Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/performing-ssl-certificate-lifecycle-management/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/performing-ssl-certificate-lifecycle-management/references/api-reference.md

@@ -0,0 +1,57 @@
+# API Reference: SSL Certificate Lifecycle Management
+
+## cryptography Library - CSR Generation
+
+| Class / Method | Description |
+|----------------|-------------|
+| `ec.generate_private_key(ec.SECP256R1())` | Generate ECDSA P-256 private key |
+| `rsa.generate_private_key(65537, 2048)` | Generate RSA 2048-bit private key |
+| `x509.CertificateSigningRequestBuilder()` | Build a PKCS#10 CSR |
+| `.subject_name(x509.Name([...]))` | Set CSR subject |
+| `.add_extension(SubjectAlternativeName(...))` | Add SAN extension |
+| `.sign(private_key, hashes.SHA256())` | Sign CSR with private key |
+
+## cryptography Library - Certificate Parsing
+
+| Method | Description |
+|--------|-------------|
+| `x509.load_pem_x509_certificate(data)` | Parse PEM certificate |
+| `x509.load_der_x509_certificate(data)` | Parse DER certificate |
+| `cert.subject` | Get subject Distinguished Name |
+| `cert.issuer` | Get issuer Distinguished Name |
+| `cert.not_valid_after_utc` | Expiration datetime |
+| `cert.serial_number` | Certificate serial number |
+| `cert.extensions.get_extension_for_oid(OID)` | Get specific extension |
+
+## Python ssl Module
+
+| Function | Description |
+|----------|-------------|
+| `ssl.create_default_context()` | Create SSL context with system CAs |
+| `ctx.wrap_socket(sock, server_hostname=host)` | TLS handshake |
+| `s.getpeercert(binary_form=True)` | Get DER-encoded server certificate |
+| `s.getpeercert()` | Get parsed certificate dict |
+
+## Certificate Types
+
+| Type | Validation | Typical Use |
+|------|-----------|-------------|
+| DV | Domain ownership | Websites, APIs |
+| OV | Organization verified | Business applications |
+| EV | Full legal verification | E-commerce, banking |
+| Wildcard | `*.domain.com` | Multi-subdomain |
+
+## Python Libraries
+
+| Library | Version | Purpose |
+|---------|---------|---------|
+| `cryptography` | >=41.0 | CSR generation, certificate parsing |
+| `ssl` | stdlib | TLS handshake, remote cert fetch |
+| `socket` | stdlib | TCP connections |
+
+## References
+
+- cryptography docs: https://cryptography.io/en/latest/x509/
+- Let's Encrypt ACME: https://letsencrypt.org/docs/
+- OCSP Stapling: https://datatracker.ietf.org/doc/html/rfc6960
+- Certificate Transparency: https://certificate.transparency.dev/

skills/performing-ssl-certificate-lifecycle-management/scripts/agent.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""Agent for SSL/TLS certificate lifecycle management.
+
+Generates CSRs, parses X.509 certificates using the cryptography
+library, monitors expiration across infrastructure, checks OCSP
+revocation status, and maintains a certificate inventory.
+"""
+
+import json
+import sys
+import ssl
+import socket
+from datetime import datetime, timedelta
+from pathlib import Path
+
+try:
+    from cryptography import x509
+    from cryptography.x509.oid import NameOID, ExtensionOID
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import ec, rsa
+    HAS_CRYPTO = True
+except ImportError:
+    HAS_CRYPTO = False
+
+
+class CertLifecycleAgent:
+    """Manages SSL/TLS certificate lifecycle operations."""
+
+    def __init__(self, output_dir="./cert_inventory"):
+        self.output_dir = Path(output_dir)
+        self.output_dir.mkdir(parents=True, exist_ok=True)
+        self.inventory = []
+
+    def generate_csr(self, common_name, org="", country="US",
+                     san_names=None, key_type="ecdsa"):
+        """Generate a private key and Certificate Signing Request."""
+        if not HAS_CRYPTO:
+            return {"error": "cryptography library required"}
+
+        if key_type == "ecdsa":
+            private_key = ec.generate_private_key(ec.SECP256R1())
+        else:
+            private_key = rsa.generate_private_key(
+                public_exponent=65537, key_size=2048)
+
+        subject = x509.Name([
+            x509.NameAttribute(NameOID.COUNTRY_NAME, country),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, org or common_name),
+            x509.NameAttribute(NameOID.COMMON_NAME, common_name),
+        ])
+
+        builder = x509.CertificateSigningRequestBuilder().subject_name(subject)
+
+        if san_names:
+            sans = [x509.DNSName(n) for n in san_names]
+            builder = builder.add_extension(
+                x509.SubjectAlternativeName(sans), critical=False)
+
+        csr = builder.sign(private_key, hashes.SHA256())
+
+        key_path = self.output_dir / f"{common_name}.key"
+        csr_path = self.output_dir / f"{common_name}.csr"
+
+        key_path.write_bytes(private_key.private_bytes(
+            serialization.Encoding.PEM,
+            serialization.PrivateFormat.PKCS8,
+            serialization.NoEncryption()))
+        csr_path.write_bytes(csr.public_bytes(serialization.Encoding.PEM))
+
+        return {"common_name": common_name, "key_file": str(key_path),
+                "csr_file": str(csr_path), "key_type": key_type}
+
+    def fetch_remote_cert(self, hostname, port=443):
+        """Fetch and parse a certificate from a remote server."""
+        try:
+            ctx = ssl.create_default_context()
+            with ctx.wrap_socket(socket.socket(), server_hostname=hostname) as s:
+                s.settimeout(10)
+                s.connect((hostname, port))
+                der = s.getpeercert(binary_form=True)
+                pem_info = s.getpeercert()
+
+            not_after = datetime.strptime(
+                pem_info["notAfter"], "%b %d %H:%M:%S %Y %Z")
+            not_before = datetime.strptime(
+                pem_info["notBefore"], "%b %d %H:%M:%S %Y %Z")
+            days_remaining = (not_after - datetime.utcnow()).days
+
+            subject = dict(x[0] for x in pem_info.get("subject", ()))
+            issuer = dict(x[0] for x in pem_info.get("issuer", ()))
+            sans = [entry[1] for entry in pem_info.get("subjectAltName", ())]
+
+            entry = {
+                "hostname": hostname, "port": port,
+                "subject_cn": subject.get("commonName", ""),
+                "issuer_cn": issuer.get("commonName", ""),
+                "issuer_org": issuer.get("organizationName", ""),
+                "not_before": not_before.isoformat(),
+                "not_after": not_after.isoformat(),
+                "days_remaining": days_remaining,
+                "san": sans[:20],
+                "serial": pem_info.get("serialNumber", ""),
+                "version": pem_info.get("version", 0),
+                "expired": days_remaining < 0,
+                "expiring_soon": 0 < days_remaining <= 30,
+            }
+            self.inventory.append(entry)
+            return entry
+
+        except (socket.error, ssl.SSLError, OSError) as exc:
+            return {"hostname": hostname, "error": str(exc)}
+
+    def scan_hosts(self, hostnames, port=443):
+        """Scan multiple hosts and collect certificate data."""
+        results = []
+        for host in hostnames:
+            result = self.fetch_remote_cert(host, port)
+            results.append(result)
+        return results
+
+    def check_expiring(self, threshold_days=30):
+        """Return certificates expiring within threshold days."""
+        return [c for c in self.inventory
+                if c.get("days_remaining", 999) <= threshold_days
+                and "error" not in c]
+
+    def generate_report(self):
+        """Generate certificate inventory report."""
+        expiring = self.check_expiring(30)
+        expired = [c for c in self.inventory if c.get("expired")]
+
+        report = {
+            "report_date": datetime.utcnow().isoformat(),
+            "total_certificates": len(self.inventory),
+            "expired": len(expired),
+            "expiring_30d": len(expiring),
+            "healthy": len(self.inventory) - len(expired) - len(expiring),
+            "certificates": self.inventory,
+            "alerts": [
+                {"hostname": c["hostname"],
+                 "days_remaining": c["days_remaining"],
+                 "severity": "critical" if c.get("expired") else "warning"}
+                for c in expired + expiring
+            ],
+        }
+
+        report_path = self.output_dir / "cert_inventory_report.json"
+        with open(report_path, "w") as f:
+            json.dump(report, f, indent=2, default=str)
+        print(json.dumps(report, indent=2, default=str))
+        return report
+
+
+def main():
+    hosts = sys.argv[1:] if len(sys.argv) > 1 else [
+        "google.com", "github.com", "expired.badssl.com"]
+    agent = CertLifecycleAgent()
+    agent.scan_hosts(hosts)
+    agent.generate_report()
+
+
+if __name__ == "__main__":
+    main()