Add 10 new cybersecurity skills with full folder anatomy

Skills added:
- implementing-privileged-access-workstation (IAM, PAW hardening)
- detecting-suspicious-oauth-application-consent (cloud security, Graph API)
- performing-hardware-security-module-integration (cryptography, PKCS#11)
- analyzing-android-malware-with-apktool (malware analysis, androguard)
- hunting-for-unusual-service-installations (threat hunting, T1543.003)
- detecting-shadow-it-cloud-usage (cloud security, proxy/DNS log analysis)
- performing-active-directory-forest-trust-attack (red team, impacket)
- implementing-deception-based-detection-with-canarytoken (deception, Canary API)
- analyzing-office365-audit-logs-for-compromise (cloud security, BEC detection)
- hunting-for-startup-folder-persistence (threat hunting, T1547.001)

Each skill includes SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/implementing-privileged-access-workstation/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: implementing-privileged-access-workstation
+description: Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.
+domain: cybersecurity
+subdomain: identity-and-access-management
+tags: [privileged-access, PAW, zero-trust, device-hardening, CyberArk, BeyondTrust, just-in-time-access]
+version: "1.0"
+author: mahipal
+license: Apache-2.0
+---
+
+# Implementing Privileged Access Workstation
+
+## Overview
+
+A Privileged Access Workstation (PAW) is a hardened device dedicated to performing sensitive administrative tasks. This skill covers PAW design using the tiered administration model, device compliance enforcement via Microsoft Intune or Group Policy, just-in-time (JIT) access provisioning, and integration with privileged access management (PAM) platforms like CyberArk and BeyondTrust.
+
+## Prerequisites
+
+- Windows 10/11 Enterprise with Virtualization Based Security (VBS)
+- Microsoft Intune or Active Directory Group Policy
+- CyberArk Privileged Access Security or BeyondTrust Password Safe (optional)
+- Python 3.9+ with `requests`, `subprocess`, `json`
+- Administrative access to target endpoints
+
+## Steps
+
+1. Audit current privileged access patterns and identify Tier 0/1/2 assets
+2. Configure device hardening baselines (AppLocker, Credential Guard, Device Guard)
+3. Enforce compliance policies via Intune or GPO
+4. Implement just-in-time access with time-limited admin group membership
+5. Integrate with CyberArk/BeyondTrust for credential vaulting
+6. Validate PAW configuration against CIS and Microsoft PAW guidance
+7. Monitor privileged sessions and generate compliance reports
+
+## Expected Output
+
+- JSON report listing device compliance status, hardening checks, JIT access windows, and PAM integration verification
+- Risk scoring per workstation with remediation recommendations