fix: fill stub workflow in performing-ssl-tls-security-assessment

[xiaolai]

Automated audit: This PR was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the diff on its merits.

Bug

performing-ssl-tls-security-assessment/SKILL.md was a stub: 4 prose-only step descriptions with no Python code, and a single-line "Expected Output". The prerequisites listed sslyze, but no actual API usage was shown. An agent following this skill would have no concrete guidance to work from.

Fix

Replace the stub with a complete 5-step Python workflow using the sslyze library:

1. Configure and run a ServerScanRequest — set up ServerNetworkLocation and queue all relevant ScanCommand values
2. Evaluate protocol versions — check SSLv2/3 and TLS 1.0–1.3 acceptance, flagging insecure protocols
3. Check certificate chain — extract expiry, key size, chain trust, and surface issues
4. Scan for known vulnerabilities — Heartbleed, ROBOT, session renegotiation DoS, and HSTS header presence
5. Generate a structured JSON report — consolidate all findings into a machine-readable output file

Also added:

• Key Concepts table — cipher suites, Heartbleed, ROBOT, HSTS, OCSP Stapling, Forward Secrecy, certificate chain
• Tools & Systems — sslyze, testssl.sh, OpenSSL, Qualys SSL Labs
• Common Scenarios — PCI-DSS TLS compliance check, HSTS deployment verification (both with Pitfalls)
• Output Format — structured text report block showing exact output shape

All additions match the style and structure of the 95-point skills in this repository.

[mukul975]

Review — REQUEST_CHANGES

The sslyze v5 API usage is correct throughout (Scanner, ServerScanRequest, ScanCommand — no legacy SynchronousScanner), all 5 steps are complete and non-stubbed, and the output format section is genuinely useful. Two items need fixing before merge:

Blockers

1. Hardcoded scan target — Step 1 hardcodes ServerNetworkLocation("example.com", 443) as the target. The target must be parameterized — either sys.argv[1] or a function parameter. An agent using this skill cannot follow it safely with a hardcoded target baked in.

2. No MITRE ATT&CK mapping — The file has NIST CSF mappings but no ATT&CK techniques. For a defensive TLS assessment skill, please add at minimum: T1040 (Network Sniffing — detection context), T1557 (Adversary-in-the-Middle prevention), T1573 (Encrypted Channel). Can go in frontmatter as a mitre_attack: list or in a body section, consistent with how other network-security skills in the repo handle it.

Minor (non-blocking)

• Consider wrapping scanner.get_results() in a try/except to handle TLS handshake failures explicitly (ServerRejectedTlsHandshake), beyond the current connectivity_error_trace check

Fix those two and this is a clean merge.

[mukul975]

Note on Co-Authored-By attribution: This PR's commits include Co-Authored-By: Claude Code <noreply@anthropic.com>. Please squash your commits and remove that line before the final merge — attribution should be yours only.