Log Parser

Parse and analyze various log formats (nginx, apache, syslog, application logs). Extract key information and generate reports.

Security Scan

The skill is internally consistent: it requires only python3 and contains a straightforward local log-parsing script that matches the described purpose and does not attempt network access or read unexpected secrets.

Purpose & Capability

Name/description (log parsing, nginx/apache/syslog/JSON) matches the provided code and SKILL.md. The only declared binary (python3) is appropriate for running the included Python script. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md instructs running the provided script against local log files (e.g., /var/log/nginx/access.log), which is expected for a log parser. The instructions and code only read files supplied by the user and parse their contents. Note: SKILL.md uses an invocation path 'skills/log-parser/scripts/log_parser.py' while the package contains 'scripts/log_parser.py' (README uses the latter) — minor path inconsistency but not a security issue. Also note that parsing local logs implies access to potentially sensitive data; this is expected but worth considering before running.

Install Mechanism

No install spec is provided (instruction-only with one script file). Nothing is downloaded or installed automatically; risk is limited to executing the included Python script locally.

Credentials

No environment variables, credentials, or config paths are requested. The script does not read environment variables or other credentials; it only opens the file path given by the user. This is proportionate to the stated purpose.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent privileges, nor does it modify other skills or system configuration. Autonomous invocation is allowed (platform default) but the skill itself does not perform background or persistent actions.

Assessment

This skill appears to be what it claims: a local log parser implemented in a single Python script. Before running it, review the script (you already have the source) and only point it at log files you are willing to share with the script — logs may contain sensitive data (credentials, IPs, tokens). Because there is no install step, the main risk is executing untrusted code locally; if you don't trust the source, run it in a sandbox/container or inspect/modify the script yourself. Note the small path inconsistency in SKILL.md (invocation path) — use the script path present in the package (scripts/log_parser.py) when running.

A log parsing and analysis tool for security operations and DevOps.

Features

• Multi-format Support - nginx, apache, syslog, application logs
• Auto-detection - Automatically detect log format
• Key Extraction - Extract IPs, timestamps, error codes, URLs
• Filtering - Filter logs by IP, status code, time range
• Statistics - Generate summary reports
• Error Detection - Identify and highlight error entries

Usage

python3 skills/log-parser/scripts/log_parser.py <action> [options]

Actions

Action	Description
parse	Parse log file and extract fields
stats	Generate statistics report
filter	Filter logs by criteria
errors	Extract error entries only
top	Top N items (IPs, URLs, etc.)

Options

Option	Type	Default	Description
--file	string	-	Log file path
--format	string	auto	Log format (auto, nginx, apache, syslog)
--limit	int	100	Max results to return
--filter-ip	string	-	Filter by IP address
--filter-status	string	-	Filter by status code
--top-field	string	-	Field for top N (ip, url, status)

Supported Log Formats

nginx

192.168.1.1 - - [22/Mar/2026:14:00:00 +0800] "GET /api/test HTTP/1.1" 200 1234

apache

192.168.1.1 - - [22/Mar/2026:14:00:00 +0800] "GET /api/test HTTP/1.1" 200 1234

syslog

Mar 22 14:00:00 server sshd[12345]: Failed password for root from 192.168.1.1

application logs (JSON)

{"timestamp": "2026-03-22T14:00:00Z", "level": "ERROR", "message": "..."}

Examples

# Parse log file
python3 skills/log-parser/scripts/log_parser.py parse --file /var/log/nginx/access.log

# Generate statistics
python3 skills/log-parser/scripts/log_parser.py stats --file /var/log/nginx/access.log

# Filter by IP
python3 skills/log-parser/scripts/log_parser.py filter --file /var/log/nginx/access.log --filter-ip 192.168.1.1

# Get top 10 IPs
python3 skills/log-parser/scripts/log_parser.py top --file /var/log/nginx/access.log --top-field ip --limit 10

# Extract errors
python3 skills/log-parser/scripts/log_parser.py errors --file /var/log/nginx/access.log

Use Cases

1. Security Analysis - Identify suspicious IPs, failed logins
2. Performance Monitoring - Find slow requests, errors
3. Traffic Analysis - Top URLs, user agents
4. Debugging - Extract error entries quickly

Output Format

All results are returned in JSON format:

{
  "success": true,
  "total": 1000,
  "parsed": 998,
  "entries": [...],
  "stats": {...}
}

Current Status

In development.