Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/implementing-patch-management-for-ot-systems/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Anthropic Agent Skills Contributors
+Copyright (c) 2025 Mahipal
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

skills/implementing-patch-management-for-ot-systems/references/api-reference.md

@@ -0,0 +1,75 @@
+# API Reference: Implementing Patch Management for OT Systems
+
+## ICS-CERT Advisory API
+
+```bash
+# Query CISA ICS advisories (RSS/JSON)
+curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | jq '.vulnerabilities[] | select(.vendorProject | test("Siemens|Rockwell|Schneider"))'
+
+# NVD API for ICS CVEs
+curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=SCADA&resultsPerPage=20"
+```
+
+## Vendor Patch Sources
+
+| Vendor | Advisory Source | Notification |
+|--------|----------------|-------------|
+| Siemens | ProductCERT (cert.siemens.com) | RSS + Email |
+| Rockwell | Knowledgebase (rockwellautomation.custhelp.com) | Email |
+| Schneider | PSIRT (se.com/ww/en/work/support/cybersecurity) | RSS + Email |
+| ABB | Cybersecurity Advisory (abb.com) | Email |
+| Honeywell | PSIRT Advisories | Email |
+
+## Patch Prioritization Matrix
+
+| CVSS Score | Exploited | OT Impact | Priority | SLA |
+|------------|-----------|-----------|----------|-----|
+| 9.0 - 10.0 | Yes | Safety system | P1 Emergency | Next maintenance window |
+| 7.0 - 8.9 | Yes | Control system | P2 Critical | 30 days |
+| 7.0 - 8.9 | No | Non-safety | P3 High | 90 days |
+| 4.0 - 6.9 | No | Any | P4 Medium | 180 days |
+| 0.1 - 3.9 | No | Any | P5 Low | Next scheduled outage |
+
+## NERC CIP-007-6 R2 Requirements
+
+| Sub-Requirement | Description |
+|-----------------|-------------|
+| R2.1 | Patch management process for tracking |
+| R2.2 | Evaluate patches within 35 days of availability |
+| R2.3 | Implement applicable patches within timeframe |
+| R2.4 | Document mitigation plans for patches not applied |
+
+## IEC 62443-2-3 Patch Management Lifecycle
+
+| Phase | Action |
+|-------|--------|
+| Monitor | Subscribe to vendor advisories and ICS-CERT |
+| Assess | Evaluate patch compatibility with OT environment |
+| Test | Validate in staging environment mirroring production |
+| Plan | Schedule during maintenance window with rollback |
+| Deploy | Staged rollout with process verification |
+| Verify | Confirm functionality and safety post-patch |
+
+## Compensating Controls (When Patching Not Possible)
+
+| Control | Use Case |
+|---------|----------|
+| Network segmentation | Isolate unpatched systems |
+| Application whitelisting | Prevent exploit execution |
+| Virtual patching (IPS rules) | Block known exploit vectors |
+| Enhanced monitoring | Detect exploitation attempts |
+| Physical access restriction | Limit console access |
+
+## WSUS/SCCM OT Configuration
+
+```powershell
+# WSUS: Approve patch for OT test group only
+Approve-WsusUpdate -Update $update -Action Install -TargetGroupName "OT-Test-Ring"
+```
+
+### References
+
+- IEC 62443-2-3: https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
+- NERC CIP-007-6: https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-007-6.pdf
+- CISA ICS Advisories: https://www.cisa.gov/news-events/ics-advisories
+- NVD API: https://nvd.nist.gov/developers/vulnerabilities

skills/implementing-patch-management-for-ot-systems/scripts/agent.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""OT Patch Management Agent - tracks ICS/SCADA patch status and risk assessment."""
+
+import json
+import argparse
+import logging
+from collections import defaultdict
+from datetime import datetime
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
+logger = logging.getLogger(__name__)
+
+OT_PATCH_SLA = {"critical": 30, "high": 60, "medium": 120, "low": 365}
+
+
+def load_data(filepath):
+    with open(filepath) as f:
+        return json.load(f)
+
+
+def assess_patch_risk(patch, asset):
+    risk_factors = []
+    if asset.get("type", "").lower() in ("plc", "rtu", "safety_controller"):
+        risk_factors.append({"factor": "Safety-critical device", "impact": "high"})
+    if asset.get("requires_downtime"):
+        risk_factors.append({"factor": "Requires process downtime", "impact": "high"})
+    if not asset.get("test_environment_available"):
+        risk_factors.append({"factor": "No test environment", "impact": "medium"})
+    if not patch.get("vendor_validated"):
+        risk_factors.append({"factor": "Not vendor validated", "impact": "high"})
+    score = sum(3 if r["impact"] == "high" else 1 for r in risk_factors)
+    return {"patch_id": patch.get("id"), "asset": asset.get("name"), "risk_score": score,
+            "risk_level": "high" if score >= 6 else "medium" if score >= 3 else "low"}
+
+
+def check_compliance(assets, patches):
+    now = datetime.utcnow()
+    results = []
+    for asset in assets:
+        for patch in patches:
+            if patch.get("asset_id") == asset.get("id") and patch.get("status") == "missing":
+                severity = patch.get("severity", "medium").lower()
+                published = datetime.fromisoformat(patch["published_date"].replace("Z", "+00:00")).replace(tzinfo=None)
+                age = (now - published).days
+                sla = OT_PATCH_SLA.get(severity, 120)
+                results.append({
+                    "asset": asset.get("name"), "patch_id": patch.get("id"),
+                    "severity": severity, "age_days": age, "sla_days": sla,
+                    "sla_status": "within_sla" if age <= sla else "sla_breached",
+                    "vendor_validated": patch.get("vendor_validated", False),
+                })
+    return results
+
+
+def generate_report(compliance, assets):
+    breached = [c for c in compliance if c["sla_status"] == "sla_breached"]
+    return {
+        "timestamp": datetime.utcnow().isoformat(), "total_assets": len(assets),
+        "missing_patches": len(compliance), "sla_breaches": len(breached),
+        "compliance_rate": round((1 - len(breached) / max(len(compliance), 1)) * 100, 1),
+        "sla_thresholds": OT_PATCH_SLA,
+        "top_overdue": sorted(breached, key=lambda x: x["age_days"], reverse=True)[:15],
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="OT Patch Management Agent")
+    parser.add_argument("--assets", required=True, help="OT asset inventory JSON")
+    parser.add_argument("--patches", required=True, help="Patch data JSON")
+    parser.add_argument("--output", default="ot_patch_report.json")
+    args = parser.parse_args()
+    assets = load_data(args.assets)
+    patches = load_data(args.patches)
+    compliance = check_compliance(assets, patches)
+    report = generate_report(compliance, assets)
+    with open(args.output, "w") as f:
+        json.dump(report, f, indent=2, default=str)
+    logger.info("OT patches: %d missing, %d breaches, %.1f%% compliant",
+                report["missing_patches"], report["sla_breaches"], report["compliance_rate"])
+    print(json.dumps(report, indent=2, default=str))
+
+if __name__ == "__main__":
+    main()