Analyze security logs through four agent roles that parse events, detect anomalies, classify risk, and write an incident report. Use nginx, authentication, or system logs to review suspicious activity and receive a risk summary with recommended actions.
中文简介正在准备中。当前显示英语简介。
Orchestrate a 4-agent cyber defense pipeline to analyze log files for threats. Use when investigating security logs, detecting anomalies in access patterns, classifying breach severity, or generating incident reports from nginx/auth/syslog files.
安装前可以查看交给 AI 代理的指令内容。
Orchestrate a 4-agent pipeline that analyzes log files for security threats and produces an incident report.
[You] -> Team Lead (this skill)
|
|-[1]-> log-ingestor (haiku) -> cyber-defense-events.json
|
|-[2]-> anomaly-detector (sonnet) -> cyber-defense-anomalies.json
| (reads events.json)
|-[3]-> risk-classifier (sonnet) -> cyber-defense-risk.json
| (reads anomalies.json)
`-[4]-> threat-reporter (sonnet) -> cyber-defense-report.md
(reads all 3 JSON files)
Stages 2 and 3 are sequential (each depends on previous output). Stage 4 runs after all data is ready.
Check that the log file exists (or that log content was provided inline). If the path doesn't exist, tell the user immediately and don't proceed.
Use the Agent tool to spawn the log-ingestor agent:
Task: Parse the log file at [log_path] and write structured events to cyber-defense-events.json.
Log path: [log_path]
Wait for completion. Confirm cyber-defense-events.json was created.
Use the Agent tool to spawn the anomaly-detector agent:
Task: Read cyber-defense-events.json and detect anomalies. Write results to cyber-defense-anomalies.json.
Wait for completion. If anomalies_found: 0, skip to Step 5 (reporter still runs).
Use the Agent tool to spawn the risk-classifier agent:
Task: Read cyber-defense-anomalies.json and classify overall risk. Write result to cyber-defense-risk.json.
Use the Agent tool to spawn the threat-reporter agent:
Task: Read cyber-defense-events.json, cyber-defense-anomalies.json, and cyber-defense-risk.json. Generate a complete incident report and save it to cyber-defense-report.md.
Read cyber-defense-risk.json and present:
Analysis complete
Risk Level : HIGH
Score : 74/100
Threats : 2 anomalies detected
Report : cyber-defense-report.md
Primary threat: Brute force attack from 192.168.1.105
Immediate action required: [first recommended_action]
| Stage | Model | Typical tokens |
|---|---|---|
| log-ingestor | haiku | ~2K |
| anomaly-detector | sonnet | ~3K |
| risk-classifier | sonnet | ~2K |
| threat-reporter | sonnet | ~3K |
| Total | ~10K |
For large log files (>10K lines), log-ingestor may use up to 20K tokens.
/cyber-defense-team /var/log/nginx/access.log
/cyber-defense-team /tmp/auth.log
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Evaluate Claude Code agents, skills, and commands with weighted quality criteria. Get scores, readiness grades, template comparisons, and practical improvement suggestions in Markdown or JSON reports to guide reviews before release.
中文简介正在准备中。当前显示英语简介。
Assess a codebase across seven areas, including exposed credentials, security, dependencies, structure, and tests. Receive category scores, findings tied to file locations, and a prioritized improvement plan with smaller tasks that can be completed quickly.
中文简介正在准备中。当前显示英语简介。
Measure code patterns such as casts to any or disabled lint rules, then run repeated, targeted edits. Keep changes that improve the chosen metric, revert unsuccessful changes, and track results for each improvement loop.
中文简介正在准备中。当前显示英语简介。
Generate several separate solutions, compare them against criteria fixed in advance, and verify the selected result through executable checks or an independent reviewer. Keep a proof log documenting candidates, evidence, failures, and remaining limits.
中文简介正在准备中。当前显示英语简介。
Monitor a live application after deployment and compare it with a saved baseline, a record of its earlier state. Check page responses, loading times, and new errors, flag persistent changes, and produce a per-page health report.
中文简介正在准备中。当前显示英语简介。
Rebuild project context after clearing a conversation or returning to work. Review recent Git history, uncommitted changes, and TODO markers to get a structured summary of project status and suggested next steps.
中文简介正在准备中。当前显示英语简介。