Add 55 new skills across 3 new domains + 6 undercovered areas (762 -> 817)

Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):

- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
  prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
  invocation, guardrails, model/data poisoning, system-prompt leakage,
  embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
  malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
  Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
  shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
  Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration

Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.

skills/enumerating-cloud-with-cloudfox/references/api-reference.md

@@ -0,0 +1,53 @@
+# CloudFox — Command Reference
+
+## Global Invocation
+
+```
+cloudfox <provider> [global-flags] <command>
+```
+
+| Flag | Description |
+|------|-------------|
+| `--profile <name>` | AWS named profile to use |
+| `-o, --outdir <dir>` | Output directory for results/loot |
+| `--region <region>` | Restrict to a region (where applicable) |
+| `-v` | Verbosity level |
+| `AWS_PROFILE` (env) | Alternative to `--profile` |
+
+## AWS Commands (selection)
+
+| Command | Description |
+|---------|-------------|
+| `all-checks` | Run all AWS enumeration commands with defaults |
+| `inventory` | Account size / resource counts by region |
+| `endpoints` | Internet-reachable service endpoints |
+| `instances` | EC2 instances with IPs and instance-profile roles |
+| `principals` | IAM users and roles |
+| `permissions` | Effective IAM permissions per principal |
+| `iam-simulator` | Simulate whether principals can perform actions |
+| `role-trusts` | Who can assume which roles (assume-role paths) |
+| `access-keys` | Active IAM access keys |
+| `secrets` | Secrets from Secrets Manager and SSM Parameter Store |
+| `buckets` | S3 buckets |
+| `ecr` | Elastic Container Registry repositories/images |
+| `lambda` | Lambda functions and configuration |
+| `route53` | Hosted zones and records |
+| `ram` | Resource Access Manager shares |
+| `sns` / `sqs` | Messaging resources |
+| `env-vars` | Environment variables across services |
+
+## Azure Commands
+
+| Command | Description |
+|---------|-------------|
+| `inventory` | Resource inventory by location/subscription |
+| `rbac` | Role-based access control assignments |
+| `storage` | Storage accounts and access data |
+| `vms` | Virtual machines |
+
+## Output Layout
+
+CloudFox writes to `<outdir>/cloudfox-output/<provider>/<account-or-sub>/`:
+- `table/` and `csv/` — per-command findings
+- `loot/` — ready-to-run follow-up commands (e.g., `aws s3 ls`, `ssm start-session`)
+- A combined log of the run

skills/enumerating-cloud-with-cloudfox/references/standards.md

@@ -0,0 +1,22 @@
+# Standards and Framework Mapping
+
+## NIST Cybersecurity Framework 2.0
+
+| ID | Name | Rationale |
+|----|------|-----------|
+| ID.AM-03 | Organizational communication and data flows are mapped (asset/inventory management) | CloudFox builds an attacker-centric inventory of cloud assets, identities, and trust relationships, informing asset-management gaps. |
+
+## MITRE ATT&CK (Enterprise / Cloud)
+
+| ID | Name | Rationale |
+|----|------|-----------|
+| T1526 | Cloud Service Discovery | CloudFox enumerates available cloud services and resources. |
+| T1580 | Cloud Infrastructure Discovery | Inventory/instances/buckets map the infrastructure footprint. |
+| T1087.004 | Account Discovery: Cloud Account | `principals`/`access-keys` enumerate cloud identities. |
+| T1069.003 | Permission Groups Discovery: Cloud Groups | `permissions`/`role-trusts` reveal cloud entitlements. |
+| T1538 | Cloud Service Dashboard | Aggregated cross-service situational awareness. |
+
+## Supporting References
+
+- BishopFox CloudFox — https://github.com/BishopFox/cloudfox
+- NIST CSF 2.0 — https://www.nist.gov/cyberframework