Expand 39 api-reference stubs with real tool docs, expand 15 agent.py boilerplate stubs

skills/building-attack-pattern-library-from-cti-reports/SKILL.md

@@ -14,6 +14,14 @@ license: Apache-2.0
 
 Cyber threat intelligence (CTI) reports from vendors like Mandiant, CrowdStrike, Talos, and Microsoft contain detailed descriptions of adversary behaviors that can be extracted, normalized, and cataloged into a structured attack pattern library. This skill covers parsing CTI reports to extract adversary techniques, mapping behaviors to MITRE ATT&CK technique IDs, creating STIX 2.1 Attack Pattern objects, building a searchable library indexed by tactic, technique, and threat actor, and generating detection rule templates from documented patterns.
 
+
+## When to Use
+
+- When deploying or configuring building attack pattern library from cti reports capabilities in your environment
+- When establishing security controls aligned to compliance requirements
+- When building or improving security architecture for this domain
+- When conducting security assessments that require this implementation
+
 ## Prerequisites
 
 - Python 3.9+ with `stix2`, `mitreattack-python`, `spacy`, `requests` libraries