Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
2026-07-29 15:40:58 +03:00 · 2026-03-10 21:02:12 +01:00
parent c74d52fa30
commit 27c6414ca5
1390 changed files with 106806 additions and 0 deletions
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,59 @@
+# API Reference: Implementing API Threat Protection with Apigee
+
+## JSONThreatProtection Policy
+
+```xml
+<JSONThreatProtection name="JSON-Threat">
+    <ObjectEntryCount>25</ObjectEntryCount>
+    <ArrayElementCount>100</ArrayElementCount>
+    <ContainerDepth>5</ContainerDepth>
+    <StringValueLength>500</StringValueLength>
+    <Source>request</Source>
+</JSONThreatProtection>
+```
+
+## SpikeArrest Policy
+
+```xml
+<SpikeArrest name="Spike-Arrest">
+    <Rate>30ps</Rate>
+    <Identifier ref="request.header.x-api-key"/>
+</SpikeArrest>
+```
+
+## RegularExpressionProtection
+
+```xml
+<RegularExpressionProtection name="Regex-Protect">
+    <Source>request</Source>
+    <QueryParam name="*">
+        <Pattern>[\s]*((delete)|(exec)|(drop\s*table))</Pattern>
+    </QueryParam>
+</RegularExpressionProtection>
+```
+
+## Apigee Management API
+
+```bash
+# Deploy proxy revision
+curl -X POST "https://apigee.googleapis.com/v1/organizations/{org}/environments/{env}/apis/{api}/revisions/{rev}/deployments" \
+  -H "Authorization: Bearer $(gcloud auth print-access-token)"
+
+# List deployed proxies
+curl "https://apigee.googleapis.com/v1/organizations/{org}/apis" \
+  -H "Authorization: Bearer $(gcloud auth print-access-token)"
+```
+
+## Recommended Policy Limits
+
+| Setting | Recommended | Description |
+|---------|-------------|-------------|
+| ContainerDepth | 5 | JSON nesting depth |
+| StringValueLength | 500 | Max string value |
+| ObjectEntryCount | 25 | Max object keys |
+| SpikeArrest Rate | 30ps | Requests per second |
+
+### References
+
+- Apigee Policies: https://cloud.google.com/apigee/docs/api-platform/reference/policies
+- Apigee Security: https://cloud.google.com/apigee/docs/api-platform/security
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+"""Agent for implementing API threat protection policies with Google Apigee."""
+
+import json
+import argparse
+import re
+from datetime import datetime
+from pathlib import Path
+
+
+APIGEE_POLICIES = {
+    "JSONThreatProtection": {
+        "max_depth": 5, "max_string_length": 500,
+        "max_entries": 25, "max_array_elements": 100,
+    },
+    "XMLThreatProtection": {
+        "max_depth": 5, "max_attributes": 10,
+        "max_element_name_length": 128, "max_text_length": 500,
+    },
+    "RegularExpressionProtection": {
+        "patterns": [
+            r"[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update)|(or))",
+            r"<\s*script\b[^>]*>[^<]+<\s*/\s*script\s*>",
+            r"(\%27)|(\')|(\-\-)|(\%23)|(#)",
+        ]
+    },
+    "SpikeArrest": {
+        "rate": "30ps", "identifier": "request.header.x-api-key",
+    },
+}
+
+
+def generate_json_threat_policy(config=None):
+    """Generate Apigee JSONThreatProtection policy XML."""
+    cfg = config or APIGEE_POLICIES["JSONThreatProtection"]
+    return f"""<?xml version="1.0" encoding="UTF-8"?>
+<JSONThreatProtection name="JSON-Threat-Protection">
+    <DisplayName>JSON Threat Protection</DisplayName>
+    <ObjectEntryCount>{cfg['max_entries']}</ObjectEntryCount>
+    <ArrayElementCount>{cfg['max_array_elements']}</ArrayElementCount>
+    <ContainerDepth>{cfg['max_depth']}</ContainerDepth>
+    <StringValueLength>{cfg['max_string_length']}</StringValueLength>
+    <Source>request</Source>
+</JSONThreatProtection>"""
+
+
+def generate_spike_arrest_policy(rate="30ps"):
+    """Generate Apigee SpikeArrest policy XML."""
+    return f"""<?xml version="1.0" encoding="UTF-8"?>
+<SpikeArrest name="Spike-Arrest">
+    <DisplayName>Spike Arrest</DisplayName>
+    <Rate>{rate}</Rate>
+    <Identifier ref="request.header.x-api-key"/>
+    <UseEffectiveCount>true</UseEffectiveCount>
+</SpikeArrest>"""
+
+
+def generate_regex_protection_policy():
+    """Generate RegularExpressionProtection policy for SQL/XSS."""
+    return """<?xml version="1.0" encoding="UTF-8"?>
+<RegularExpressionProtection name="Regex-Protection">
+    <DisplayName>SQL Injection and XSS Protection</DisplayName>
+    <Source>request</Source>
+    <QueryParam name="*">
+        <Pattern>[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update))</Pattern>
+        <Pattern>&lt;\\s*script\\b[^&gt;]*&gt;</Pattern>
+    </QueryParam>
+    <JSONPayload>
+        <JSONPath>$.*</JSONPath>
+        <Pattern>[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update))</Pattern>
+    </JSONPayload>
+</RegularExpressionProtection>"""
+
+
+def analyze_apigee_proxy_bundle(bundle_path):
+    """Analyze an Apigee proxy bundle for security policy gaps."""
+    findings = []
+    bundle = Path(bundle_path)
+    policies_dir = bundle / "apiproxy" / "policies"
+    if not policies_dir.exists():
+        return [{"issue": "no_policies_directory", "severity": "CRITICAL"}]
+    policy_files = list(policies_dir.glob("*.xml"))
+    policy_names = [p.stem for p in policy_files]
+    required_policies = [
+        ("JSONThreatProtection", "json_threat_protection", "HIGH"),
+        ("SpikeArrest", "spike_arrest", "HIGH"),
+        ("OAuthV2", "oauth_authentication", "CRITICAL"),
+        ("CORS", "cors_policy", "MEDIUM"),
+    ]
+    for policy_type, issue_name, severity in required_policies:
+        has_policy = any(policy_type.lower() in p.lower() for p in policy_names)
+        if not has_policy:
+            for pf in policy_files:
+                content = pf.read_text(errors="ignore")
+                if policy_type in content:
+                    has_policy = True
+                    break
+        if not has_policy:
+            findings.append({
+                "issue": f"missing_{issue_name}",
+                "policy_type": policy_type,
+                "severity": severity,
+            })
+    return findings
+
+
+def audit_threat_protection_config(policy_path):
+    """Audit a threat protection policy for weak configurations."""
+    findings = []
+    content = Path(policy_path).read_text(errors="ignore")
+    depth_match = re.search(r"<ContainerDepth>(\d+)</ContainerDepth>", content)
+    if depth_match and int(depth_match.group(1)) > 10:
+        findings.append({
+            "issue": "excessive_container_depth",
+            "value": int(depth_match.group(1)),
+            "recommended": 5, "severity": "MEDIUM",
+        })
+    string_match = re.search(r"<StringValueLength>(\d+)</StringValueLength>", content)
+    if string_match and int(string_match.group(1)) > 10000:
+        findings.append({
+            "issue": "excessive_string_length",
+            "value": int(string_match.group(1)),
+            "recommended": 500, "severity": "MEDIUM",
+        })
+    rate_match = re.search(r"<Rate>(\d+)(ps|pm)</Rate>", content)
+    if rate_match:
+        rate_val = int(rate_match.group(1))
+        unit = rate_match.group(2)
+        if unit == "ps" and rate_val > 100:
+            findings.append({
+                "issue": "spike_arrest_too_permissive",
+                "rate": f"{rate_val}{unit}", "severity": "HIGH",
+            })
+    return findings
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Apigee API Threat Protection Agent")
+    parser.add_argument("--action", choices=[
+        "generate", "audit_bundle", "audit_policy", "full"
+    ], default="generate")
+    parser.add_argument("--bundle", help="Apigee proxy bundle path")
+    parser.add_argument("--policy", help="Policy XML file to audit")
+    parser.add_argument("--output", default="apigee_threat_protection_report.json")
+    args = parser.parse_args()
+
+    report = {"generated_at": datetime.utcnow().isoformat(), "findings": {}}
+
+    if args.action == "generate":
+        report["policies"] = {
+            "json_threat_protection": generate_json_threat_policy(),
+            "spike_arrest": generate_spike_arrest_policy(),
+            "regex_protection": generate_regex_protection_policy(),
+        }
+        print("[+] Generated 3 Apigee security policies")
+
+    if args.action in ("audit_bundle", "full") and args.bundle:
+        f = analyze_apigee_proxy_bundle(args.bundle)
+        report["findings"]["bundle_audit"] = f
+        print(f"[+] Bundle audit findings: {len(f)}")
+
+    if args.action in ("audit_policy", "full") and args.policy:
+        f = audit_threat_protection_config(args.policy)
+        report["findings"]["policy_audit"] = f
+        print(f"[+] Policy audit findings: {len(f)}")
+
+    with open(args.output, "w") as fout:
+        json.dump(report, fout, indent=2, default=str)
+    print(f"[+] Report saved to {args.output}")
+
+
+if __name__ == "__main__":
+    main()