@blamejs/exceptd-skills 0.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (136) hide show
  1. package/AGENTS.md +232 -0
  2. package/ARCHITECTURE.md +267 -0
  3. package/CHANGELOG.md +616 -0
  4. package/CONTEXT.md +203 -0
  5. package/LICENSE +200 -0
  6. package/NOTICE +82 -0
  7. package/README.md +307 -0
  8. package/SECURITY.md +73 -0
  9. package/agents/README.md +81 -0
  10. package/agents/report-generator.md +156 -0
  11. package/agents/skill-updater.md +102 -0
  12. package/agents/source-validator.md +119 -0
  13. package/agents/threat-researcher.md +149 -0
  14. package/bin/exceptd.js +183 -0
  15. package/data/_indexes/_meta.json +88 -0
  16. package/data/_indexes/activity-feed.json +362 -0
  17. package/data/_indexes/catalog-summaries.json +229 -0
  18. package/data/_indexes/chains.json +7135 -0
  19. package/data/_indexes/currency.json +359 -0
  20. package/data/_indexes/did-ladders.json +451 -0
  21. package/data/_indexes/frequency.json +2072 -0
  22. package/data/_indexes/handoff-dag.json +476 -0
  23. package/data/_indexes/jurisdiction-clocks.json +967 -0
  24. package/data/_indexes/jurisdiction-map.json +536 -0
  25. package/data/_indexes/recipes.json +319 -0
  26. package/data/_indexes/section-offsets.json +3656 -0
  27. package/data/_indexes/stale-content.json +14 -0
  28. package/data/_indexes/summary-cards.json +1736 -0
  29. package/data/_indexes/theater-fingerprints.json +381 -0
  30. package/data/_indexes/token-budget.json +2137 -0
  31. package/data/_indexes/trigger-table.json +1374 -0
  32. package/data/_indexes/xref.json +818 -0
  33. package/data/atlas-ttps.json +282 -0
  34. package/data/cve-catalog.json +496 -0
  35. package/data/cwe-catalog.json +1017 -0
  36. package/data/d3fend-catalog.json +738 -0
  37. package/data/dlp-controls.json +1039 -0
  38. package/data/exploit-availability.json +67 -0
  39. package/data/framework-control-gaps.json +1255 -0
  40. package/data/global-frameworks.json +2913 -0
  41. package/data/rfc-references.json +324 -0
  42. package/data/zeroday-lessons.json +377 -0
  43. package/keys/public.pem +3 -0
  44. package/lib/framework-gap.js +328 -0
  45. package/lib/job-queue.js +195 -0
  46. package/lib/lint-skills.js +536 -0
  47. package/lib/prefetch.js +372 -0
  48. package/lib/refresh-external.js +713 -0
  49. package/lib/schemas/cve-catalog.schema.json +151 -0
  50. package/lib/schemas/manifest.schema.json +106 -0
  51. package/lib/schemas/skill-frontmatter.schema.json +113 -0
  52. package/lib/scoring.js +149 -0
  53. package/lib/sign.js +197 -0
  54. package/lib/ttp-mapper.js +80 -0
  55. package/lib/validate-catalog-meta.js +198 -0
  56. package/lib/validate-cve-catalog.js +213 -0
  57. package/lib/validate-indexes.js +83 -0
  58. package/lib/validate-package.js +162 -0
  59. package/lib/validate-vendor.js +85 -0
  60. package/lib/verify.js +216 -0
  61. package/lib/worker-pool.js +84 -0
  62. package/manifest-snapshot.json +1833 -0
  63. package/manifest.json +2108 -0
  64. package/orchestrator/README.md +124 -0
  65. package/orchestrator/dispatcher.js +140 -0
  66. package/orchestrator/event-bus.js +146 -0
  67. package/orchestrator/index.js +874 -0
  68. package/orchestrator/pipeline.js +201 -0
  69. package/orchestrator/scanner.js +327 -0
  70. package/orchestrator/scheduler.js +137 -0
  71. package/package.json +113 -0
  72. package/sbom.cdx.json +158 -0
  73. package/scripts/audit-cross-skill.js +261 -0
  74. package/scripts/audit-perf.js +160 -0
  75. package/scripts/bootstrap.js +205 -0
  76. package/scripts/build-indexes.js +721 -0
  77. package/scripts/builders/activity-feed.js +79 -0
  78. package/scripts/builders/catalog-summaries.js +67 -0
  79. package/scripts/builders/currency.js +109 -0
  80. package/scripts/builders/cwe-chains.js +105 -0
  81. package/scripts/builders/did-ladders.js +149 -0
  82. package/scripts/builders/frequency.js +89 -0
  83. package/scripts/builders/jurisdiction-clocks.js +126 -0
  84. package/scripts/builders/recipes.js +159 -0
  85. package/scripts/builders/section-offsets.js +162 -0
  86. package/scripts/builders/stale-content.js +171 -0
  87. package/scripts/builders/summary-cards.js +166 -0
  88. package/scripts/builders/theater-fingerprints.js +198 -0
  89. package/scripts/builders/token-budget.js +96 -0
  90. package/scripts/check-manifest-snapshot.js +217 -0
  91. package/scripts/predeploy.js +267 -0
  92. package/scripts/refresh-manifest-snapshot.js +57 -0
  93. package/scripts/refresh-sbom.js +222 -0
  94. package/skills/age-gates-child-safety/skill.md +456 -0
  95. package/skills/ai-attack-surface/skill.md +282 -0
  96. package/skills/ai-c2-detection/skill.md +440 -0
  97. package/skills/ai-risk-management/skill.md +311 -0
  98. package/skills/api-security/skill.md +287 -0
  99. package/skills/attack-surface-pentest/skill.md +381 -0
  100. package/skills/cloud-security/skill.md +384 -0
  101. package/skills/compliance-theater/skill.md +365 -0
  102. package/skills/container-runtime-security/skill.md +379 -0
  103. package/skills/coordinated-vuln-disclosure/skill.md +473 -0
  104. package/skills/defensive-countermeasure-mapping/skill.md +300 -0
  105. package/skills/dlp-gap-analysis/skill.md +337 -0
  106. package/skills/email-security-anti-phishing/skill.md +206 -0
  107. package/skills/exploit-scoring/skill.md +331 -0
  108. package/skills/framework-gap-analysis/skill.md +374 -0
  109. package/skills/fuzz-testing-strategy/skill.md +313 -0
  110. package/skills/global-grc/skill.md +564 -0
  111. package/skills/identity-assurance/skill.md +272 -0
  112. package/skills/incident-response-playbook/skill.md +546 -0
  113. package/skills/kernel-lpe-triage/skill.md +303 -0
  114. package/skills/mcp-agent-trust/skill.md +326 -0
  115. package/skills/mlops-security/skill.md +325 -0
  116. package/skills/ot-ics-security/skill.md +340 -0
  117. package/skills/policy-exception-gen/skill.md +437 -0
  118. package/skills/pqc-first/skill.md +546 -0
  119. package/skills/rag-pipeline-security/skill.md +294 -0
  120. package/skills/researcher/skill.md +310 -0
  121. package/skills/sector-energy/skill.md +409 -0
  122. package/skills/sector-federal-government/skill.md +302 -0
  123. package/skills/sector-financial/skill.md +398 -0
  124. package/skills/sector-healthcare/skill.md +373 -0
  125. package/skills/security-maturity-tiers/skill.md +464 -0
  126. package/skills/skill-update-loop/skill.md +463 -0
  127. package/skills/supply-chain-integrity/skill.md +318 -0
  128. package/skills/threat-model-currency/skill.md +404 -0
  129. package/skills/threat-modeling-methodology/skill.md +312 -0
  130. package/skills/webapp-security/skill.md +281 -0
  131. package/skills/zeroday-gap-learn/skill.md +350 -0
  132. package/vendor/blamejs/LICENSE +201 -0
  133. package/vendor/blamejs/README.md +54 -0
  134. package/vendor/blamejs/_PROVENANCE.json +54 -0
  135. package/vendor/blamejs/retry.js +335 -0
  136. package/vendor/blamejs/worker-pool.js +418 -0
package/data/_indexes/currency.json ADDED
@@ -0,0 +1,359 @@
1
+ {
2
+ "_meta": {
3
+ "schema_version": "1.0.0",
4
+ "reference_date": "2026-05-01",
5
+ "note": "Pre-computed skill currency snapshot. Reference date is manifest.threat_review_date (deterministic). Re-runs of build-indexes against the same inputs produce byte-identical output. The orchestrator `currency` command produces a real-time view against today's date.",
6
+ "decay_formula": "100 base; -30/-20/-10/-5 at 180/90/60/30-day thresholds; -5 per forward_watch entry. Label thresholds: ≥90 current, ≥70 acceptable, ≥50 stale, <50 critical_stale."
7
+ },
8
+ "summary": {
9
+ "current": 19,
10
+ "acceptable": 11,
11
+ "stale": 5,
12
+ "critical_stale": 3,
13
+ "action_required": 8
14
+ },
15
+ "skills": [
16
+ {
17
+ "skill": "cloud-security",
18
+ "last_threat_review": "2026-05-11",
19
+ "days_since_review": -10,
20
+ "currency_score": 30,
21
+ "currency_label": "critical_stale",
22
+ "forward_watch_count": 14,
23
+ "action_required": true
24
+ },
25
+ {
26
+ "skill": "sector-financial",
27
+ "last_threat_review": "2026-05-11",
28
+ "days_since_review": -10,
29
+ "currency_score": 40,
30
+ "currency_label": "critical_stale",
31
+ "forward_watch_count": 12,
32
+ "action_required": true
33
+ },
34
+ {
35
+ "skill": "pqc-first",
36
+ "last_threat_review": "2026-05-01",
37
+ "days_since_review": 0,
38
+ "currency_score": 45,
39
+ "currency_label": "critical_stale",
40
+ "forward_watch_count": 11,
41
+ "action_required": true
42
+ },
43
+ {
44
+ "skill": "age-gates-child-safety",
45
+ "last_threat_review": "2026-05-11",
46
+ "days_since_review": -10,
47
+ "currency_score": 50,
48
+ "currency_label": "stale",
49
+ "forward_watch_count": 10,
50
+ "action_required": true
51
+ },
52
+ {
53
+ "skill": "sector-federal-government",
54
+ "last_threat_review": "2026-05-11",
55
+ "days_since_review": -10,
56
+ "currency_score": 50,
57
+ "currency_label": "stale",
58
+ "forward_watch_count": 10,
59
+ "action_required": true
60
+ },
61
+ {
62
+ "skill": "incident-response-playbook",
63
+ "last_threat_review": "2026-05-11",
64
+ "days_since_review": -10,
65
+ "currency_score": 60,
66
+ "currency_label": "stale",
67
+ "forward_watch_count": 8,
68
+ "action_required": true
69
+ },
70
+ {
71
+ "skill": "sector-energy",
72
+ "last_threat_review": "2026-05-11",
73
+ "days_since_review": -10,
74
+ "currency_score": 60,
75
+ "currency_label": "stale",
76
+ "forward_watch_count": 8,
77
+ "action_required": true
78
+ },
79
+ {
80
+ "skill": "skill-update-loop",
81
+ "last_threat_review": "2026-05-01",
82
+ "days_since_review": 0,
83
+ "currency_score": 65,
84
+ "currency_label": "stale",
85
+ "forward_watch_count": 7,
86
+ "action_required": true
87
+ },
88
+ {
89
+ "skill": "coordinated-vuln-disclosure",
90
+ "last_threat_review": "2026-05-11",
91
+ "days_since_review": -10,
92
+ "currency_score": 70,
93
+ "currency_label": "acceptable",
94
+ "forward_watch_count": 6,
95
+ "action_required": false
96
+ },
97
+ {
98
+ "skill": "mlops-security",
99
+ "last_threat_review": "2026-05-11",
100
+ "days_since_review": -10,
101
+ "currency_score": 70,
102
+ "currency_label": "acceptable",
103
+ "forward_watch_count": 6,
104
+ "action_required": false
105
+ },
106
+ {
107
+ "skill": "supply-chain-integrity",
108
+ "last_threat_review": "2026-05-11",
109
+ "days_since_review": -10,
110
+ "currency_score": 70,
111
+ "currency_label": "acceptable",
112
+ "forward_watch_count": 6,
113
+ "action_required": false
114
+ },
115
+ {
116
+ "skill": "threat-modeling-methodology",
117
+ "last_threat_review": "2026-05-11",
118
+ "days_since_review": -10,
119
+ "currency_score": 70,
120
+ "currency_label": "acceptable",
121
+ "forward_watch_count": 6,
122
+ "action_required": false
123
+ },
124
+ {
125
+ "skill": "dlp-gap-analysis",
126
+ "last_threat_review": "2026-05-11",
127
+ "days_since_review": -10,
128
+ "currency_score": 75,
129
+ "currency_label": "acceptable",
130
+ "forward_watch_count": 5,
131
+ "action_required": false
132
+ },
133
+ {
134
+ "skill": "threat-model-currency",
135
+ "last_threat_review": "2026-05-01",
136
+ "days_since_review": 0,
137
+ "currency_score": 75,
138
+ "currency_label": "acceptable",
139
+ "forward_watch_count": 5,
140
+ "action_required": false
141
+ },
142
+ {
143
+ "skill": "attack-surface-pentest",
144
+ "last_threat_review": "2026-05-11",
145
+ "days_since_review": -10,
146
+ "currency_score": 80,
147
+ "currency_label": "acceptable",
148
+ "forward_watch_count": 4,
149
+ "action_required": false
150
+ },
151
+ {
152
+ "skill": "fuzz-testing-strategy",
153
+ "last_threat_review": "2026-05-11",
154
+ "days_since_review": -10,
155
+ "currency_score": 80,
156
+ "currency_label": "acceptable",
157
+ "forward_watch_count": 4,
158
+ "action_required": false
159
+ },
160
+ {
161
+ "skill": "policy-exception-gen",
162
+ "last_threat_review": "2026-05-01",
163
+ "days_since_review": 0,
164
+ "currency_score": 80,
165
+ "currency_label": "acceptable",
166
+ "forward_watch_count": 4,
167
+ "action_required": false
168
+ },
169
+ {
170
+ "skill": "security-maturity-tiers",
171
+ "last_threat_review": "2026-05-01",
172
+ "days_since_review": 0,
173
+ "currency_score": 80,
174
+ "currency_label": "acceptable",
175
+ "forward_watch_count": 4,
176
+ "action_required": false
177
+ },
178
+ {
179
+ "skill": "zeroday-gap-learn",
180
+ "last_threat_review": "2026-05-01",
181
+ "days_since_review": 0,
182
+ "currency_score": 80,
183
+ "currency_label": "acceptable",
184
+ "forward_watch_count": 4,
185
+ "action_required": false
186
+ },
187
+ {
188
+ "skill": "ai-attack-surface",
189
+ "last_threat_review": "2026-05-01",
190
+ "days_since_review": 0,
191
+ "currency_score": 100,
192
+ "currency_label": "current",
193
+ "forward_watch_count": 0,
194
+ "action_required": false
195
+ },
196
+ {
197
+ "skill": "ai-c2-detection",
198
+ "last_threat_review": "2026-05-01",
199
+ "days_since_review": 0,
200
+ "currency_score": 100,
201
+ "currency_label": "current",
202
+ "forward_watch_count": 0,
203
+ "action_required": false
204
+ },
205
+ {
206
+ "skill": "ai-risk-management",
207
+ "last_threat_review": "2026-05-11",
208
+ "days_since_review": -10,
209
+ "currency_score": 100,
210
+ "currency_label": "current",
211
+ "forward_watch_count": 0,
212
+ "action_required": false
213
+ },
214
+ {
215
+ "skill": "api-security",
216
+ "last_threat_review": "2026-05-11",
217
+ "days_since_review": -10,
218
+ "currency_score": 100,
219
+ "currency_label": "current",
220
+ "forward_watch_count": 0,
221
+ "action_required": false
222
+ },
223
+ {
224
+ "skill": "compliance-theater",
225
+ "last_threat_review": "2026-05-01",
226
+ "days_since_review": 0,
227
+ "currency_score": 100,
228
+ "currency_label": "current",
229
+ "forward_watch_count": 0,
230
+ "action_required": false
231
+ },
232
+ {
233
+ "skill": "container-runtime-security",
234
+ "last_threat_review": "2026-05-11",
235
+ "days_since_review": -10,
236
+ "currency_score": 100,
237
+ "currency_label": "current",
238
+ "forward_watch_count": 0,
239
+ "action_required": false
240
+ },
241
+ {
242
+ "skill": "defensive-countermeasure-mapping",
243
+ "last_threat_review": "2026-05-11",
244
+ "days_since_review": -10,
245
+ "currency_score": 100,
246
+ "currency_label": "current",
247
+ "forward_watch_count": 0,
248
+ "action_required": false
249
+ },
250
+ {
251
+ "skill": "email-security-anti-phishing",
252
+ "last_threat_review": "2026-05-11",
253
+ "days_since_review": -10,
254
+ "currency_score": 100,
255
+ "currency_label": "current",
256
+ "forward_watch_count": 0,
257
+ "action_required": false
258
+ },
259
+ {
260
+ "skill": "exploit-scoring",
261
+ "last_threat_review": "2026-05-01",
262
+ "days_since_review": 0,
263
+ "currency_score": 100,
264
+ "currency_label": "current",
265
+ "forward_watch_count": 0,
266
+ "action_required": false
267
+ },
268
+ {
269
+ "skill": "framework-gap-analysis",
270
+ "last_threat_review": "2026-05-01",
271
+ "days_since_review": 0,
272
+ "currency_score": 100,
273
+ "currency_label": "current",
274
+ "forward_watch_count": 0,
275
+ "action_required": false
276
+ },
277
+ {
278
+ "skill": "global-grc",
279
+ "last_threat_review": "2026-05-01",
280
+ "days_since_review": 0,
281
+ "currency_score": 100,
282
+ "currency_label": "current",
283
+ "forward_watch_count": 0,
284
+ "action_required": false
285
+ },
286
+ {
287
+ "skill": "identity-assurance",
288
+ "last_threat_review": "2026-05-11",
289
+ "days_since_review": -10,
290
+ "currency_score": 100,
291
+ "currency_label": "current",
292
+ "forward_watch_count": 0,
293
+ "action_required": false
294
+ },
295
+ {
296
+ "skill": "kernel-lpe-triage",
297
+ "last_threat_review": "2026-05-01",
298
+ "days_since_review": 0,
299
+ "currency_score": 100,
300
+ "currency_label": "current",
301
+ "forward_watch_count": 0,
302
+ "action_required": false
303
+ },
304
+ {
305
+ "skill": "mcp-agent-trust",
306
+ "last_threat_review": "2026-05-01",
307
+ "days_since_review": 0,
308
+ "currency_score": 100,
309
+ "currency_label": "current",
310
+ "forward_watch_count": 0,
311
+ "action_required": false
312
+ },
313
+ {
314
+ "skill": "ot-ics-security",
315
+ "last_threat_review": "2026-05-11",
316
+ "days_since_review": -10,
317
+ "currency_score": 100,
318
+ "currency_label": "current",
319
+ "forward_watch_count": 0,
320
+ "action_required": false
321
+ },
322
+ {
323
+ "skill": "rag-pipeline-security",
324
+ "last_threat_review": "2026-05-01",
325
+ "days_since_review": 0,
326
+ "currency_score": 100,
327
+ "currency_label": "current",
328
+ "forward_watch_count": 0,
329
+ "action_required": false
330
+ },
331
+ {
332
+ "skill": "researcher",
333
+ "last_threat_review": "2026-05-11",
334
+ "days_since_review": -10,
335
+ "currency_score": 100,
336
+ "currency_label": "current",
337
+ "forward_watch_count": 0,
338
+ "action_required": false
339
+ },
340
+ {
341
+ "skill": "sector-healthcare",
342
+ "last_threat_review": "2026-05-11",
343
+ "days_since_review": -10,
344
+ "currency_score": 100,
345
+ "currency_label": "current",
346
+ "forward_watch_count": 0,
347
+ "action_required": false
348
+ },
349
+ {
350
+ "skill": "webapp-security",
351
+ "last_threat_review": "2026-05-11",
352
+ "days_since_review": -10,
353
+ "currency_score": 100,
354
+ "currency_label": "current",
355
+ "forward_watch_count": 0,
356
+ "action_required": false
357
+ }
358
+ ]
359
+ }