Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/implementing-dmarc-dkim-spf-email-security/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Anthropic Agent Skills Contributors
+Copyright (c) 2025 Mahipal
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

skills/implementing-dmarc-dkim-spf-email-security/references/api-reference.md

@@ -0,0 +1,51 @@
+# API Reference: Implementing DMARC/DKIM/SPF Email Security
+
+## dnspython Lookups
+
+```python
+import dns.resolver
+# SPF
+answers = dns.resolver.resolve("example.com", "TXT")
+# DMARC
+answers = dns.resolver.resolve("_dmarc.example.com", "TXT")
+# DKIM
+answers = dns.resolver.resolve("selector._domainkey.example.com", "TXT")
+```
+
+## SPF Record Syntax
+
+| Mechanism | Example | Meaning |
+|-----------|---------|---------|
+| `include:` | `include:_spf.google.com` | Authorize sender |
+| `ip4:` | `ip4:203.0.113.0/24` | Allow IP range |
+| `-all` | End of record | Hard fail others |
+| `~all` | End of record | Soft fail (weak) |
+| `+all` | End of record | Allow all (insecure) |
+
+## DMARC Policy Levels
+
+| Policy | Action | Severity if Missing |
+|--------|--------|---------------------|
+| `p=reject` | Reject failing mail | Recommended |
+| `p=quarantine` | Send to spam | Acceptable |
+| `p=none` | Monitor only | HIGH risk |
+
+## Recommended DNS Records
+
+```
+# SPF
+v=spf1 include:_spf.google.com -all
+
+# DMARC
+v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@example.com; adkim=s; aspf=s
+
+# DKIM (provider-specific key)
+selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjAN..."
+```
+
+### References
+
+- SPF RFC 7208: https://www.rfc-editor.org/rfc/rfc7208
+- DMARC RFC 7489: https://www.rfc-editor.org/rfc/rfc7489
+- DKIM RFC 6376: https://www.rfc-editor.org/rfc/rfc6376
+- dnspython: https://dnspython.readthedocs.io/

skills/implementing-dmarc-dkim-spf-email-security/scripts/agent.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""Agent for implementing and auditing DMARC, DKIM, and SPF email security."""
+
+import json
+import argparse
+import subprocess
+import re
+from datetime import datetime
+
+try:
+    import dns.resolver
+except ImportError:
+    dns = None
+
+
+def check_spf_record(domain):
+    """Check SPF record for a domain."""
+    try:
+        answers = dns.resolver.resolve(domain, "TXT")
+        for rdata in answers:
+            txt = rdata.to_text().strip('"')
+            if txt.startswith("v=spf1"):
+                issues = []
+                if "+all" in txt:
+                    issues.append({"issue": "spf_plus_all", "severity": "CRITICAL"})
+                if "~all" in txt:
+                    issues.append({"issue": "spf_softfail", "severity": "MEDIUM"})
+                lookups = txt.count("include:") + txt.count("a:") + txt.count("mx")
+                if lookups > 10:
+                    issues.append({"issue": "spf_too_many_lookups", "count": lookups, "severity": "HIGH"})
+                return {"domain": domain, "record": txt, "valid": True, "issues": issues}
+        return {"domain": domain, "record": None, "valid": False,
+                "issues": [{"issue": "no_spf_record", "severity": "HIGH"}]}
+    except Exception as e:
+        return {"domain": domain, "error": str(e)}
+
+
+def check_dmarc_record(domain):
+    """Check DMARC record for a domain."""
+    try:
+        answers = dns.resolver.resolve(f"_dmarc.{domain}", "TXT")
+        for rdata in answers:
+            txt = rdata.to_text().strip('"')
+            if txt.startswith("v=DMARC1"):
+                issues = []
+                policy_match = re.search(r"p=(\w+)", txt)
+                policy = policy_match.group(1) if policy_match else "none"
+                if policy == "none":
+                    issues.append({"issue": "dmarc_policy_none", "severity": "HIGH"})
+                pct_match = re.search(r"pct=(\d+)", txt)
+                if pct_match and int(pct_match.group(1)) < 100:
+                    issues.append({"issue": "dmarc_pct_not_100", "severity": "MEDIUM"})
+                if "rua=" not in txt:
+                    issues.append({"issue": "no_aggregate_reporting", "severity": "MEDIUM"})
+                return {"domain": domain, "record": txt, "policy": policy, "issues": issues}
+        return {"domain": domain, "record": None,
+                "issues": [{"issue": "no_dmarc_record", "severity": "CRITICAL"}]}
+    except Exception as e:
+        return {"domain": domain, "error": str(e)}
+
+
+def check_dkim_record(domain, selector="default"):
+    """Check DKIM record for a domain and selector."""
+    try:
+        dkim_domain = f"{selector}._domainkey.{domain}"
+        answers = dns.resolver.resolve(dkim_domain, "TXT")
+        for rdata in answers:
+            txt = rdata.to_text().strip('"')
+            issues = []
+            if "k=rsa" in txt:
+                p_match = re.search(r"p=([A-Za-z0-9+/=]+)", txt)
+                if p_match and len(p_match.group(1)) < 300:
+                    issues.append({"issue": "weak_dkim_key", "severity": "HIGH"})
+            return {"domain": domain, "selector": selector, "record": txt[:200], "issues": issues}
+        return {"domain": domain, "selector": selector, "record": None}
+    except Exception as e:
+        return {"domain": domain, "selector": selector, "error": str(e)}
+
+
+def audit_domains(domain_list):
+    """Audit multiple domains for email security records."""
+    results = []
+    for domain in domain_list:
+        result = {
+            "domain": domain,
+            "spf": check_spf_record(domain),
+            "dmarc": check_dmarc_record(domain),
+            "dkim": check_dkim_record(domain),
+        }
+        all_issues = (result["spf"].get("issues", []) + result["dmarc"].get("issues", [])
+                     + result["dkim"].get("issues", []))
+        critical = sum(1 for i in all_issues if i.get("severity") == "CRITICAL")
+        result["risk_level"] = "CRITICAL" if critical > 0 else "HIGH" if len(all_issues) > 2 else "MEDIUM"
+        results.append(result)
+    return results
+
+
+def generate_dns_records(domain, policy="reject"):
+    """Generate recommended SPF, DMARC, and DKIM DNS records."""
+    return {
+        "spf": f'v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all',
+        "dmarc": f'v=DMARC1; p={policy}; pct=100; rua=mailto:dmarc-reports@{domain}; '
+                 f'ruf=mailto:dmarc-forensics@{domain}; adkim=s; aspf=s',
+        "dkim_selector": "google._domainkey",
+        "notes": "DKIM key must be generated by your email provider",
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="DMARC/DKIM/SPF Email Security Agent")
+    parser.add_argument("--domains", nargs="+", help="Domains to audit")
+    parser.add_argument("--generate", help="Domain to generate records for")
+    parser.add_argument("--output", default="email_security_report.json")
+    args = parser.parse_args()
+
+    report = {"generated_at": datetime.utcnow().isoformat(), "findings": {}}
+
+    if args.domains:
+        results = audit_domains(args.domains)
+        report["findings"]["domain_audit"] = results
+        for r in results:
+            print(f"[+] {r['domain']}: {r['risk_level']}")
+
+    if args.generate:
+        records = generate_dns_records(args.generate)
+        report["findings"]["recommended_records"] = records
+        print(f"[+] Generated records for {args.generate}")
+
+    with open(args.output, "w") as f:
+        json.dump(report, f, indent=2, default=str)
+    print(f"[+] Report saved to {args.output}")
+
+
+if __name__ == "__main__":
+    main()