What should we add in v1.3.0?

[mukul975]

v1.2.0 just shipped with 5-framework coverage
(MITRE ATT&CK + NIST CSF + ATLAS + D3FEND + NIST AI RMF).

What should we prioritize next?

• OWASP LLM Top 10 2025
• OWASP Agentic AI Top 10
• CIS Controls v8.1
• CMMC 2.0
• EU AI Act technical requirements
• Something else?

Drop your vote or suggestion below.

[ai-craftsman404]

Just a quick note about my observation; do you guys release that two of the six frameworks (ATLAS, AI RMF) got skipped never gone through validation process the other four went through?
you still need to apply atlas_techniques/nist_ai_rmf fields to the ~12-90 skills that are genuinely AI/ML-security-relevant, and leave the field empty on the rest instead of stamping a default value everywhere.

[mukul975]

Good callout, @ai-craftsman404 — you were right that the ATLAS and NIST AI RMF mappings had not been put through an explicit validation pass the way the ATT&CK and F3 mappings were. So I ran one.

Result: both check out clean.

• MITRE ATLAS — 21 distinct AML technique IDs across 81 skills, all validated against the official mitre-atlas/atlas-data catalog (170 techniques). 0 invalid, and the names match the current catalog (e.g. AML.T0066 Retrieval Content Crafting, AML.T0070 RAG Poisoning, AML.T0051 LLM Prompt Injection).
• NIST AI RMF 1.0 — 19 distinct subcategory IDs across 85 skills, all valid against the AI 100-1 Core (GOVERN/MAP/MEASURE/MANAGE). 0 invalid.

On your second point — these two frameworks are intentionally scoped to the genuinely AI/ML-relevant skills (81 and 85 respectively) and left empty on the rest, rather than blanket-applied to all 817. That is the right design, and it matches what you suggested. ATT&CK (817/817) and NIST CSF are the two that apply repo-wide; ATLAS, AI RMF, D3FEND, and F3 are scoped to where they actually fit.

Appreciate the scrutiny — keeps the mappings honest.