Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/implementing-network-segmentation-with-firewall-zones/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Anthropic Agent Skills Contributors
+Copyright (c) 2025 Mahipal
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

skills/implementing-network-segmentation-with-firewall-zones/references/api-reference.md

@@ -0,0 +1,80 @@
+# API Reference: Implementing Network Segmentation with Firewall Zones
+
+## Zone Trust Levels
+
+| Zone | Trust Level | Typical VLANs | Default Policy |
+|------|-------------|---------------|----------------|
+| Internet | 0 (Untrusted) | N/A | Deny all inbound |
+| DMZ | 1 (Low) | 10-19 | Permit specific inbound services |
+| Guest | 1 (Low) | 50-59 | Internet-only, deny internal |
+| Corporate | 3 (Medium) | 100-199 | Permit outbound, restricted inbound |
+| Server/DC | 4 (High) | 200-299 | Strict ACL, limited admin |
+| PCI CDE | 5 (Critical) | 300-309 | PCI DSS compliant isolation |
+| Management | 5 (Critical) | 900-909 | Jump box only |
+| OT/SCADA | 5 (Critical) | 400-409 | Air-gapped or strictly firewalled |
+
+## Palo Alto Zone-Based CLI
+
+```bash
+# Create security zone
+set network zone trust network layer3 ethernet1/2
+set network zone untrust network layer3 ethernet1/1
+set network zone dmz network layer3 ethernet1/3
+
+# Inter-zone security policy
+set rulebase security rules Allow-Corp-to-DMZ from trust to dmz \
+  application web-browsing action allow log-end yes
+
+# Default deny rule
+set rulebase security rules Deny-All from any to any application any action deny log-start yes
+```
+
+## Cisco ASA Zone Commands
+
+```bash
+# Define nameif and security level
+interface GigabitEthernet0/0
+  nameif outside
+  security-level 0
+interface GigabitEthernet0/1
+  nameif inside
+  security-level 100
+interface GigabitEthernet0/2
+  nameif dmz
+  security-level 50
+
+# ACL for inter-zone traffic
+access-list OUTSIDE_IN extended permit tcp any host 192.168.10.5 eq 443
+access-group OUTSIDE_IN in interface outside
+```
+
+## PCI DSS Segmentation Requirements
+
+| Requirement | Control |
+|-------------|---------|
+| Req 1.2 | Restrict connections between untrusted and CDE |
+| Req 1.3 | Prohibit direct public access to CDE |
+| Req 1.4 | Personal firewall on portable devices |
+| Req 11.3.4 | Penetration testing validates segmentation |
+
+## VLAN Trunking (802.1Q)
+
+```bash
+# Cisco switch VLAN configuration
+vlan 100
+  name Corporate
+vlan 200
+  name Servers
+vlan 300
+  name PCI_CDE
+
+interface GigabitEthernet0/1
+  switchport mode trunk
+  switchport trunk allowed vlan 100,200,300
+```
+
+### References
+
+- NIST SP 800-41: https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final
+- PCI DSS v4.0 Network Segmentation: https://www.pcisecuritystandards.org/
+- CIS Controls v8 Control 12: https://www.cisecurity.org/controls/v8

skills/implementing-network-segmentation-with-firewall-zones/scripts/agent.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+"""Firewall Zone Segmentation Agent - audits zone-based firewall rules and inter-zone traffic policies."""
+
+import json
+import argparse
+import logging
+import subprocess
+from collections import defaultdict
+from datetime import datetime
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
+logger = logging.getLogger(__name__)
+
+
+def parse_firewall_config(config_file):
+    with open(config_file) as f:
+        return json.load(f)
+
+
+def get_iptables_zones():
+    cmd = ["iptables", "-L", "-n", "-v", "--line-numbers"]
+    result = subprocess.run(cmd, capture_output=True, text=True)
+    chains = defaultdict(list)
+    current_chain = ""
+    for line in result.stdout.split("\n"):
+        if line.startswith("Chain"):
+            current_chain = line.split()[1]
+        elif line.strip() and not line.startswith("num"):
+            chains[current_chain].append(line.strip())
+    return dict(chains)
+
+
+def audit_zone_rules(config):
+    findings = []
+    rules = config.get("rules", [])
+    for rule in rules:
+        src_zone = rule.get("source_zone", "")
+        dst_zone = rule.get("destination_zone", "")
+        action = rule.get("action", "")
+        service = rule.get("service", "any")
+        if action == "allow" and service == "any":
+            findings.append({"rule_id": rule.get("id", ""), "source_zone": src_zone, "dest_zone": dst_zone,
+                           "issue": "Allows all services between zones", "severity": "high"})
+        if action == "allow" and src_zone == "untrust" and dst_zone == "trust":
+            findings.append({"rule_id": rule.get("id", ""), "issue": "Inbound from untrust to trust zone", "severity": "critical"})
+        if rule.get("log") is False and action == "allow":
+            findings.append({"rule_id": rule.get("id", ""), "issue": "Allow rule without logging", "severity": "medium"})
+    return findings
+
+
+def check_default_zone_policies(config):
+    issues = []
+    for zone in config.get("zones", []):
+        if zone.get("default_action", "deny") != "deny":
+            issues.append({"zone": zone.get("name"), "default_action": zone.get("default_action"),
+                         "issue": "Default zone policy is not deny", "severity": "critical"})
+    return issues
+
+
+def analyze_rule_shadowing(rules):
+    shadowed = []
+    for i, rule in enumerate(rules):
+        for j in range(i):
+            prev = rules[j]
+            if (prev.get("source_zone") == rule.get("source_zone") and
+                prev.get("destination_zone") == rule.get("destination_zone") and
+                prev.get("service") == "any" and prev.get("action") == "allow"):
+                shadowed.append({"rule_id": rule.get("id"), "shadowed_by": prev.get("id"), "severity": "low"})
+                break
+    return shadowed
+
+
+def generate_report(config, zone_findings, default_issues, shadowed):
+    all_findings = zone_findings + default_issues + shadowed
+    report = {
+        "timestamp": datetime.utcnow().isoformat(),
+        "total_zones": len(config.get("zones", [])),
+        "total_rules": len(config.get("rules", [])),
+        "zone_rule_findings": zone_findings,
+        "default_policy_issues": default_issues,
+        "shadowed_rules": shadowed,
+        "total_findings": len(all_findings),
+        "critical_findings": sum(1 for f in all_findings if f.get("severity") == "critical"),
+    }
+    return report
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Firewall Zone Segmentation Audit Agent")
+    parser.add_argument("--config", required=True, help="Firewall zone config JSON file")
+    parser.add_argument("--output", default="zone_segmentation_report.json")
+    args = parser.parse_args()
+
+    config = parse_firewall_config(args.config)
+    zone_findings = audit_zone_rules(config)
+    default_issues = check_default_zone_policies(config)
+    shadowed = analyze_rule_shadowing(config.get("rules", []))
+    report = generate_report(config, zone_findings, default_issues, shadowed)
+    with open(args.output, "w") as f:
+        json.dump(report, f, indent=2, default=str)
+    logger.info("Zone audit: %d zones, %d rules, %d findings", report["total_zones"], report["total_rules"], report["total_findings"])
+    print(json.dumps(report, indent=2, default=str))
+
+
+if __name__ == "__main__":
+    main()