This entry duplicates analyzing-api-gateway-access-logs, which is the one we list in search.

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts.

Skill by RobotFlow-Labs

IndexedApache-2.0★ 2

Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/robotflow-labs-analyzing-api-gateway-access-logs

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

Use cases: backend, cloud, data, security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions: not checked yet.

What's inside

Skill name: analyzing-api-gateway-access-logs
Description: Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.
License: Apache-2.0
Instructions: 34 lines in SKILL.md · view on GitHub

Before installing

Ships executable scripts

Files (4)

LICENSE
SKILL.md
api-reference.md · references/
agent.py · scripts/

SKILL.md (first lines)

# Analyzing API Gateway Access Logs

## Instructions

Parse API gateway access logs to identify attack patterns including broken object
level authorization (BOLA), excessive data exposure, and injection attempts.

```python
import pandas as pd

df = pd.read_json("api_gateway_logs.json", lines=True)
# Detect BOLA: same user accessing many different resource IDs
bola = df.groupby(["user_id", "endpoint"]).agg(
    unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]
```

Key detection patterns:
1. BOLA/IDOR: sequential resource ID enumeration
2. Rate limit bypass via header manipulation
3. Credential scanning (401 surges from single source)
4. SQL/NoSQL injection in query parameters
5. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints

## Examples

```python
# Detect 401 surges indicating credential scanning
auth_failures = df[df["status_code"] == 401]
scanner_ips = auth_failures.groupby("source_ip").size()
scanners = scanner_ips[scanner_ips > 100]
```

From RobotFlow-Labs/skills-repo, Apache-2.0.

Signals

Stars: 2
Forks: 0
Open issues: 0
Last commit (this folder): Apr 1, 2026 (7 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: Apache-2.0
Repository: github.com/RobotFlow-Labs/skills-repo
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

Same skill elsewhere

Copies of this SKILL.md published by others; search shows only one of them.

More from RobotFlow-Labs

Cite this page

analyzing-api-gateway-access-logs skill. Agent Mart. https://agentmart.dev/skills/robotflow-labs-analyzing-api-gateway-access-logs (last updated 2026-10-24)