The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system utilities and command-line tools (systemctl, apt, dnf, nft, docker, kubectl) to deploy and manage the CrowdSec engine and its bouncers across various operating environments.\n- [PRIVILEGE_ESCALATION]: Administrative access via root or sudo is required for the skill to perform its intended functions. The instructions include explicit checks for these privileges and advise the agent to request them from the user when necessary, avoiding silent bypasses.\n- [EXTERNAL_DOWNLOADS]: The skill downloads installation scripts and hub content from official vendor domains such as install.crowdsec.net and github.com/crowdsecurity. These are standard delivery mechanisms for the software and target trusted infrastructure.\n- [REMOTE_CODE_EXECUTION]: Deployment procedures involve fetching and executing shell scripts from the vendor's official repositories. These actions are performed using standard utilities like curl and sh and are consistent with professional software installation practices.\n- [PERSISTENCE]: The skill configures systemd units and Kubernetes controllers to ensure the security engine remains active across reboots and service failures, which is essential for its primary function as a security monitoring tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill manages an attack surface where the agent processes external data (logs, HTTP metadata) that could potentially contain malicious instructions.\n
Ingestion points: Data enters the system via log files, journald, container stdout, and dedicated WAF listeners as configured in references/configure/acquisition.md and references/install/docker.md.\n
Boundary markers: The skill encourages the use of cscli explain for testing parsing logic and uses built-in whitelists to filter events at the parser level as described in references/operate/health-check.md.\n
Capability inventory: The skill has the capability to modify system configuration, update firewall rules, and execute diagnostic scripts as shown in references/configure/bouncers/firewall.md and scripts/diagnose.sh.\n
Sanitization: Sanitization is handled by the CrowdSec engine's internal parsing and enrichment stages, which evaluate log lines against defined security patterns.

crowdsec