@blamejs/exceptd-skills 0.9.1

package/manifest-snapshot.json

@@ -0,0 +1,1833 @@
+{
+  "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
+  "_generated_at": "2026-05-11T23:30:00.566Z",
+  "atlas_version": "5.1.0",
+  "skill_count": 38,
+  "skills": [
+    {
+      "name": "age-gates-child-safety",
+      "version": "1.0.0",
+      "triggers": [
+        "age assurance",
+        "age gate",
+        "age gates",
+        "age verification",
+        "california aadc",
+        "child online safety",
+        "child safety",
+        "children's code",
+        "children's online safety",
+        "cipa",
+        "coppa",
+        "csam",
+        "dsa article 28",
+        "esafety",
+        "gdpr article 8",
+        "kosa",
+        "ofcom",
+        "parental consent",
+        "uk online safety act"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "dlp-controls.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T1078",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.30",
+        "NIST-800-53-AC-2",
+        "SOC2-CC6-logical-access"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-200",
+        "CWE-287",
+        "CWE-862"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "ai-attack-surface",
+      "version": "1.0.0",
+      "triggers": [
+        "ai attack surface",
+        "ai red team",
+        "ai security assessment",
+        "ai threat model",
+        "llm security",
+        "model security",
+        "prompt injection",
+        "promptflux",
+        "promptsteal"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0016",
+        "AML.T0017",
+        "AML.T0018",
+        "AML.T0020",
+        "AML.T0043",
+        "AML.T0051",
+        "AML.T0054",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1059",
+        "T1190",
+        "T1566"
+      ],
+      "framework_gaps": [
+        "ALL-AI-PIPELINE-INTEGRITY",
+        "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
+        "ISO-27001-2022-A.8.28",
+        "ISO-IEC-23894-2023-clause-7",
+        "NIST-800-53-AC-2",
+        "NIST-800-53-SI-3",
+        "OWASP-LLM-Top-10-2025-LLM01",
+        "OWASP-LLM-Top-10-2025-LLM02",
+        "SOC2-CC6-logical-access"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1039",
+        "CWE-1426",
+        "CWE-94"
+      ],
+      "d3fend_refs": [
+        "D3-IOPR",
+        "D3-NTA"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "ai-c2-detection",
+      "version": "1.0.0",
+      "triggers": [
+        "ai api abuse",
+        "ai c2",
+        "ai command and control",
+        "aml.t0096",
+        "covert channel ai",
+        "llm c2",
+        "promptflux",
+        "promptsteal",
+        "sesameop"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1071",
+        "T1102",
+        "T1568"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.16",
+        "NIST-800-53-SC-7",
+        "NIST-800-53-SI-3",
+        "SOC2-CC7-anomaly-detection"
+      ],
+      "rfc_refs": [
+        "RFC-8446",
+        "RFC-9000",
+        "RFC-9114",
+        "RFC-9180",
+        "RFC-9421",
+        "RFC-9458"
+      ],
+      "cwe_refs": [],
+      "d3fend_refs": [
+        "D3-CA",
+        "D3-CSPP",
+        "D3-DA",
+        "D3-IOPR",
+        "D3-NI",
+        "D3-NTA",
+        "D3-NTPM"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "ai-risk-management",
+      "version": "1.0.0",
+      "triggers": [
+        "ai governance",
+        "ai impact assessment",
+        "ai incident response",
+        "ai management system",
+        "ai red team program",
+        "ai risk management",
+        "ai vendor risk",
+        "aia",
+        "dpia ai",
+        "eu ai act high-risk",
+        "iso 23894",
+        "iso 42001",
+        "nist ai rmf"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0051",
+        "AML.T0096"
+      ],
+      "attack_refs": [],
+      "framework_gaps": [
+        "ISO-IEC-23894-2023-clause-7",
+        "ISO-IEC-42001-2023-clause-6.1.2",
+        "NIST-AI-RMF-MEASURE-2.5",
+        "OWASP-LLM-Top-10-2025-LLM01"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1039",
+        "CWE-1426"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "api-security",
+      "version": "1.0.0",
+      "triggers": [
+        "ai api security",
+        "api gateway",
+        "api security",
+        "bfla",
+        "bola",
+        "graphql security",
+        "grpc security",
+        "mass assignment",
+        "mcp transport",
+        "openapi security",
+        "owasp api top 10",
+        "rate limiting",
+        "rest security",
+        "websocket security"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1190",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.28",
+        "NIST-800-218-SSDF",
+        "NIST-800-53-AC-2",
+        "OWASP-ASVS-v5.0-V14"
+      ],
+      "rfc_refs": [
+        "RFC-6749",
+        "RFC-7519",
+        "RFC-8446",
+        "RFC-8725",
+        "RFC-9114",
+        "RFC-9421",
+        "RFC-9700"
+      ],
+      "cwe_refs": [
+        "CWE-1188",
+        "CWE-200",
+        "CWE-22",
+        "CWE-287",
+        "CWE-352",
+        "CWE-77",
+        "CWE-862",
+        "CWE-863",
+        "CWE-918"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "attack-surface-pentest",
+      "version": "1.0.0",
+      "triggers": [
+        "adversary emulation",
+        "asm",
+        "asset inventory",
+        "attack surface",
+        "external footprint",
+        "pen test",
+        "penetration testing",
+        "red team",
+        "threat-led testing",
+        "tiber-eu",
+        "tlpt"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010",
+        "AML.T0043",
+        "AML.T0051"
+      ],
+      "attack_refs": [
+        "T1059",
+        "T1078",
+        "T1133",
+        "T1190"
+      ],
+      "framework_gaps": [
+        "NIS2-Art21-patch-management",
+        "NIST-800-115",
+        "OWASP-Pen-Testing-Guide-v5",
+        "PTES-Pre-engagement"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1395",
+        "CWE-22",
+        "CWE-269",
+        "CWE-352",
+        "CWE-434",
+        "CWE-732",
+        "CWE-78",
+        "CWE-787",
+        "CWE-79",
+        "CWE-89",
+        "CWE-918"
+      ],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-EAL",
+        "D3-NTA"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "cloud-security",
+      "version": "1.0.0",
+      "triggers": [
+        "aws security",
+        "azure security",
+        "cloud iam",
+        "cloud runtime",
+        "cloud security",
+        "cnapp",
+        "csa ccm",
+        "cspm",
+        "cwpp",
+        "falco",
+        "gcp security",
+        "irsa",
+        "multi cloud",
+        "shared responsibility",
+        "workload identity"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010",
+        "AML.T0017"
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1190",
+        "T1530",
+        "T1552"
+      ],
+      "framework_gaps": [
+        "FedRAMP-Rev5-Moderate",
+        "ISO-27001-2022-A.8.30",
+        "NIST-800-53-CM-7",
+        "SOC2-CC9-vendor-management"
+      ],
+      "rfc_refs": [
+        "RFC-7519",
+        "RFC-8446",
+        "RFC-8725",
+        "RFC-9180"
+      ],
+      "cwe_refs": [
+        "CWE-1188",
+        "CWE-200",
+        "CWE-287",
+        "CWE-732",
+        "CWE-798",
+        "CWE-862"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "compliance-theater",
+      "version": "1.0.0",
+      "triggers": [
+        "audit but exposed",
+        "audit theater",
+        "checkbox security",
+        "compliance gap",
+        "compliance theater",
+        "compliant but vulnerable",
+        "paper compliance"
+      ],
+      "data_deps": [
+        "cve-catalog.json",
+        "exploit-availability.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [
+        "ALL-AI-PIPELINE-INTEGRITY",
+        "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
+        "CMMC-2.0-Level-2",
+        "FedRAMP-Rev5-Moderate"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "container-runtime-security",
+      "version": "1.0.0",
+      "triggers": [
+        "admission controller",
+        "cilium",
+        "cis kubernetes",
+        "container security",
+        "falco",
+        "gatekeeper",
+        "k8s security",
+        "kserve",
+        "kubernetes security",
+        "kyverno",
+        "networkpolicy",
+        "nsa hardening",
+        "opa",
+        "pod security standards",
+        "sigstore policy",
+        "tetragon",
+        "vllm"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010"
+      ],
+      "attack_refs": [
+        "T1068",
+        "T1190",
+        "T1610",
+        "T1611"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.28",
+        "NIST-800-53-CM-7",
+        "SLSA-v1.0-Build-L3"
+      ],
+      "rfc_refs": [
+        "RFC-8032",
+        "RFC-8446"
+      ],
+      "cwe_refs": [
+        "CWE-1188",
+        "CWE-1395",
+        "CWE-269",
+        "CWE-732",
+        "CWE-787"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "coordinated-vuln-disclosure",
+      "version": "1.0.0",
+      "triggers": [
+        "90-day disclosure",
+        "bug bounty",
+        "coordinated vulnerability disclosure",
+        "csaf",
+        "cvd",
+        "iso 29147",
+        "iso 30111",
+        "project zero",
+        "responsible disclosure",
+        "security.txt",
+        "vdp",
+        "vulnerability disclosure program"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.8",
+        "NIST-800-218-SSDF",
+        "SOC2-CC9-vendor-management"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1357"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "defensive-countermeasure-mapping",
+      "version": "1.0.0",
+      "triggers": [
+        "blue team",
+        "blue team map",
+        "control mapping",
+        "countermeasure",
+        "d3fend",
+        "defense in depth",
+        "defensive coverage",
+        "defensive mapping",
+        "least privilege",
+        "mitigation",
+        "zero trust"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "dlp-controls.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [
+        "D3-ASLR",
+        "D3-CA",
+        "D3-CBAN",
+        "D3-CSPP",
+        "D3-DA",
+        "D3-EAL",
+        "D3-EHB",
+        "D3-FAPA",
+        "D3-FE",
+        "D3-IOPR",
+        "D3-MENCR",
+        "D3-MFA",
+        "D3-NI",
+        "D3-NTA",
+        "D3-NTPM",
+        "D3-PA",
+        "D3-PHRA",
+        "D3-PSEP",
+        "D3-RPA",
+        "D3-SCP"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "dlp-gap-analysis",
+      "version": "1.0.0",
+      "triggers": [
+        "clipboard ai paste",
+        "copilot data leak",
+        "data classification",
+        "data exfiltration",
+        "data leak",
+        "data loss prevention",
+        "dlp",
+        "egress",
+        "embedding store exfil",
+        "exfiltration",
+        "llm dlp",
+        "mcp tool arg dlp",
+        "prompt dlp",
+        "rag exfil"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "dlp-controls.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0051",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1041",
+        "T1213",
+        "T1530",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "HIPAA-Security-Rule-164.312(a)(1)",
+        "ISO-27001-2022-A.8.16",
+        "ISO-IEC-42001-2023-clause-6.1.2",
+        "NIST-800-53-SC-28",
+        "NIST-800-53-SC-7",
+        "SOC2-CC7-anomaly-detection"
+      ],
+      "rfc_refs": [
+        "RFC-8446",
+        "RFC-9458"
+      ],
+      "cwe_refs": [
+        "CWE-1426",
+        "CWE-200"
+      ],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-EAL",
+        "D3-IOPR",
+        "D3-NTA",
+        "D3-NTPM"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "email-security-anti-phishing",
+      "version": "1.0.0",
+      "triggers": [
+        "ai phishing",
+        "anti-phishing",
+        "arc",
+        "bec",
+        "bimi",
+        "business email compromise",
+        "deepfake phishing",
+        "dkim",
+        "dmarc",
+        "email security",
+        "mta-sts",
+        "phishing",
+        "secure email gateway",
+        "spear phishing",
+        "spf",
+        "tlsrpt",
+        "vishing"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "dlp-controls.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T1078",
+        "T1566",
+        "T1566.001",
+        "T1566.002",
+        "T1566.003"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.16",
+        "NIST-800-53-SI-3",
+        "SOC2-CC7-anomaly-detection"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "exploit-scoring",
+      "version": "1.0.0",
+      "triggers": [
+        "beyond cvss",
+        "cve priority",
+        "exploit scoring",
+        "how bad is this cve",
+        "patch priority",
+        "prioritize cve",
+        "real world priority",
+        "rwep"
+      ],
+      "data_deps": [
+        "cve-catalog.json",
+        "exploit-availability.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [
+        "CIS-Controls-v8-Control7",
+        "CWE-Top-25-2024-meta"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "framework-gap-analysis",
+      "version": "1.0.0",
+      "triggers": [
+        "compliance gap",
+        "control gap",
+        "framework gap",
+        "iso 27001 gap",
+        "nis2 gap",
+        "nist gap",
+        "pci gap",
+        "soc 2 gap",
+        "why doesn't this control cover"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "fuzz-testing-strategy",
+      "version": "1.0.0",
+      "triggers": [
+        "afl",
+        "ai-assisted fuzz",
+        "api fuzz",
+        "continuous fuzz",
+        "coverage-guided fuzz",
+        "fuzz testing",
+        "fuzzing",
+        "libfuzzer",
+        "oss-fuzz",
+        "prompt fuzz",
+        "syzkaller"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0043"
+      ],
+      "attack_refs": [
+        "T1190"
+      ],
+      "framework_gaps": [
+        "NIST-800-115",
+        "NIST-800-218-SSDF",
+        "OWASP-ASVS-v5.0-V14"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-125",
+        "CWE-20",
+        "CWE-362",
+        "CWE-416",
+        "CWE-78",
+        "CWE-787"
+      ],
+      "d3fend_refs": [
+        "D3-EAL",
+        "D3-IOPR",
+        "D3-PSEP"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "global-grc",
+      "version": "1.0.0",
+      "triggers": [
+        "apra cps 234",
+        "cert-in",
+        "cyber resilience act",
+        "dora compliance",
+        "essential 8",
+        "eu ai act",
+        "gdpr security",
+        "global compliance",
+        "global grc",
+        "international compliance",
+        "mas trm",
+        "multi-jurisdiction",
+        "nis2"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "identity-assurance",
+      "version": "1.0.0",
+      "triggers": [
+        "aal",
+        "agent identity",
+        "fal",
+        "federation",
+        "fido2",
+        "ial",
+        "identity assurance",
+        "nist 800-63",
+        "oidc",
+        "passkey",
+        "phishing-resistant",
+        "saml",
+        "scim",
+        "service account",
+        "webauthn",
+        "workload identity"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0051"
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1110",
+        "T1556"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.30",
+        "NIST-800-53-AC-2",
+        "NIST-800-63B-rev4",
+        "PSD2-RTS-SCA",
+        "SOC2-CC6-logical-access"
+      ],
+      "rfc_refs": [
+        "RFC-6749",
+        "RFC-7519",
+        "RFC-8032",
+        "RFC-8725",
+        "RFC-9700"
+      ],
+      "cwe_refs": [
+        "CWE-269",
+        "CWE-287",
+        "CWE-306",
+        "CWE-732",
+        "CWE-798",
+        "CWE-862",
+        "CWE-863"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "incident-response-playbook",
+      "version": "1.0.0",
+      "triggers": [
+        "ai incident",
+        "blue team",
+        "breach notification",
+        "csirt",
+        "incident handler",
+        "incident response",
+        "ir playbook",
+        "iso 27035",
+        "model exfiltration incident",
+        "nist 800-61",
+        "picerl",
+        "prompt injection incident",
+        "soc playbook"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0051",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1041",
+        "T1078",
+        "T1486",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.16",
+        "NIST-800-53-AC-2",
+        "SOC2-CC7-anomaly-detection"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "kernel-lpe-triage",
+      "version": "1.0.0",
+      "triggers": [
+        "copy fail",
+        "cve-2026-31431",
+        "cve-2026-43284",
+        "dirty frag",
+        "kernel lpe",
+        "kernel patch",
+        "linux root",
+        "live kernel patch",
+        "privilege escalation"
+      ],
+      "data_deps": [
+        "cve-catalog.json",
+        "exploit-availability.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T1068",
+        "T1548.001"
+      ],
+      "framework_gaps": [
+        "CIS-Controls-v8-Control7",
+        "ISO-27001-2022-A.8.8",
+        "NIS2-Art21-patch-management",
+        "NIST-800-53-SC-8",
+        "NIST-800-53-SI-2",
+        "PCI-DSS-4.0-6.3.3"
+      ],
+      "rfc_refs": [
+        "RFC-4301",
+        "RFC-4303",
+        "RFC-7296"
+      ],
+      "cwe_refs": [
+        "CWE-125",
+        "CWE-362",
+        "CWE-416",
+        "CWE-672",
+        "CWE-787"
+      ],
+      "d3fend_refs": [
+        "D3-ASLR",
+        "D3-EAL",
+        "D3-PHRA",
+        "D3-PSEP"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "mcp-agent-trust",
+      "version": "1.0.0",
+      "triggers": [
+        "agent trust",
+        "ai agent security",
+        "claude code security",
+        "cursor security",
+        "cve-2026-30615",
+        "mcp rce",
+        "mcp security",
+        "model context protocol",
+        "tool trust",
+        "windsurf security"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010",
+        "AML.T0016",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1059",
+        "T1190",
+        "T1195.001"
+      ],
+      "framework_gaps": [
+        "ALL-MCP-TOOL-TRUST",
+        "ISO-27001-2022-A.8.30",
+        "NIST-800-53-CM-7",
+        "NIST-800-53-SA-12",
+        "OWASP-LLM-Top-10-2025-LLM06",
+        "SOC2-CC9-vendor-management",
+        "SWIFT-CSCF-v2026-1.1"
+      ],
+      "rfc_refs": [
+        "RFC-6749",
+        "RFC-7519",
+        "RFC-8446",
+        "RFC-8725",
+        "RFC-9114",
+        "RFC-9421",
+        "RFC-9700"
+      ],
+      "cwe_refs": [
+        "CWE-22",
+        "CWE-345",
+        "CWE-352",
+        "CWE-434",
+        "CWE-494",
+        "CWE-77",
+        "CWE-918",
+        "CWE-94"
+      ],
+      "d3fend_refs": [
+        "D3-CBAN",
+        "D3-CSPP",
+        "D3-EAL",
+        "D3-EHB",
+        "D3-MFA"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "mlops-security",
+      "version": "1.0.0",
+      "triggers": [
+        "azure ml",
+        "data card",
+        "drift detection",
+        "feature store",
+        "hugging face",
+        "kubeflow",
+        "ml pipeline security",
+        "mlflow",
+        "mlops security",
+        "model card",
+        "model monitoring",
+        "model registry security",
+        "model signing",
+        "sagemaker",
+        "training data integrity",
+        "vertex ai"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010",
+        "AML.T0017",
+        "AML.T0018",
+        "AML.T0020",
+        "AML.T0043"
+      ],
+      "attack_refs": [
+        "T1195.001",
+        "T1565"
+      ],
+      "framework_gaps": [
+        "ISO-IEC-42001-2023-clause-6.1.2",
+        "NIST-800-218-SSDF",
+        "NIST-AI-RMF-MEASURE-2.5",
+        "OWASP-LLM-Top-10-2025-LLM08",
+        "SLSA-v1.0-Build-L3"
+      ],
+      "rfc_refs": [
+        "RFC-8032"
+      ],
+      "cwe_refs": [
+        "CWE-1357",
+        "CWE-1395",
+        "CWE-1426",
+        "CWE-502"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "ot-ics-security",
+      "version": "1.0.0",
+      "triggers": [
+        "air gap",
+        "hmi security",
+        "ics security",
+        "iec 62443",
+        "industrial control",
+        "it ot convergence",
+        "level 0",
+        "level 1",
+        "nerc cip",
+        "nist 800-82",
+        "operational technology",
+        "ot security",
+        "plc security",
+        "purdue",
+        "scada"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010"
+      ],
+      "attack_refs": [
+        "T0855",
+        "T0883",
+        "T1068",
+        "T1190"
+      ],
+      "framework_gaps": [
+        "IEC-62443-3-3",
+        "NERC-CIP-007-6-R4",
+        "NIS2-Art21-patch-management",
+        "NIST-800-82r3"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1037",
+        "CWE-287",
+        "CWE-306",
+        "CWE-798"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "policy-exception-gen",
+      "version": "1.0.0",
+      "triggers": [
+        "ai pipeline exception",
+        "compensating control",
+        "control exception",
+        "ephemeral exception",
+        "exception request",
+        "policy exception",
+        "serverless exception",
+        "zero trust exception"
+      ],
+      "data_deps": [
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1188"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "pqc-first",
+      "version": "1.0.0",
+      "triggers": [
+        "crypto migration",
+        "fips 203",
+        "fips 204",
+        "fips 205",
+        "harvest now decrypt later",
+        "ml-dsa",
+        "ml-kem",
+        "openssl pqc",
+        "post-quantum",
+        "pqc",
+        "quantum cryptography",
+        "quantum migration",
+        "quantum safe",
+        "slh-dsa"
+      ],
+      "data_deps": [
+        "cve-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [
+        "NIST-800-53-SC-28",
+        "NIST-800-53-SC-8"
+      ],
+      "rfc_refs": [
+        "DRAFT-IETF-TLS-ECDHE-MLKEM",
+        "DRAFT-IETF-TLS-HYBRID-DESIGN",
+        "RFC-8032",
+        "RFC-8446",
+        "RFC-9106",
+        "RFC-9180",
+        "RFC-9420",
+        "RFC-9794"
+      ],
+      "cwe_refs": [
+        "CWE-327"
+      ],
+      "d3fend_refs": [
+        "D3-FE",
+        "D3-MENCR"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "rag-pipeline-security",
+      "version": "1.0.0",
+      "triggers": [
+        "embedding attack",
+        "knowledge base security",
+        "rag security",
+        "rag threat model",
+        "retrieval security",
+        "vector poisoning",
+        "vector store security"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [
+        "AML.T0020",
+        "AML.T0043",
+        "AML.T0051",
+        "AML.T0054"
+      ],
+      "attack_refs": [
+        "T1565"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.28",
+        "NIST-800-53-SI-12",
+        "NIST-AI-RMF-MEASURE-2.5",
+        "OWASP-LLM-Top-10-2025-LLM08"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1395",
+        "CWE-1426"
+      ],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-IOPR",
+        "D3-NTA"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "researcher",
+      "version": "1.0.0",
+      "triggers": [
+        "exceptd research",
+        "new advisory",
+        "new exploit",
+        "new threat",
+        "research this cve",
+        "threat intel triage",
+        "triage threat",
+        "what should I do about",
+        "where do I start",
+        "which skill should I use"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "exploit-availability.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "sector-energy",
+      "version": "1.0.0",
+      "triggers": [
+        "aescsf",
+        "awwa cyber",
+        "der security",
+        "electric grid security",
+        "energy security",
+        "grid resilience",
+        "inverter security",
+        "nccs-g",
+        "nerc cip",
+        "oil gas cyber",
+        "pipeline cyber",
+        "renewable cyber",
+        "smart meter security",
+        "tsa sd-2021",
+        "water utility cyber"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T0855",
+        "T0883",
+        "T1078",
+        "T1190"
+      ],
+      "framework_gaps": [
+        "IEC-62443-3-3",
+        "NERC-CIP-007-6-R4",
+        "NIS2-Art21-patch-management",
+        "NIST-800-82r3"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1037",
+        "CWE-287",
+        "CWE-306",
+        "CWE-798"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "sector-federal-government",
+      "version": "1.0.0",
+      "triggers": [
+        "cisa bod",
+        "cisa ed",
+        "cmmc",
+        "cui",
+        "eo 14028",
+        "federal cyber",
+        "federal zero trust",
+        "fedramp",
+        "fisma",
+        "government cybersecurity",
+        "jab authorization",
+        "m-22-09",
+        "nist 800-171",
+        "nist 800-172",
+        "omb m-24-04",
+        "stateramp"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [
+        "T1190",
+        "T1195.001",
+        "T1554"
+      ],
+      "framework_gaps": [
+        "CMMC-2.0-Level-2",
+        "FedRAMP-Rev5-Moderate",
+        "NIST-800-218-SSDF",
+        "SLSA-v1.0-Build-L3"
+      ],
+      "rfc_refs": [
+        "RFC-8032",
+        "RFC-8446"
+      ],
+      "cwe_refs": [
+        "CWE-1357",
+        "CWE-1395",
+        "CWE-829"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "sector-financial",
+      "version": "1.0.0",
+      "triggers": [
+        "23 nycrr 500",
+        "apra cps 234",
+        "banking security",
+        "cbest",
+        "dora",
+        "ffiec",
+        "financial security",
+        "icast",
+        "mas trm",
+        "nydfs",
+        "psd2",
+        "psd3",
+        "sca",
+        "strong customer authentication",
+        "swift cscf",
+        "tiber-eu",
+        "tlpt"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "dlp-controls.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0096"
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1190",
+        "T1486",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "NIST-800-53-AC-2",
+        "PSD2-RTS-SCA",
+        "SOC2-CC6-logical-access",
+        "SWIFT-CSCF-v2026-1.1"
+      ],
+      "rfc_refs": [
+        "RFC-7519",
+        "RFC-8446",
+        "RFC-8725",
+        "RFC-9421"
+      ],
+      "cwe_refs": [
+        "CWE-287",
+        "CWE-352",
+        "CWE-798",
+        "CWE-862",
+        "CWE-863"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "sector-healthcare",
+      "version": "1.0.0",
+      "triggers": [
+        "ai diagnostic",
+        "clinical decision support",
+        "eu mdr",
+        "fda cyber",
+        "fhir",
+        "healthcare security",
+        "hipaa",
+        "hitrust",
+        "hl7",
+        "medical device security",
+        "patient data",
+        "phi",
+        "protected health information",
+        "samd"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "dlp-controls.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [
+        "AML.T0017",
+        "AML.T0051"
+      ],
+      "attack_refs": [
+        "T1078",
+        "T1530",
+        "T1567"
+      ],
+      "framework_gaps": [
+        "HIPAA-Security-Rule-164.312(a)(1)",
+        "HITRUST-CSF-v11.4-09.l",
+        "ISO-27001-2022-A.8.30",
+        "NIST-800-53-AC-2"
+      ],
+      "rfc_refs": [
+        "RFC-7519",
+        "RFC-9421"
+      ],
+      "cwe_refs": [
+        "CWE-1426",
+        "CWE-200",
+        "CWE-287",
+        "CWE-862"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "security-maturity-tiers",
+      "version": "1.0.0",
+      "triggers": [
+        "defense in depth",
+        "how do we get from here to there",
+        "implementation roadmap",
+        "minimum viable security",
+        "mvp security",
+        "security best practices",
+        "security maturity",
+        "security roadmap",
+        "security tiers",
+        "what should we do first",
+        "what's practical",
+        "where to start"
+      ],
+      "data_deps": [
+        "cve-catalog.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [
+        "CWE-1188"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "skill-update-loop",
+      "version": "1.0.0",
+      "triggers": [
+        "are skills current",
+        "atlas update",
+        "check skill currency",
+        "forward watch",
+        "framework update",
+        "new cve update",
+        "skill maintenance",
+        "skill review",
+        "update skills",
+        "update threat intel"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "exploit-availability.json",
+        "framework-control-gaps.json",
+        "global-frameworks.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "supply-chain-integrity",
+      "version": "1.0.0",
+      "triggers": [
+        "ai bom",
+        "aibom",
+        "cosign",
+        "csaf",
+        "cyclonedx",
+        "in-toto",
+        "model provenance",
+        "sbom",
+        "sigstore",
+        "slsa",
+        "software composition",
+        "spdx",
+        "supply chain",
+        "vex"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0010",
+        "AML.T0018"
+      ],
+      "attack_refs": [
+        "T1195.001",
+        "T1195.002",
+        "T1554"
+      ],
+      "framework_gaps": [
+        "CMMC-2.0-Level-2",
+        "CycloneDX-v1.6-SBOM",
+        "FedRAMP-Rev5-Moderate",
+        "HITRUST-CSF-v11.4-09.l",
+        "NIST-800-218-SSDF",
+        "NIST-800-53-SA-12",
+        "SLSA-v1.0-Build-L3",
+        "SPDX-v3.0-SBOM",
+        "SWIFT-CSCF-v2026-1.1",
+        "VEX-CSAF-v2.1"
+      ],
+      "rfc_refs": [
+        "RFC-8032"
+      ],
+      "cwe_refs": [
+        "CWE-1357",
+        "CWE-1395",
+        "CWE-494",
+        "CWE-502",
+        "CWE-829"
+      ],
+      "d3fend_refs": [
+        "D3-CBAN",
+        "D3-EAL",
+        "D3-EHB"
+      ],
+      "dlp_refs": []
+    },
+    {
+      "name": "threat-model-currency",
+      "version": "1.0.0",
+      "triggers": [
+        "is our threat model current",
+        "threat intelligence gap",
+        "threat model currency",
+        "threat model gap",
+        "threat model review",
+        "update threat model"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "threat-modeling-methodology",
+      "version": "1.0.0",
+      "triggers": [
+        "attack tree",
+        "data flow diagram",
+        "dfd",
+        "diamond model",
+        "kill chain",
+        "linddun",
+        "pasta",
+        "stride",
+        "threat model",
+        "threat modeling",
+        "threat modeling methodology",
+        "trust boundary",
+        "unified kill chain"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.28",
+        "ISO-IEC-23894-2023-clause-7",
+        "ISO-IEC-42001-2023-clause-6.1.2",
+        "NIST-800-218-SSDF"
+      ],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "webapp-security",
+      "version": "1.0.0",
+      "triggers": [
+        "ai generated code",
+        "broken access control",
+        "command injection",
+        "csrf",
+        "file upload",
+        "owasp asvs",
+        "owasp top 10",
+        "path traversal",
+        "sql injection",
+        "sqli",
+        "ssrf",
+        "unsafe deserialization",
+        "web application security",
+        "webapp security",
+        "xss"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "cwe-catalog.json",
+        "d3fend-catalog.json",
+        "framework-control-gaps.json",
+        "rfc-references.json"
+      ],
+      "atlas_refs": [
+        "AML.T0051"
+      ],
+      "attack_refs": [
+        "T1059",
+        "T1190",
+        "T1505"
+      ],
+      "framework_gaps": [
+        "ISO-27001-2022-A.8.28",
+        "NIST-800-218-SSDF",
+        "OWASP-ASVS-v5.0-V14",
+        "OWASP-LLM-Top-10-2025-LLM01"
+      ],
+      "rfc_refs": [
+        "RFC-7519",
+        "RFC-8446",
+        "RFC-8725",
+        "RFC-9114"
+      ],
+      "cwe_refs": [
+        "CWE-1188",
+        "CWE-200",
+        "CWE-22",
+        "CWE-269",
+        "CWE-287",
+        "CWE-352",
+        "CWE-434",
+        "CWE-502",
+        "CWE-732",
+        "CWE-77",
+        "CWE-78",
+        "CWE-79",
+        "CWE-862",
+        "CWE-863",
+        "CWE-89",
+        "CWE-918",
+        "CWE-94"
+      ],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    },
+    {
+      "name": "zeroday-gap-learn",
+      "version": "1.0.0",
+      "triggers": [
+        "0day learning",
+        "exploit to control gap",
+        "learn from exploit",
+        "what control gap enabled this",
+        "what should have caught this",
+        "zero day lesson",
+        "zeroday gap"
+      ],
+      "data_deps": [
+        "atlas-ttps.json",
+        "cve-catalog.json",
+        "framework-control-gaps.json",
+        "zeroday-lessons.json"
+      ],
+      "atlas_refs": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "rfc_refs": [],
+      "cwe_refs": [],
+      "d3fend_refs": [],
+      "dlp_refs": []
+    }
+  ]
+}