Skip to content
Get packs

API Gateway Log Analyzer

Scans API gateway access logs for BOLA, credential scanning and injection attacks.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to read API gateway access logs (from AWS API Gateway, Kong or Nginx) and look for signs of abuse, such as someone enumerating resource IDs they should not access, bursts of failed logins from one source, rate limit evasion, and injection attempts in query parameters. It guides the agent to use pandas to count and group requests so suspicious patterns stand out. A bundled Python script can load logs from JSON lines or CSV and flag users who touch an unusually large number of resources.

Great for

  • Security operations analysts reviewing API traffic for abuse
  • Developers building threshold-based detection rules for their APIs
  • Threat hunters who want a starting point for API log queries

Skip it if

  • Production blocking decisions: thresholds such as 50 unique IDs or 100 failed logins are generic examples and can produce false positives or miss attacks in real traffic
  • Organisations without authorization to analyse their users' log data, since logs contain personal and identifying information

Try asking

  • “Analyze this Kong access log export and tell me if any user is enumerating order IDs they don't own”
  • “Find source IPs with more than 100 401 responses in these Nginx logs”
  • “Check my API gateway logs for SQL injection patterns in query strings”
Step-by-step guide: how to use API Gateway Log AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-api-gateway-access-logs.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-api-gateway-access-logs.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-api-gateway-access-logs.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the analysis on exported copies of logs in a lab or copy, not directly against live systems.
  • Tune the thresholds to your normal traffic baseline before treating any finding as an incident.
  • Ask the agent to explain each flagged finding so you can verify it against the raw log lines.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.