Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/analyzing-powershell-script-block-logging/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: analyzing-powershell-script-block-logging
+description: >-
+  Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated
+  commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and
+  reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded
+  commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
+---
+
+## Instructions
+
+1. Install dependencies: `pip install python-evtx lxml`
+2. Collect PowerShell Operational logs: `Microsoft-Windows-PowerShell%4Operational.evtx`
+3. Parse Event ID 4104 entries using python-evtx to extract ScriptBlockText, ScriptBlockId, and MessageNumber/MessageTotal for multi-part script reconstruction.
+4. Apply detection heuristics:
+   - Base64-encoded commands (`-EncodedCommand`, `FromBase64String`)
+   - Download cradles (`DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `Net.WebClient`)
+   - AMSI bypass patterns (`AmsiUtils`, `amsiInitFailed`)
+   - Obfuscation indicators (high entropy, tick-mark insertion, string concatenation)
+5. Generate a report with reconstructed scripts, risk scores, and MITRE ATT&CK mappings.
+
+```bash
+python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json
+```
+
+## Examples
+
+### Detect Encoded Command Execution
+```python
+import base64
+if "-encodedcommand" in script_text.lower():
+    encoded = script_text.split()[-1]
+    decoded = base64.b64decode(encoded).decode("utf-16-le")
+```
+
+### Reconstruct Multi-Block Script
+Scripts split across multiple 4104 events share a `ScriptBlockId`. Concatenate blocks ordered by `MessageNumber` to recover the full script.