Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/exploiting-broken-function-level-authorization/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Anthropic Agent Skills Contributors
+Copyright (c) 2025 Mahipal
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

skills/exploiting-broken-function-level-authorization/references/api-reference.md

@@ -0,0 +1,89 @@
+# API Reference: Broken Function Level Authorization (BFLA)
+
+## OWASP API5:2023 — Broken Function Level Authorization
+
+### Description
+API endpoints expose functions that should be restricted to specific roles.
+Low-privileged users can invoke admin-level functionality.
+
+### Common Patterns
+| Pattern | Example |
+|---------|---------|
+| Guessable admin paths | `/api/admin/users` |
+| Method switching | POST allowed but PUT bypasses auth |
+| Role parameter manipulation | `{"role": "admin"}` in request |
+| Vertical privilege escalation | User accessing admin endpoints |
+
+## Testing Methodology
+
+### Step 1: Discover Endpoints
+```bash
+# From OpenAPI spec
+curl https://api.target.com/swagger.json | jq '.paths | keys'
+
+# From JavaScript source
+grep -oP '["'"'"']/api/[^"'"'"']+' app.js
+```
+
+### Step 2: Test with Low-Priv Token
+```bash
+curl -H "Authorization: Bearer <low_priv_token>" \
+     https://api.target.com/api/admin/users
+```
+
+### Step 3: Test HTTP Method Switching
+```bash
+# If GET returns 403, try POST/PUT/DELETE
+curl -X PUT -H "Authorization: Bearer <low_priv_token>" \
+     https://api.target.com/api/admin/users/1
+```
+
+## Python requests Library
+
+### Request with Token
+```python
+headers = {"Authorization": f"Bearer {token}"}
+resp = requests.get(url, headers=headers, timeout=10, verify=False)
+```
+
+### Method Switching
+```python
+for method in ["GET", "POST", "PUT", "DELETE", "PATCH"]:
+    resp = requests.request(method, url, headers=headers, timeout=10)
+    if resp.status_code < 400:
+        print(f"Accessible via {method}: {resp.status_code}")
+```
+
+## Common Admin Endpoints to Test
+
+```
+/admin
+/api/admin
+/api/v1/admin/users
+/api/internal
+/manage
+/api/config
+/api/debug
+/api/users/all
+/api/system/settings
+/graphql (with admin mutations)
+```
+
+## Burp Suite — Authorization Testing
+
+### Autorize Extension
+1. Install Autorize from BApp Store
+2. Set low-privilege cookie/token
+3. Browse application as admin
+4. Autorize replays requests with low-priv token
+5. Compare responses for authorization bypass
+
+## Response Analysis
+
+| Indicator | Meaning |
+|-----------|---------|
+| 200 with data | Full access (vulnerability) |
+| 200 empty body | Possible partial bypass |
+| 403 Forbidden | Properly restricted |
+| 401 Unauthorized | Auth required |
+| 405 Method Not Allowed | Method restricted |

skills/exploiting-broken-function-level-authorization/scripts/agent.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Agent for testing Broken Function Level Authorization (BFLA) in APIs."""
+
+import argparse
+import json
+import sys
+from datetime import datetime, timezone
+
+try:
+    import requests
+    HAS_REQUESTS = True
+except ImportError:
+    HAS_REQUESTS = False
+
+
+ADMIN_ENDPOINTS = [
+    "/admin", "/admin/users", "/admin/settings", "/admin/config",
+    "/api/admin/users", "/api/v1/admin", "/api/internal",
+    "/manage", "/management", "/dashboard/admin",
+    "/api/users/all", "/api/config", "/api/debug",
+]
+
+HTTP_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH"]
+
+
+def test_endpoint_access(base_url, endpoint, token, method="GET"):
+    """Test if an endpoint is accessible with given credentials."""
+    if not HAS_REQUESTS:
+        return None
+    url = f"{base_url.rstrip('/')}{endpoint}"
+    headers = {"Authorization": f"Bearer {token}"} if token else {}
+    try:
+        resp = requests.request(method, url, headers=headers, timeout=10, verify=False)
+        return {
+            "endpoint": endpoint,
+            "method": method,
+            "status_code": resp.status_code,
+            "response_size": len(resp.content),
+            "accessible": resp.status_code < 400,
+        }
+    except requests.RequestException:
+        return None
+
+
+def test_method_switching(base_url, endpoint, token):
+    """Test if changing HTTP method bypasses authorization."""
+    results = []
+    for method in HTTP_METHODS:
+        result = test_endpoint_access(base_url, endpoint, token, method)
+        if result and result["accessible"]:
+            results.append(result)
+    return results
+
+
+def test_privilege_escalation(base_url, low_priv_token, endpoints=None):
+    """Test if low-privilege user can access admin endpoints."""
+    findings = []
+    test_endpoints = endpoints or ADMIN_ENDPOINTS
+    for ep in test_endpoints:
+        result = test_endpoint_access(base_url, ep, low_priv_token)
+        if result and result["accessible"]:
+            findings.append({
+                "vulnerability": "BFLA",
+                "endpoint": ep,
+                "status_code": result["status_code"],
+                "response_size": result["response_size"],
+                "severity": "HIGH",
+            })
+    return findings
+
+
+def test_idor_via_function(base_url, token, user_id, target_user_id):
+    """Test function-level auth by accessing another user's admin functions."""
+    findings = []
+    endpoints = [
+        f"/api/users/{target_user_id}",
+        f"/api/users/{target_user_id}/settings",
+        f"/api/users/{target_user_id}/role",
+    ]
+    for ep in endpoints:
+        for method in ["GET", "PUT", "DELETE"]:
+            result = test_endpoint_access(base_url, ep, token, method)
+            if result and result["accessible"]:
+                findings.append({
+                    "vulnerability": "BFLA+IDOR",
+                    "endpoint": ep,
+                    "method": method,
+                    "own_user_id": user_id,
+                    "target_user_id": target_user_id,
+                })
+    return findings
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Test Broken Function Level Authorization (authorized testing only)"
+    )
+    parser.add_argument("--url", required=True, help="Base API URL")
+    parser.add_argument("--token", help="Low-privilege user JWT token")
+    parser.add_argument("--endpoints", nargs="*", help="Custom admin endpoints to test")
+    parser.add_argument("--user-id", help="Current user ID")
+    parser.add_argument("--target-id", help="Target user ID for IDOR test")
+    parser.add_argument("--output", "-o", help="Output JSON report")
+    args = parser.parse_args()
+
+    print("[*] BFLA Testing Agent")
+    print("[!] For authorized security testing only")
+    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "target": args.url, "findings": []}
+
+    escalation = test_privilege_escalation(args.url, args.token, args.endpoints)
+    report["findings"].extend(escalation)
+    print(f"[*] Privilege escalation findings: {len(escalation)}")
+
+    if args.user_id and args.target_id:
+        idor = test_idor_via_function(args.url, args.token, args.user_id, args.target_id)
+        report["findings"].extend(idor)
+        print(f"[*] IDOR findings: {len(idor)}")
+
+    report["risk_level"] = "CRITICAL" if report["findings"] else "LOW"
+
+    if args.output:
+        with open(args.output, "w") as f:
+            json.dump(report, f, indent=2)
+        print(f"[*] Report saved to {args.output}")
+    else:
+        print(json.dumps(report, indent=2))
+
+
+if __name__ == "__main__":
+    main()