The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts directly from official CrowdSec domains (install.crowdsec.net) and their verified GitHub repository (crowdsecurity/pfSense-pkg-crowdsec). These downloads are integral to the deployment process and originate from a trusted vendor.\n- [COMMAND_EXECUTION]: Extensive use of system-level commands for package management (apt, dnf), service control (systemctl, service), container management (docker, kubectl), and firewall configuration (nft, pfctl). These commands are standard for the skill's operational tasks.\n- [PRIVILEGE_ESCALATION]: The skill requires root or sudo privileges for tasks such as reading system logs, modifying global configuration files, and updating firewall rules. This level of access is expected and documented as a prerequisite for operating security middleware.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from various sources including system logs, web server logs, the Docker socket, and an AppSec listener. \n
Ingestion points: Data enters through log files in /var/log/, journald units, docker.sock, and the AppSec HTTP listener on port 7422.\n
Boundary markers: No specific delimiters or warnings for embedded instructions are provided in the documentation for log processing.\n
Capability inventory: The skill utilizes cscli for management, and has the capability to execute shell commands via sudo, docker exec, and kubectl exec across multiple reference files and the diagnose.sh script.\n
Sanitization: Data sanitization is handled by the CrowdSec engine's internal parsing and enrichment stages (s00, s01, s02-enrich) as described in the configuration references.\n- [DATA_EXFILTRATION]: Includes a diagnostic script (diagnose.sh) that collects system logs, configuration metrics, and hub status into a local archive. The collection is intended for manual sharing by the user for support purposes and does not automate exfiltration to external domains.

crowdsec