Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/conducting-cloud-infrastructure-penetration-test/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/conducting-cloud-infrastructure-penetration-test/references/api-reference.md

@@ -0,0 +1,47 @@
+# Cloud Infrastructure Penetration Test — API Reference
+
+## Libraries
+
+| Library | Install | Purpose |
+|---------|---------|---------|
+| boto3 | `pip install boto3` | AWS SDK for Python — EC2, S3, IAM, security group enumeration |
+| ScoutSuite | `pip install scoutsuite` | Multi-cloud security auditing tool |
+| pacu | `pip install pacu` | AWS exploitation framework for penetration testing |
+
+## Key boto3 Methods
+
+| Method | Description |
+|--------|-------------|
+| `ec2.describe_security_groups()` | List all security groups with inbound/outbound rules |
+| `ec2.describe_instances()` | Enumerate EC2 instances with metadata options |
+| `s3.list_buckets()` | List all S3 buckets in the account |
+| `s3.get_bucket_acl(Bucket=name)` | Check bucket ACL for public access grants |
+| `s3.get_bucket_policy(Bucket=name)` | Retrieve bucket resource policy JSON |
+| `iam.list_users()` | Enumerate all IAM users |
+| `iam.list_attached_user_policies(UserName=u)` | List managed policies attached to a user |
+| `iam.list_access_keys(UserName=u)` | List access keys with creation dates |
+| `iam.simulate_principal_policy()` | Test effective permissions for a principal |
+| `sts.get_caller_identity()` | Identify current credentials (account, ARN) |
+
+## ScoutSuite CLI
+
+```bash
+scout aws --no-browser --report-dir ./report
+scout azure --cli --no-browser
+scout gcp --no-browser
+```
+
+## Key Constants
+
+| Constant | Value |
+|----------|-------|
+| IMDSv2 required | `HttpTokens: "required"` |
+| Public ACL URI | `http://acs.amazonaws.com/groups/global/AllUsers` |
+| Admin policy ARN | `arn:aws:iam::aws:policy/AdministratorAccess` |
+
+## External References
+
+- [AWS Penetration Testing Policy](https://aws.amazon.com/security/penetration-testing/)
+- [ScoutSuite Documentation](https://github.com/nccgroup/ScoutSuite/wiki)
+- [Pacu Wiki](https://github.com/RhinoSecurityLabs/pacu/wiki)
+- [boto3 EC2 Reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ec2.html)

skills/conducting-cloud-infrastructure-penetration-test/scripts/agent.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Cloud infrastructure penetration testing agent using boto3 and ScoutSuite."""
+
+import json
+import sys
+import argparse
+import subprocess
+from datetime import datetime
+
+try:
+    import boto3
+    from botocore.exceptions import ClientError
+except ImportError:
+    print("Install: pip install boto3")
+    sys.exit(1)
+
+
+def enumerate_public_resources(session):
+    """Find publicly accessible resources across AWS services."""
+    findings = []
+    ec2 = session.client("ec2")
+    for sg in ec2.describe_security_groups()["SecurityGroups"]:
+        for perm in sg.get("IpPermissions", []):
+            for ip_range in perm.get("IpRanges", []):
+                if ip_range.get("CidrIp") == "0.0.0.0/0":
+                    findings.append({
+                        "type": "open_security_group",
+                        "resource": sg["GroupId"],
+                        "port": perm.get("FromPort", "all"),
+                        "severity": "HIGH",
+                    })
+    s3 = session.client("s3")
+    for bucket in s3.list_buckets().get("Buckets", []):
+        try:
+            acl = s3.get_bucket_acl(Bucket=bucket["Name"])
+            for grant in acl.get("Grants", []):
+                grantee = grant.get("Grantee", {})
+                if grantee.get("URI", "").endswith("AllUsers"):
+                    findings.append({
+                        "type": "public_s3_bucket",
+                        "resource": bucket["Name"],
+                        "permission": grant["Permission"],
+                        "severity": "CRITICAL",
+                    })
+        except ClientError:
+            pass
+    return findings
+
+
+def check_iam_weaknesses(session):
+    """Audit IAM for privilege escalation paths."""
+    iam = session.client("iam")
+    issues = []
+    for user in iam.list_users()["Users"]:
+        policies = iam.list_attached_user_policies(UserName=user["UserName"])
+        for pol in policies["AttachedPolicies"]:
+            if pol["PolicyArn"].endswith("/AdministratorAccess"):
+                issues.append({
+                    "type": "admin_user",
+                    "user": user["UserName"],
+                    "policy": pol["PolicyName"],
+                    "severity": "HIGH",
+                })
+        keys = iam.list_access_keys(UserName=user["UserName"])
+        for key in keys["AccessKeyMetadata"]:
+            if key["Status"] == "Active":
+                age = (datetime.utcnow() - key["CreateDate"].replace(tzinfo=None)).days
+                if age > 90:
+                    issues.append({
+                        "type": "stale_access_key",
+                        "user": user["UserName"],
+                        "key_id": key["AccessKeyId"],
+                        "age_days": age,
+                        "severity": "MEDIUM",
+                    })
+    return issues
+
+
+def check_metadata_service(session):
+    """Check EC2 instances for IMDSv1 (SSRF-exploitable metadata)."""
+    ec2 = session.client("ec2")
+    vulnerable = []
+    paginator = ec2.get_paginator("describe_instances")
+    for page in paginator.paginate():
+        for res in page["Reservations"]:
+            for inst in res["Instances"]:
+                md = inst.get("MetadataOptions", {})
+                if md.get("HttpTokens") != "required":
+                    vulnerable.append({
+                        "type": "imdsv1_enabled",
+                        "instance_id": inst["InstanceId"],
+                        "state": inst["State"]["Name"],
+                        "severity": "HIGH",
+                    })
+    return vulnerable
+
+
+def run_scoutsuite_scan(provider="aws"):
+    """Run ScoutSuite for comprehensive cloud audit."""
+    cmd = ["scout", provider, "--no-browser", "--report-dir", "/tmp/scoutsuite-report"]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
+        return {"status": "completed", "output": result.stdout[-500:]}
+    except FileNotFoundError:
+        return {"status": "error", "message": "ScoutSuite not installed: pip install scoutsuite"}
+    except subprocess.TimeoutExpired:
+        return {"status": "timeout", "message": "ScoutSuite scan exceeded 10 minute timeout"}
+
+
+def run_pentest(profile=None, region="us-east-1"):
+    """Execute cloud infrastructure penetration test."""
+    session = boto3.Session(profile_name=profile, region_name=region)
+    print(f"\n{'='*60}")
+    print(f"  CLOUD INFRASTRUCTURE PENETRATION TEST")
+    print(f"  Region: {region} | Profile: {profile or 'default'}")
+    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
+    print(f"{'='*60}\n")
+
+    public = enumerate_public_resources(session)
+    print(f"--- PUBLIC EXPOSURE ({len(public)} findings) ---")
+    for f in public[:10]:
+        print(f"  [{f['severity']}] {f['type']}: {f['resource']}")
+
+    iam_issues = check_iam_weaknesses(session)
+    print(f"\n--- IAM WEAKNESSES ({len(iam_issues)} findings) ---")
+    for f in iam_issues[:10]:
+        print(f"  [{f['severity']}] {f['type']}: {f.get('user', f.get('resource', 'N/A'))}")
+
+    metadata = check_metadata_service(session)
+    print(f"\n--- IMDSv1 EXPOSURE ({len(metadata)} instances) ---")
+    for f in metadata[:10]:
+        print(f"  [{f['severity']}] {f['instance_id']} ({f['state']})")
+
+    return {"public_exposure": public, "iam_issues": iam_issues, "imdsv1": metadata}
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Cloud Infrastructure Pentest Agent")
+    parser.add_argument("--profile", help="AWS CLI profile name")
+    parser.add_argument("--region", default="us-east-1", help="AWS region")
+    parser.add_argument("--scan", action="store_true", help="Run full pentest scan")
+    parser.add_argument("--scoutsuite", action="store_true", help="Run ScoutSuite audit")
+    parser.add_argument("--output", help="Save report to JSON file")
+    args = parser.parse_args()
+
+    if args.scoutsuite:
+        report = run_scoutsuite_scan()
+        print(json.dumps(report, indent=2))
+    elif args.scan:
+        report = run_pentest(args.profile, args.region)
+        if args.output:
+            with open(args.output, "w") as f:
+                json.dump(report, f, indent=2, default=str)
+            print(f"\n[+] Report saved to {args.output}")
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()