Agent skill · aliyun
alibabacloud-web-application-attacks-analysis
Analyze origin web access logs (Nginx/Apache/IIS) to detect CC attacks, proxy-pool distributed bots, scanning probes, login brute force, abnormal crawlers, QPS/bandwidth/status-code surges, and slow resource consumption, then produce an actionable security report with mitigation advice. Read-only; no credentials required. Triggers: "CC attack", "HTTP flood", "proxy pool bot", "login brute force", "web access log analysis", "access log security analysis", "abnormal crawler", "QPS surge", "bandwidth surge", "4xx/5xx surge", "site being attacked", "scanning probe", "API abuse", "slow request analysis".
What it needs
About 7k tokens when loaded.
What this skill does
Web Application Attacks Analysis Analyze origin web access logs and identify security threats with actionable mitigation recommendations. The analyzer supports Nginx, Apache, and IIS W3C log formats (auto-detected), extracts the real client IP from X-Forwarded-For chains, aggregates traffic across eleven analysis dimensions, detects eleven attack patterns with evidence-backed confidence levels, and renders a pure-ASCII report in text or Markdown format. Requires Python 3 (standard library only, no third-party packages): Module Index Module Purpose File -------- --------- ------ Log Parsing Format auto-detection, Nginx/Apache/IIS patterns, real client IP extraction, standardized fields references/logparsing.md Attack Detection Detection thresholds, behavioral signatures, and aggregate functions behind each attack type references/attack-detection.md Report Generation Dual-audience layout: Executive Summary up front, the 11 detail sections, and Structured Findings (JSON) at the end references/report-generation.md Load references on demand. Do not read all reference files unless the task requires them. User Confirmation Before running any analysis, confirm the access log file path with the user. If the user has not provided a log file, ask for the file path first. Never guess, derive, or scan for log files on your own. ABSOLUTE PROHIBITION: never run find, ls, glob, or any filesystem scan to look for log files. If no log file is provided, ask the user for the file path; never probe the disk instead. Execution Principle MANDATORY: Read-only: this skill only reads and analyzes. It MUST NOT modify, move, or delete any user file, and it requires no credentials of any kind. Single entry point: all analysis MUST be executed through the entry script scripts/loganalyzer.py. Do not hand-assemble parsing or detection command chains. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-web-application-attacks-analysis