Guide · Agent skill
How to use the API Gateway Log Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the analyzing-api-gateway-access-logs agent skill does, how to install it, and how to ask an AI agent to use it on your API gateway logs. It is written for readers who have not used agent skills before. By the end you will know how to install the skill, how to phrase a request that triggers it, and what to check before you act on its findings.
API Gateway Log Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page. You need Python 3.8 or newer and pandas on the machine where the agent runs the scripts.
- 2Unzip into a skills folder. Unzip the file into ~/.claude/skills/ for all projects, or into .claude/skills/ inside one project.
- 3Or upload it in the Claude apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.
- 4Export your gateway logs. Export the access logs from AWS API Gateway, Kong or Nginx as JSON lines or CSV. Confirm you are authorised to analyse them.
- 5Ask for an analysis in plain language. Describe the problem, such as a suspected BOLA attack or a 401 surge, and point the agent to the log file.
- 6Verify the results. Check flagged users and IPs against normal traffic before acting, because the thresholds are generic examples.
What the skill makes the agent do
The skill teaches an AI agent how to read access logs exported from AWS API Gateway, Kong or Nginx and look for signs of API abuse. The patterns it covers include BOLA/IDOR attacks (one user touching many resource IDs they should not reach), bursts of 401 failures from a single source that suggest credential scanning, rate limit bypass, and injection attempts in query parameters.
The agent uses pandas to count and group requests so that unusual patterns stand out. A bundled Python script can load logs in JSON lines or CSV format and flag users who touch an unusually large number of resources.
- BOLA/IDOR: sequential or unusually wide resource ID enumeration
- Credential scanning: 401 surges from one source
- Rate limit bypass via header manipulation
- SQL/NoSQL injection in query parameters
- Unusual HTTP methods (DELETE, PATCH) on read-only endpoints
How to install the skill
Download the skill ZIP from this page. Then install it using one of two methods.
For Claude Code, unzip the download into ~/.claude/skills/ to make it available in all your projects, or into a project's .claude/skills/ folder to limit it to that project.
In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
How to trigger the skill with a natural request
You do not need to type the skill name. The skill's description says it applies when you are investigating API abuse or building API-specific threat detection rules, so ask in those terms and attach or point to your log file.
Name the gateway and the log format if you know them, and say what you are looking for. The more specific your question, the easier it is for the agent to choose the right detection pattern.
- Check api_gateway_logs.json for BOLA: which users touched more than 50 resource IDs on the same endpoint?
- Look at this Kong export in CSV for a 401 surge that could be credential scanning.
- Review our Nginx access logs for injection attempts in query parameters.
- Help me write threshold-based detection rules for our API from these logs.
Example: the BOLA check the skill uses
The core BOLA check groups requests by user and endpoint, counts distinct resource IDs, and keeps the groups above a threshold. The threshold of 50 is a generic example from the skill, not a tuned value for your traffic.
import pandas as pd
df = pd.read_json("api_gateway_logs.json", lines=True)
bola = df.groupby(["user_id", "endpoint"]).agg(
unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]Example: spotting a 401 surge
To look for credential scanning, the skill filters for 401 responses, counts them per source IP and keeps sources above a threshold. As with the BOLA check, the threshold of 100 is an example value.
# Detect 401 surges indicating credential scanning
auth_failures = df[df["status_code"] == 401]
scanner_ips = auth_failures.groupby("source_ip").size()
scanners = scanner_ips[scanner_ips > 100]Safety notes: scripts and network access
This skill runs scripts. Its bundled Python script reads your exported log files, so review the script before you run the skill on sensitive data. The skill does not use the network.
Logs contain personal and identifying information. Only analyse logs if you are authorised to examine your users' data. The skill's own prerequisites also call for appropriate authorization and a test or lab environment for safe execution.
- The skill runs scripts; read scripts/agent.py before first use
- The skill does not use the network, according to its listed requirements
- Confirm you have authorization to analyse the log data
- Treat flagged results as leads to investigate, not as proof of attack
Tips and limits
The thresholds in the skill (50 unique IDs, 100 failed logins, 100 requests per minute) are generic examples. Real traffic can produce false positives or hide real attacks, so tune them against a baseline of your own normal traffic before using them for blocking decisions. Do not use these numbers as production blocking rules without testing.
The skill also includes a reference file with AWS API Gateway log field names and an OWASP API Top 10 table of detection patterns. Ask the agent to read it when you need the exact field names for your export.
- Export logs as JSON lines or CSV, as the script expects
- Check the field names in your export against the reference file, since they may differ from the example
- Compare flagged users and IPs against your known-good traffic before acting
- Use the output to write detection rules and queries you can test
What people use it for
- Finding users who enumerate many resource IDs on one endpoint, a possible BOLA/IDOR pattern
- Spotting a burst of 401 responses from one IP that may indicate credential scanning
- Searching query parameters in gateway logs for SQL or NoSQL injection attempts
- Drafting threshold-based detection rules for an API team to test in a lab
Frequently asked questions
How do I install the API Gateway Log Analyzer agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead go to Settings, then Capabilities, then Skills, and upload the ZIP.
What do I need to run the skill?
The skill needs Python 3.8 or newer, pandas, and exported API gateway log files in JSON lines or CSV format. It runs scripts and does not use the network.
Is the skill free to use?
The skill is released under the Apache-2.0 licence. Check the licence file in the source repository for the full terms before using it in your organisation.
Which gateways does the skill support?
The skill is written for logs from AWS API Gateway, Kong and Nginx. Its reference file lists AWS API Gateway log fields, so check that your export uses matching field names.
Can the skill block attackers automatically?
No. The thresholds it uses, such as 50 unique IDs or 100 failed logins, are generic examples that can produce false positives or miss attacks. Test them against your own traffic before using them for any blocking decision.
Are there alternatives to this skill?
The skill's own examples are plain pandas code, so you can run similar groupings directly in Python or in a log platform. This page does not compare the skill with specific commercial tools, so evaluate options against your own log sources.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts and developers who want a structured starting point for finding BOLA, credential scanning and injection patterns in exported API gateway logs. It is not suited to automatic blocking, and anyone without authorization to analyse user log data should not use it. Tune its thresholds against your own traffic before relying on any result.
Download the skill