Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/implementing-api-rate-limiting-and-throttling/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/implementing-api-rate-limiting-and-throttling/references/api-reference.md

@@ -0,0 +1,65 @@
+# API Reference: Implementing API Rate Limiting and Throttling
+
+## Token Bucket Algorithm
+
+```python
+import time
+class TokenBucket:
+    def __init__(self, capacity, refill_rate):
+        self.capacity = capacity
+        self.tokens = capacity
+        self.refill_rate = refill_rate  # tokens/sec
+        self.last_refill = time.time()
+
+    def allow(self):
+        now = time.time()
+        self.tokens = min(self.capacity,
+            self.tokens + (now - self.last_refill) * self.refill_rate)
+        self.last_refill = now
+        if self.tokens >= 1:
+            self.tokens -= 1
+            return True
+        return False
+```
+
+## Redis Sliding Window
+
+```python
+import redis, time
+r = redis.Redis()
+def check_rate(client_id, window=60, limit=100):
+    key = f"rl:{client_id}"
+    now = time.time()
+    pipe = r.pipeline()
+    pipe.zremrangebyscore(key, 0, now - window)
+    pipe.zadd(key, {str(now): now})
+    pipe.zcard(key)
+    pipe.expire(key, window)
+    _, _, count, _ = pipe.execute()
+    return count <= limit
+```
+
+## HTTP 429 Response Headers
+
+| Header | Value | Description |
+|--------|-------|-------------|
+| `Retry-After` | `30` | Seconds until retry |
+| `X-RateLimit-Limit` | `100` | Max requests |
+| `X-RateLimit-Remaining` | `0` | Remaining requests |
+| `X-RateLimit-Reset` | epoch | Reset timestamp |
+
+## Kong Rate Limiting Plugin
+
+```bash
+curl -X POST http://localhost:8001/services/{id}/plugins \
+  -d "name=rate-limiting" \
+  -d "config.minute=100" \
+  -d "config.policy=redis" \
+  -d "config.redis_host=redis"
+```
+
+### References
+
+- Redis Rate Limiting: https://redis.io/glossary/rate-limiting/
+- IETF RateLimit Headers: https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
+- Kong Rate Limiting: https://docs.konghq.com/hub/kong-inc/rate-limiting/

skills/implementing-api-rate-limiting-and-throttling/scripts/agent.py

@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""Agent for implementing and testing API rate limiting and throttling."""
+
+import json
+import argparse
+import time
+from datetime import datetime
+from collections import defaultdict, Counter
+
+
+class TokenBucket:
+    """In-memory token bucket rate limiter."""
+    def __init__(self, max_tokens=100, refill_rate=10.0):
+        self.max_tokens = max_tokens
+        self.refill_rate = refill_rate
+        self.buckets = {}
+
+    def allow(self, client_id):
+        now = time.time()
+        if client_id not in self.buckets:
+            self.buckets[client_id] = {"tokens": self.max_tokens, "last": now}
+        bucket = self.buckets[client_id]
+        elapsed = now - bucket["last"]
+        bucket["tokens"] = min(self.max_tokens, bucket["tokens"] + elapsed * self.refill_rate)
+        bucket["last"] = now
+        if bucket["tokens"] >= 1:
+            bucket["tokens"] -= 1
+            return True, {"remaining": int(bucket["tokens"]), "limit": self.max_tokens}
+        return False, {"remaining": 0, "retry_after": round((1 - bucket["tokens"]) / self.refill_rate, 2)}
+
+
+class SlidingWindow:
+    """In-memory sliding window rate limiter."""
+    def __init__(self, window_seconds=60, max_requests=100):
+        self.window = window_seconds
+        self.max_requests = max_requests
+        self.requests = defaultdict(list)
+
+    def allow(self, client_id):
+        now = time.time()
+        cutoff = now - self.window
+        self.requests[client_id] = [t for t in self.requests[client_id] if t > cutoff]
+        current = len(self.requests[client_id])
+        if current < self.max_requests:
+            self.requests[client_id].append(now)
+            return True, {"remaining": self.max_requests - current - 1, "window": self.window}
+        return False, {"remaining": 0, "retry_after": round(self.requests[client_id][0] - cutoff, 2)}
+
+
+def analyze_rate_limit_effectiveness(log_path):
+    """Analyze API logs to assess rate limiting effectiveness."""
+    ip_requests = Counter()
+    ip_429s = Counter()
+    endpoint_load = Counter()
+    with open(log_path) as f:
+        for line in f:
+            try:
+                entry = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            ip = entry.get("client_ip", entry.get("ip", ""))
+            status = int(entry.get("status_code", entry.get("status", 0)))
+            endpoint = entry.get("path", entry.get("endpoint", ""))
+            ip_requests[ip] += 1
+            if status == 429:
+                ip_429s[ip] += 1
+            endpoint_load[endpoint] += 1
+    findings = []
+    for ip, total in ip_requests.most_common(20):
+        rate_limited = ip_429s.get(ip, 0)
+        if total > 1000 and rate_limited == 0:
+            findings.append({
+                "ip": ip, "total_requests": total, "rate_limited": 0,
+                "issue": "high_volume_not_rate_limited", "severity": "HIGH",
+            })
+        elif rate_limited > 0 and rate_limited < total * 0.1:
+            findings.append({
+                "ip": ip, "total_requests": total, "rate_limited": rate_limited,
+                "issue": "rate_limit_too_permissive", "severity": "MEDIUM",
+            })
+    return findings
+
+
+def simulate_rate_limit_test(algorithm="token_bucket", requests_count=200, rate=10):
+    """Simulate rate limiting to test configuration."""
+    if algorithm == "token_bucket":
+        limiter = TokenBucket(max_tokens=rate, refill_rate=rate / 60.0)
+    else:
+        limiter = SlidingWindow(window_seconds=60, max_requests=rate)
+    allowed = 0
+    denied = 0
+    for i in range(requests_count):
+        ok, _ = limiter.allow("test_client")
+        if ok:
+            allowed += 1
+        else:
+            denied += 1
+    return {
+        "algorithm": algorithm, "total_requests": requests_count,
+        "allowed": allowed, "denied": denied,
+        "effective_rate": round(allowed / requests_count * 100, 1),
+    }
+
+
+def generate_rate_limit_recommendations(log_path):
+    """Generate rate limit recommendations from traffic patterns."""
+    ip_rpm = defaultdict(int)
+    endpoint_rpm = defaultdict(int)
+    with open(log_path) as f:
+        for line in f:
+            try:
+                entry = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            ip = entry.get("client_ip", "")
+            endpoint = entry.get("path", "")
+            ip_rpm[ip] += 1
+            endpoint_rpm[endpoint] += 1
+    ip_values = sorted(ip_rpm.values())
+    p95 = ip_values[int(len(ip_values) * 0.95)] if ip_values else 100
+    p99 = ip_values[int(len(ip_values) * 0.99)] if ip_values else 200
+    return {
+        "global_rate_limit": p99 * 2,
+        "per_ip_limit": p95 * 2,
+        "auth_endpoint_limit": max(10, p95 // 10),
+        "p95_requests_per_ip": p95,
+        "p99_requests_per_ip": p99,
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="API Rate Limiting Agent")
+    parser.add_argument("--action", choices=[
+        "analyze", "simulate", "recommend", "full"
+    ], default="full")
+    parser.add_argument("--log", help="API access log (JSON lines)")
+    parser.add_argument("--algorithm", choices=["token_bucket", "sliding_window"],
+                        default="token_bucket")
+    parser.add_argument("--output", default="rate_limiting_report.json")
+    args = parser.parse_args()
+
+    report = {"generated_at": datetime.utcnow().isoformat(), "findings": {}}
+
+    if args.action in ("analyze", "full") and args.log:
+        f = analyze_rate_limit_effectiveness(args.log)
+        report["findings"]["effectiveness"] = f
+        print(f"[+] Rate limit issues: {len(f)}")
+
+    if args.action in ("simulate", "full"):
+        result = simulate_rate_limit_test(args.algorithm)
+        report["findings"]["simulation"] = result
+        print(f"[+] Simulation: {result['allowed']}/{result['total_requests']} allowed")
+
+    if args.action in ("recommend", "full") and args.log:
+        recs = generate_rate_limit_recommendations(args.log)
+        report["findings"]["recommendations"] = recs
+        print(f"[+] Recommended per-IP limit: {recs['per_ip_limit']}")
+
+    with open(args.output, "w") as fout:
+        json.dump(report, fout, indent=2, default=str)
+    print(f"[+] Report saved to {args.output}")
+
+
+if __name__ == "__main__":
+    main()