How do I install the Cis Tomcat8 V100 2.5 skill?

Run npx skillmds@latest add cyberstrikeus/cis-tomcat8-v100-2-5 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Tomcat8 V100 2.5 skill do?

Disable client facing Stack Traces It is listed under Coding & Dev Tools on SkillMD.

Is Cis Tomcat8 V100 2.5 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Tomcat8 V100 2.5?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Tomcat8 V100 2.5 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Tomcat8 V100 2.5?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Tomcat8 V100 2.5 by cyberstrikeus

Name: Cis Tomcat8 V100 2.5
Author: cyberstrikeus

File contents

2.5 Disable client facing Stack Traces (Scored)

Description

When a runtime error occurs during request processing, Apache Tomcat will display debugging information to the requestor. It is recommended that such debug information be withheld from the requestor.

Rationale

Debugging information, such as that found in call stacks, often contains sensitive information that may be useful to an attacker. By preventing Tomcat from providing this information, the risk of leaking sensitive information to a potential attacker is reduced.

Audit Procedure

Perform the following to determine if Tomcat is configured to prevent sending debug information to the requestor:

Ensure an <error-page> element is defined in $CATALINA_HOME/conf/web.xml.
Ensure the <error-page> element has an <exception-type> child element with a value of java.lang.Throwable.
Ensure the <error-page> element has a <location> child element.

Note: Perform the above for each application hosted within Tomcat. Per application instances of web.xml can be found at $CATALINA_HOME/webapps/<APP_NAME>/WEB-INF/web.xml

Remediation

Create a web page that contains the logic or message you wish to invoke when encountering a runtime error. For example purposes, assume this page is located at /error.jsp.
Add a child element, <error-page>, to the <web-app> element, in the $CATALINA_HOME/conf/web.xml file.
Add a child element, <exception-type>, to the <error-page> element. Set the value of the <exception-type> element to java.lang.Throwable.
Add a child element, <location>, to the <error-page> element. Set the value of the <location> element to the location of page created in #1.

The resulting entry will look as follows:

<error-page>
 <exception-type>java.lang.Throwable</exception-type>
 <location>/error.jsp</location>
</error-page>

Default Value

Tomcat's default configuration does not include an <error-page> element in $CATALINA_HOME/conf/web.xml. Therefore, Tomcat will provide debug information to the requestor by default.

References

https://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/tomcat/util/descriptor/web/ErrorPage.html

CIS Controls

Not mapped in this benchmark version

Profile Applicability

Level 1

---name: cis-tomcat8-v100-2-5description: Disable client facing Stack Traces---# 2.5 Disable client facing Stack Traces (Scored)## DescriptionWhen a runtime error occurs during request processing, Apache Tomcat will display debugging information to the requestor. It is recommended that such debug information be withheld from the requestor.## RationaleDebugging information, such as that found in call stacks, often contains sensitive information that may be useful to an attacker. By preventing Tomcat from providing this information, the risk of leaking sensitive information to a potential attacker is reduced.## Audit ProcedurePerform the following to determine if Tomcat is configured to prevent sending debug information to the requestor:1. Ensure an `<error-page>` element is defined in `$CATALINA_HOME/conf/web.xml`.2. Ensure the `<error-page>` element has an `<exception-type>` child element with a value of `java.lang.Throwable`.3. Ensure the `<error-page>` element has a `<location>` child element.Note: Perform the above for each application hosted within Tomcat. Per application instances of web.xml can be found at `$CATALINA_HOME/webapps/<APP_NAME>/WEB-INF/web.xml`## Remediation1. Create a web page that contains the logic or message you wish to invoke when encountering a runtime error. For example purposes, assume this page is located at /error.jsp.2. Add a child element, `<error-page>`, to the `<web-app>` element, in the `$CATALINA_HOME/conf/web.xml` file.3. Add a child element, `<exception-type>`, to the `<error-page>` element. Set the value of the `<exception-type>` element to `java.lang.Throwable`.4. Add a child element, `<location>`, to the `<error-page>` element. Set the value of the `<location>` element to the location of page created in #1.The resulting entry will look as follows:```xml<error-page> <exception-type>java.lang.Throwable</exception-type> <location>/error.jsp</location></error-page>```## Default ValueTomcat's default configuration does not include an `<error-page>` element in `$CATALINA_HOME/conf/web.xml`. Therefore, Tomcat will provide debug information to the requestor by default.## References1. https://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/tomcat/util/descriptor/web/ErrorPage.html## CIS Controls- Not mapped in this benchmark version## Profile Applicability- Level 1

Frequently asked questions

Cis Tomcat8 V100 2.5