CtrlK
BlogDocsLog inGet started
Tessl Logo

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

65

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-api-gateway-access-logs/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is reasonably concise and actionable with working pandas examples, but it lacks validation checkpoints for a batch analysis task and fails to point to the available reference and script bundle files.

Suggestions

Add a validation/verification step to the workflow (e.g., tune BOLA thresholds against a baseline and confirm findings against known-good traffic) so batch analysis has a feedback loop.

Reference the bundle files from the body — point to scripts/agent.py for the end-to-end detector and references/api-reference.md for the OWASP pattern table and injection regex — so progressive disclosure is one level deep and navigable.

Provide executable snippets (or a link to one) for the remaining detection patterns (rate-limit bypass, unusual HTTP methods) instead of describing them in prose.

DimensionReasoningScore

Conciseness

Mostly lean with executable code and no concept-explaining padding, though the generic Prerequisites boilerplate ('Familiarity with security operations concepts') could be trimmed; sits above the 3 anchor but short of fully lean.

4 / 5

Actionability

Provides concrete, executable pandas code for BOLA and 401-surge detection, but detection-pattern items 2, 4, and 5 are described rather than given as code, leaving minor gaps.

4 / 5

Workflow Clarity

Log analysis is a batch operation yet there is no validation or verification step (no threshold tuning, no false-positive check), which caps workflow clarity at 3; the parse-to-detect sequence is only loosely implied.

3 / 5

Progressive Disclosure

The body has section structure but never signals the existing bundle files (references/api-reference.md with OWASP patterns and injection regex, scripts/agent.py with the full detector), so references are present but not navigated to.

3 / 5

Total

14

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities and explicit use-when triggers with good keyword coverage. The only minor gap is a few natural synonyms that would round out the trigger-term set.

DimensionReasoningScore

Specificity

Names the domain plus multiple concrete actions (parse logs; detect BOLA/IDOR, rate-limit bypass, credential scanning, injection attempts; statistical anomaly detection), matching the comprehensive-coverage anchor.

5 / 5

Completeness

Clearly states what it does (parses logs to detect named attack classes via pandas) and gives an explicit 'Use when...' trigger clause with concrete scenarios, matching the 5 anchor.

5 / 5

Trigger Term Quality

Strong natural terms ('API abuse', 'API Gateway access logs', AWS/Kong/Nginx, 'BOLA/IDOR', 'threat detection rules') but a few natural synonyms (e.g. 'log analysis', 'threat hunting') are missing, short of the comprehensive 5 anchor.

4 / 5

Distinctiveness Conflict Risk

Niche is well-scoped to API gateway access-log analysis with named vendors and specific attack types, giving distinct triggers and minimal conflict with other skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
mukul975/Anthropic-Cybersecurity-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.