{
 "schema": "aiblocks-page/1",
 "id": "crowdsec-protection-checker",
 "type": "skill",
 "name": "CrowdSec protection checker",
 "summary": "Bring CrowdSec settings and status. Get a check of protection gaps, including whether the bouncer can block traffic.",
 "headline": "CrowdSec protection checker",
 "subhead": "Share CrowdSec settings, protected services and status. It checks the supplied evidence and lists gaps, including the bouncer that blocks traffic, plus checks for an operator.",
 "job": {
  "id": "secure-code",
  "name": "Keep your code secure"
 },
 "level": "intermediate",
 "thinking": "medium",
 "tested": true,
 "updated": "2026-10-28",
 "first_published": "2026-10-25",
 "inputs": [
  {
   "type": "question",
   "required": true,
   "label": "Question",
   "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like"
  },
  {
   "type": "tool_connection",
   "required": true,
   "label": "Tool connection",
   "what": "an AI connected to an outside tool or service, such as an MCP server"
  }
 ],
 "outputs": [
  {
   "type": "security_report",
   "required": true,
   "label": "Security report",
   "what": "the risks found in the code, ranked, each with a fix"
  },
  {
   "type": "plan",
   "required": true,
   "label": "Plan",
   "what": "a dated plan: what to do, in what order, with a decision rule for each step"
  }
 ],
 "you_give": [
  "The authorized host/container, installed CrowdSec version, log samples and observed symptoms.",
  "Read access plus the agreed action scope, maintenance window and rollback plan before changes."
 ],
 "you_get": [
  "A stage-by-stage diagnosis from log capture through parser, scenario, decision and bouncer.",
  "A bounded fix and harmless proof plan; an alert alone is not evidence of blocking."
 ],
 "use_when": [
  "Alerts fire but blocked requests still reach your app.",
  "A bouncer shows a stale last-pull time, or no decisions arrive.",
  "Logs are coming in but nothing gets parsed or matched to a scenario.",
  "You are handing over a CrowdSec setup and need proof that it blocks."
 ],
 "skip_when": [
  "You need general firewall design: use a firewall guide or your platform's own docs, then come back for the CrowdSec part.",
  "You need Kubernetes or reverse-proxy design: ask a person or tool that knows that platform, and use this only for the CrowdSec link.",
  "You want to change live blocking with no undo plan or maintenance window: agree both with your team first."
 ],
 "output_sample": {
  "input": [
   "Your host or container name, and the CrowdSec version",
   "A few log lines from the service you protect",
   "What you see going wrong",
   "Your allowed scope, maintenance window and undo plan"
  ],
  "prerequisites": [
   "Read access to the host or container",
   "An AI that can read your pasted command output (it cannot run commands for you in a chat)"
  ],
  "output": [
   {
    "name": "Scope and undo record",
    "contains": "The target, version, what may be changed, and how to undo each change."
   },
   {
    "name": "Stage-by-stage diagnosis",
    "contains": "Status and evidence for log capture, parsing, scenarios, decisions and the bouncer, in that order."
   },
   {
    "name": "Failed stage",
    "contains": "The first stage where protection stops, and why an alert alone does not prove blocking."
   },
   {
    "name": "Bounded fix",
    "contains": "A small change that fixes the failed stage, with the safety checks to run before it."
   },
   {
    "name": "Proof plan",
    "contains": "A harmless test to show the proxy or firewall really blocks, plus what the test cannot show."
   }
  ]
 },
 "how_to_use": [
  "Download the complete skill folder and add it to your AI tool, or copy the instructions into a chat.",
  "Provide the inputs listed here and ask your AI to follow the skill.",
  "A chat AI cannot run commands on your host. You run each cscli or log command it asks for, then paste the output back.",
  "Review the result and any missing facts before using it.",
  "Use the operations checklist and the bouncer guide in the skill's references folder (Traefik or Nginx) to hand the setup over."
 ],
 "checks": [],
 "next": [
  {
   "name": "AI agent attack tester",
   "url": "https://useaiblocks.com/skills/ai-agent-attack-tester",
   "why": "AI agent attack tester"
  },
  {
   "name": "Prompt injection defender",
   "url": "https://useaiblocks.com/skills/prompt-injection-defender",
   "why": "Prompt injection defender"
  }
 ],
 "source": {
  "by": "magnus919",
  "repo": "magnus919/agent-skills",
  "url": "https://github.com/magnus919/agent-skills/tree/92c327e525da69c9ad3812fd223a1770e977c2e3/crowdsec",
  "licence": "MIT",
  "original_name": "crowdsec",
  "commit": "92c327e525da69c9ad3812fd223a1770e977c2e3"
 },
 "credits": [
  {
   "title": "crowdsec skill",
   "by": "magnus919",
   "url": "https://github.com/magnus919/agent-skills/tree/92c327e525da69c9ad3812fd223a1770e977c2e3/crowdsec",
   "used": "Original instructions and supporting files, with attribution and the MIT licence. Display copy describes the task."
  }
 ],
 "files": [
  "evals/evals.json",
  "LICENSE.md",
  "README.md",
  "references/appsec-deep-dive.md",
  "references/config-reference.md",
  "references/cscli-command-reference.md",
  "references/database-config.md",
  "references/docker-deployment.md",
  "references/hub-collections.md",
  "references/nginx-bouncer.md",
  "references/operations-checklist.md",
  "references/production-hardening.md",
  "references/traefik-bouncer.md",
  "references/troubleshooting.md"
 ],
 "links": {
  "page": "https://useaiblocks.com/skills/crowdsec-protection-checker",
  "markdown": "https://useaiblocks.com/skills/crowdsec-protection-checker.md",
  "json": "https://useaiblocks.com/skills/crowdsec-protection-checker.json",
  "instructions": "https://useaiblocks.com/skills/crowdsec-protection-checker/SKILL.md",
  "download": "https://useaiblocks.com/skills/crowdsec-protection-checker.zip",
  "api_item": "https://useaiblocks.com/api/v1/items/crowdsec-protection-checker",
  "api_document": "https://useaiblocks.com/api/v1/documents/skill/crowdsec-protection-checker",
  "mcp": "https://useaiblocks.com/mcp"
 }
}