Add IsMalicious indicator reputation package

[hexablob]

Add ismalicious::check, a single reputation lookup for IP addresses, domains, URLs and MD5/SHA-1/SHA-256 hashes. It preserves the provider JSON, including evidence/contradictions, provenance, unknown hash status and optional confidence, instead of manufacturing detection counts or clean verdicts.

The operator uses a managed credential containing Base64(apiKey:apiSecret), standard enrichment, a configurable timeout and no automatic retries. Empty inputs and unexpected response statuses are diagnosed and dropped. Examples show a single lookup and retention of the original security event, with serial enrichment and quota guidance. This is investigation enrichment, not a TAXII feed redistributor or automatic blocking policy.

Validation:

• Loaded the official tenzir skill and its HTTP, secrets, encoding, each and package-testing references as required by AGENTS.md.
• uvx --with tenzir tenzir-test ismalicious: 12 tests and 12 fixture assertions pass with Tenzir v6.19.1.
• Native HTTP cases cover malicious evidence, unknown hash, context-only data, absent optional fields, original-event preservation, exact URL query/fragment encoding, no request on empty input, redirect rejection, invalid JSON/non-object JSON, 401, 429 and timeout.
• Python fixture checks verify the endpoint, standard-enrichment parameter, credential header and one-request/no-retry behavior. Error tests use environment-resolved synthetic credentials to verify diagnostics do not expose them.
• Ruff checks/format and git diff --check pass.

The response data and credentials are synthetic. No authenticated production API response or real customer telemetry was tested.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.