based + government-ID verification, never phone-only | n/a | Help-desk-system audit; vendor-fragmented |
 | SAML token forgery (Golden SAML / NobleSAML class) | n/a (design class) | high (state-actor priority) | n/a | Public research + active campaigns | n/a | Suspected ongoing against hybrid-identity tenants | Mitigation — signing-key rotation + signing-state attestation + audit-log alerting on signing-cert modification | n/a | Tenant audit log if signing-state modification alerts configured |
 | ScreenConnect identity-class CVE | 7.5 (CVSS) | high (CISA KEV) | Yes (2024-02) | Yes — public PoC | No | Confirmed exploitation against IdP-adjacent MSP surface | Yes — vendor patch | Patch-class | EDR + tenant audit if integration logged |
-| CVE-2024-1709 ScreenConnect authentication bypass | 10.0 | 95 | Yes | Yes | No | Confirmed exploitation 2024 | Yes | Limited — appliance reboot window | Vendor-side patching + IdP-side conditional-access tightening |
-| CVE-2023-3519 Citrix NetScaler RCE | 9.8 | 92 | Yes | Yes | No | Confirmed exploitation 2023-2024 (financial-sector and federal targets) | Yes | Limited — appliance reboot | Network telemetry + IdP-tenant access-pattern alerting |
-| CVE-2026-30615 Windsurf MCP — adjacent identity surface | 8.6 | 88 | Forward-watched | Yes | Yes | Suspected | Mitigation + vendor patch | n/a | MCP-tool-trust telemetry |
+| CVE-2024-1709 ScreenConnect authentication bypass | 10.0 | 75 | Yes (2024-02-22) | Yes | No | Confirmed exploitation 2024 | Yes | No | Vendor-side patching + IdP-side conditional-access tightening |
+| CVE-2023-3519 Citrix NetScaler RCE | 9.8 | 80 | Yes (2023-07-19) | Yes | No | Confirmed exploitation 2023-2024 (financial-sector and federal targets) | Yes | No | Network telemetry + IdP-tenant access-pattern alerting |
+| CVE-2026-30615 Windsurf MCP — adjacent identity surface | 8.0 | 35 | No | Yes | No | Suspected | Mitigation + vendor patch | Yes (IDE update) | MCP-tool-trust telemetry |
 
 **Honest gap statement.** IdP-specific CVEs (Okta Auth0 Workforce CVEs, Entra ID Graph CVEs, Auth0 platform CVEs, Ping platform CVEs, OneLogin platform CVEs) are not exhaustively inventoried in `data/cve-catalog.json`. Authoritative sources: vendor advisories (Okta Security, Microsoft MSRC + Security Update Guide, Auth0 Security Advisories, Ping Identity Security Notices, One Identity Customer Advisory), CISA KEV for cross-sector exposure, CISA AA24 series for federal-targeting advisories, and sector intel feeds. Forward-watched.