analyzing-web-server-logs-for-intrusion

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-web-server-logs-for-intrusion/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, actionable skill body with a clear command and concrete examples, undermined by two structural gaps: a batch workflow with no validation checkpoint, and an orphaned reference file that duplicates inline content rather than being linked from the overview.

Suggestions

Add an explicit validation/verification step to the workflow, e.g. after parsing confirm 'parsed N entries, 0 unparseable' and sanity-check the report before finishing.

Link references/api-reference.md from the body (e.g. a '## API reference' section) and move the duplicated attack-signature and scanner-UA tables out of SKILL.md into that file to avoid redundancy.

Either show executable detection-rule code inline or explicitly defer to scripts/agent.py for the full pattern set, so the guidance is fully executable rather than a pattern list.

Dimension	Reasoning	Score
Conciseness	The body is lean and efficient — bullet-list 'When to Use' and 'Prerequisites', a tight numbered instruction set, one command, two short examples — with no over-explanation of concepts Claude already knows; every token earns its place.	5 / 5
Actionability	Provides a copy-paste-ready bash command whose CLI flags (--log-file, --geoip-db, --output) match the real agent.py, plus concrete detection patterns and real example log lines; held at 4 because the detection rules are pattern lists rather than full executable code.	4 / 5
Workflow Clarity	A clear five-step sequence is present, but this is a batch log-processing operation with no validation or verification checkpoint (e.g. confirm parsing succeeded, sanity-check the generated report); per the rubric cap, a batch operation without validation cannot score above 3.	3 / 5
Progressive Disclosure	Sections are well-organized and scripts/agent.py is correctly referenced, but the bundled references/api-reference.md is never linked or signaled from the body and duplicates content already inlined (attack-signature and scanner-UA tables), leaving references present but not clearly signaled.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, third-person, well-scoped description that clearly conveys capabilities and occupies a distinct niche. Its main weakness is the absence of an explicit 'Use when…' trigger clause, which caps completeness at 3 despite otherwise strong content.

Suggestions

Append an explicit trigger clause, e.g. 'Use when analyzing Apache or Nginx access logs for SQL injection, LFI, traversal, scanner, or brute-force activity.'

Add a few synonym/extension variants users might say (e.g. 'web logs', 'access logs', '.log files', 'intrusion detection') to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns' plus 'regex-based pattern matching', 'GeoIP enrichment', 'statistical anomaly detection' — comprehensive coverage matching the level-5 anchor.	5 / 5
Completeness	The 'what' is explicit and detailed, but there is no 'Use when…' clause or equivalent explicit trigger guidance; per the rubric guideline a missing trigger clause caps completeness at 3.	3 / 5
Trigger Term Quality	Good natural keyword coverage ('Apache and Nginx access logs', 'SQL injection', 'brute-force', 'OWASP attack signatures'), but lacks the 'Use when…' trigger phrasing and synonym/extension variants that would lift it to 5.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (web server log intrusion analysis) with distinct triggers (Apache/Nginx logs, specific attack classes) and minimal conflict risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-web-server-logs-for-intrusion/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.