Is analyzing-web-server-logs-for-intrusion safe to install?

SaferSkills independently audited analyzing-web-server-logs-for-intrusion (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/analyzing-web-server-logs-for-intrusion/SKILL.md · 1 file

skills/analyzing-web-server-logs-for-intrusion/SKILL.md2.5 KB · Markdown

name: analyzing-web-server-logs-for-intrusion

description: Parse Apache and Nginx access logs to detect SQL injection attempts,

local file inclusion, directory traversal, web scanner fingerprints, and brute-force

patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP

enrichment for source attribution, and statistical anomaly detection for request

frequency and response size outliers.

domain: cybersecurity

subdomain: security-operations

tags:

- web-log-analysis

- apache-logs

- nginx-logs

- sql-injection-detection

- lfi-detection

- directory-traversal

- intrusion-detection

version: '1.0'

author: mahipal

license: Apache-2.0

nist_csf:

- DE.CM-01

- RS.MA-01

- GV.OV-01

- DE.AE-02

mitre_attack:

- T1190

- T1059.007

- T1110

- T1595.002

- T1505.003

Analyzing Web Server Logs for Intrusion

When to Use

When investigating security incidents that require analyzing web server logs for intrusion
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install geoip2 user-agents
Collect web server access logs in Combined Log Format (Apache) or Nginx default format.
Parse each log entry extracting: IP, timestamp, method, URI, status code, response size, user-agent, referer.
Apply detection rules:

SQL injection: UNION SELECT, OR 1=1, ' OR ', hex encoding patterns
LFI/Path traversal: ../, /etc/passwd, /proc/self, php://filter
XSS: <script>, javascript:, onerror=, onload=
Scanner signatures: nikto, sqlmap, dirbuster, gobuster, wfuzz user-agents
Brute force: >50 POST requests to login endpoints from same IP in 5 minutes

Enrich with GeoIP data and generate a prioritized findings report.

python scripts/agent.py --log-file /var/log/nginx/access.log --geoip-db GeoLite2-City.mmdb --output web_intrusion_report.json

Examples

Detect SQLi in URI

192.168.1.100 - - [15/Jan/2024:10:30:45 +0000] "GET /products?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 4532

Scanner User-Agent Detection

Nikto/2.1.6, sqlmap/1.7, DirBuster-1.0-RC1, gobuster/3.1.0

analyzing-web-server-logs-for-intrusion— agent skill

Is analyzing-web-server-logs-for-intrusion safe to install?

Analyzing Web Server Logs for Intrusion

When to Use

Prerequisites

Instructions

Examples

Detect SQLi in URI

Scanner User-Agent Detection

Audit the pieces. Scan the whole. Decide.