Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/building-threat-actor-profile-from-osint/references/api-reference.md

@@ -0,0 +1,73 @@
+# API Reference: Threat Actor Profiling from OSINT
+
+## MITRE ATT&CK STIX Data
+```bash
+curl -o enterprise-attack.json \
+  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json
+```
+
+### STIX Object Types
+| Type | Description |
+|------|-------------|
+| `intrusion-set` | Threat actor groups |
+| `attack-pattern` | Techniques/sub-techniques |
+| `malware` | Malware families |
+| `tool` | Legitimate tools abused |
+| `relationship` | Links (group "uses" technique) |
+
+## AlienVault OTX API
+```
+GET https://otx.alienvault.com/api/v1/pulses/search?q={group_name}&limit=10
+X-OTX-API-KEY: $OTX_API_KEY
+```
+
+### OTX Pulse Fields
+| Field | Description |
+|-------|-------------|
+| `name` | Pulse title |
+| `created` | Publication date |
+| `tags` | Topic tags |
+| `indicators` | IOCs (IPs, domains, hashes) |
+
+## MITRE ATT&CK Navigator Layer
+```json
+{
+  "name": "APT29 Techniques",
+  "versions": {"attack": "14", "navigator": "4.9"},
+  "domain": "enterprise-attack",
+  "techniques": [
+    {"techniqueID": "T1566.001", "score": 100, "color": "#ff6666"}
+  ]
+}
+```
+
+## ATT&CK Tactic IDs
+| Tactic | ID |
+|--------|-----|
+| Initial Access | TA0001 |
+| Execution | TA0002 |
+| Persistence | TA0003 |
+| Privilege Escalation | TA0004 |
+| Defense Evasion | TA0005 |
+| Credential Access | TA0006 |
+| Discovery | TA0007 |
+| Lateral Movement | TA0008 |
+| Collection | TA0009 |
+| Exfiltration | TA0010 |
+| Command and Control | TA0011 |
+| Impact | TA0040 |
+
+## MALPEDIA API
+```
+GET https://malpedia.caad.fkie.fraunhofer.de/api/list/actors
+Authorization: apitoken $MALPEDIA_API_KEY
+```
+
+## Threat Actor Profiling Fields
+| Field | Source |
+|-------|--------|
+| Aliases | ATT&CK intrusion-set |
+| TTPs | ATT&CK relationships |
+| Malware | ATT&CK malware objects |
+| IOCs | OTX pulse indicators |
+| Reports | OTX, MITRE references |