Agent skill · security · borghei
threat-detection
This skill should be used when the user asks to "analyze logs for threats", "detect suspicious activity", "scan for brute force attempts", "identify injection attacks", or "audit access patterns for anomalies".
Why this skill is useful
Adds an executable script for automated log analysis that detects multiple threat patterns not covered by generic knowledge.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Threat Detection Category: Engineering Domain: Security Operations Overview The Threat Detection skill provides automated analysis of log files for suspicious patterns including brute force attacks, injection attempts, unusual access patterns, and privilege escalation indicators. It helps security teams triage log data and identify threats before they escalate. Clarify First Before analyzing logs, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Log file & source type — auth / access / application logs to analyze (--file; the subject of detection) [ ] Threat category — brute force / injection / access anomaly / privilege escalation (--category; focuses the scan) [ ] Minimum severity — the reporting/alert threshold (--min-severity; changes which signals surface and any SIEM/CI gate) Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact. Quick Start Tools Overview threatsignalanalyzer.py Analyzes log files for suspicious activity patterns across multiple threat categories. Feature Description --------- ------------- Brute force detection Identifies repeated failed login attempts from same source Injection scanning Detects SQL injection, XSS, command injection in requests Access anomalies Flags unusual access times, forbidden paths, admin probes Privilege escalation Detects sudo abuse, role changes, permission modifications Rate analysis Identifies request flooding and denial-of-service patterns IP reputation Flags known-bad patterns (scanners, bots, TOR indicators) Workflows Log Analysis Workflow 1. Collect - Gather logs from auth, access, application sources 2. Analyze - Run threatsignalanalyzer.py across log files 3. Triage - Review critical and high severity findings first 4. Correlate - Cross-reference findings across log sources 5. Respond - Block IPs, reset credentials, escalate as needed Incident Investigation Workflow 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/threat-detection