Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/implementing-beyondcorp-zero-trust-access-model/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/implementing-beyondcorp-zero-trust-access-model/references/api-reference.md

@@ -0,0 +1,57 @@
+# API Reference: BeyondCorp Zero Trust Assessment Agent
+
+## Dependencies
+
+| Library | Version | Purpose |
+|---------|---------|---------|
+| requests | >=2.28 | HTTP client for Google Cloud IAP and Access Context Manager APIs |
+
+## CLI Usage
+
+```bash
+python scripts/agent.py \
+  --project my-gcp-project \
+  --output-dir /reports/ \
+  --output beyondcorp_report.json
+```
+
+## Functions
+
+### `get_gcloud_token() -> str`
+Runs `gcloud auth print-access-token` to obtain Bearer token.
+
+### `list_iap_resources(project_id, token) -> list`
+GET IAP tunnel destination groups for the project.
+
+### `get_iap_settings(project_id, resource, token) -> dict`
+GET IAP settings for a specific compute service resource.
+
+### `list_access_levels(org_id, policy_name, token) -> list`
+GET `/accessPolicies/{name}/accessLevels` from Access Context Manager.
+
+### `audit_iap_bindings(project_id, token) -> list`
+POST `getIamPolicy` and filters for IAP-related role bindings.
+
+### `assess_zero_trust_posture(project_id, token) -> dict`
+Evaluates IAP coverage, binding security, checks for allUsers exposure.
+
+### `generate_report(project_id, token) -> dict`
+Computes zero trust score (0-100) based on findings.
+
+## Google Cloud APIs Used
+
+| API | Endpoint |
+|-----|----------|
+| IAP | `iap.googleapis.com/v1/projects/{id}/iap_tunnel/...` |
+| Access Context Manager | `accesscontextmanager.googleapis.com/v1/accessPolicies/...` |
+| Resource Manager | `cloudresourcemanager.googleapis.com/v1/projects/{id}:getIamPolicy` |
+
+## Output Schema
+
+```json
+{
+  "project": "my-project",
+  "posture": {"iap_resources": 5, "findings": []},
+  "zero_trust_score": 85
+}
+```

skills/implementing-beyondcorp-zero-trust-access-model/scripts/agent.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""BeyondCorp zero trust access assessment agent using Google Cloud IAP API via requests."""
+
+import argparse
+import json
+import logging
+import os
+import subprocess
+import sys
+from datetime import datetime
+from typing import Dict, List, Optional
+
+try:
+    import requests
+except ImportError:
+    sys.exit("requests required: pip install requests")
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
+logger = logging.getLogger(__name__)
+
+
+def get_gcloud_token() -> str:
+    """Get access token from gcloud CLI."""
+    try:
+        result = subprocess.run(
+            ["gcloud", "auth", "print-access-token"], capture_output=True, text=True, timeout=10)
+        return result.stdout.strip()
+    except FileNotFoundError:
+        return ""
+
+
+def list_iap_resources(project_id: str, token: str) -> List[dict]:
+    """List IAP-protected resources in a GCP project."""
+    url = f"https://iap.googleapis.com/v1/projects/{project_id}/iap_tunnel/locations/-/destGroups"
+    resp = requests.get(url, headers={"Authorization": f"Bearer {token}"}, timeout=30)
+    if resp.status_code == 200:
+        return resp.json().get("destGroups", [])
+    return []
+
+
+def get_iap_settings(project_id: str, resource: str, token: str) -> dict:
+    """Get IAP settings for a specific resource."""
+    url = f"https://iap.googleapis.com/v1/projects/{project_id}/iap_web/compute/services/{resource}:iapSettings"
+    resp = requests.get(url, headers={"Authorization": f"Bearer {token}"}, timeout=30)
+    if resp.status_code == 200:
+        return resp.json()
+    return {"error": resp.status_code}
+
+
+def list_access_levels(org_id: str, policy_name: str, token: str) -> List[dict]:
+    """List Access Context Manager access levels."""
+    url = f"https://accesscontextmanager.googleapis.com/v1/accessPolicies/{policy_name}/accessLevels"
+    resp = requests.get(url, headers={"Authorization": f"Bearer {token}"}, timeout=30)
+    if resp.status_code == 200:
+        return resp.json().get("accessLevels", [])
+    return []
+
+
+def audit_iap_bindings(project_id: str, token: str) -> List[dict]:
+    """Audit IAM policy bindings for IAP-secured resources."""
+    url = f"https://cloudresourcemanager.googleapis.com/v1/projects/{project_id}:getIamPolicy"
+    resp = requests.post(url, headers={"Authorization": f"Bearer {token}"},
+                         json={}, timeout=30)
+    if resp.status_code != 200:
+        return []
+    bindings = resp.json().get("bindings", [])
+    iap_bindings = [b for b in bindings if "iap" in b.get("role", "").lower()]
+    return iap_bindings
+
+
+def assess_zero_trust_posture(project_id: str, token: str) -> dict:
+    """Assess BeyondCorp zero trust posture for a project."""
+    iap_resources = list_iap_resources(project_id, token)
+    iap_bindings = audit_iap_bindings(project_id, token)
+    findings = []
+    if not iap_resources:
+        findings.append({"severity": "HIGH", "finding": "No IAP-protected resources found"})
+    if not iap_bindings:
+        findings.append({"severity": "HIGH", "finding": "No IAP IAM bindings configured"})
+    allUsers = any("allUsers" in str(b.get("members", [])) for b in iap_bindings)
+    if allUsers:
+        findings.append({"severity": "CRITICAL", "finding": "IAP binding includes allUsers"})
+    return {
+        "iap_resources": len(iap_resources),
+        "iap_bindings": len(iap_bindings),
+        "findings": findings,
+    }
+
+
+def generate_report(project_id: str, token: str) -> dict:
+    """Generate BeyondCorp zero trust assessment report."""
+    report = {
+        "analysis_date": datetime.utcnow().isoformat(),
+        "project": project_id,
+        "posture": assess_zero_trust_posture(project_id, token),
+    }
+    score = 100
+    for f in report["posture"]["findings"]:
+        if f["severity"] == "CRITICAL":
+            score -= 30
+        elif f["severity"] == "HIGH":
+            score -= 15
+    report["zero_trust_score"] = max(0, score)
+    return report
+
+
+def main():
+    parser = argparse.ArgumentParser(description="BeyondCorp Zero Trust Assessment Agent")
+    parser.add_argument("--project", required=True, help="GCP project ID")
+    parser.add_argument("--token", default="", help="Access token (or uses gcloud)")
+    parser.add_argument("--output-dir", default=".")
+    parser.add_argument("--output", default="beyondcorp_report.json")
+    args = parser.parse_args()
+
+    token = args.token or get_gcloud_token()
+    if not token:
+        logger.error("No access token. Run: gcloud auth print-access-token")
+        sys.exit(1)
+
+    os.makedirs(args.output_dir, exist_ok=True)
+    report = generate_report(args.project, token)
+    out_path = os.path.join(args.output_dir, args.output)
+    with open(out_path, "w") as f:
+        json.dump(report, f, indent=2)
+    logger.info("Report saved to %s", out_path)
+    print(json.dumps(report, indent=2))
+
+
+if __name__ == "__main__":
+    main()