Claude Code, Plugin
crowdsec
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.
Compatibility: Portable across standard formats.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 8802dbe68a05, unchanged since the check below.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV INSTALL_DOCUMENTED_INSTALLER
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
skills/crowdsec/SKILL.md, line 72
curl -s https://version.crowdsec.net/latest # → {"tag_name":"v1.7.8",...}; parse tag_name - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
skills/crowdsec/SKILL.md, line 72
curl -s https://version.crowdsec.net/latest # → {"tag_name":"v1.7.8",...}; parse tag_name - SECRETS_PATH_DOTENV Low
Mentions a .env file.
skills/crowdsec/references/appsec/overview.md, line 74
| Patch a known CVE / shut down `/.env` / block obviously bad paths | **inband** (e.g. `crowdsecurity/virtual-patching`) | Per-request 403. `kind: waf` alert with `Remediation: fal - INSTALL_DOCUMENTED_INSTALLER Note
Documentation shows an installer that pipes a download into a shell.
skills/crowdsec/references/configure/bouncers/web-servers.md, line 205
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec-apache/script.deb.sh | sudo bash
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Note
The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
skills/crowdsec/references/configure/bouncers/web-servers.md, line 205
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec-apache/script.deb.sh | sudo bash
skills/crowdsec/references/install/bare-metal.md, line 23
curl -s https://install.crowdsec.net | sudo sh # adds the repo
skills/crowdsec/references/operate/upgrades.md, line 48
curl -s https://install.crowdsec.net | sudo sh # adds the signed official repo
Network
Concern
can reach version.crowdsec.net. The description does not name that host. can reach a host that is not written as a fixed address. can reach your-site. The description does not name that host. can reach admin.api.crowdsec.net. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/crowdsec/SKILL.md, line 72
curl -s https://version.crowdsec.net/latest # → {"tag_name":"v1.7.8",...}; parse tag_name
skills/crowdsec/references/appsec/deploy.md, line 94
curl -sS -o /dev/null -w 'allow: %{http_code}\n' \
skills/crowdsec/references/appsec/deploy.md, line 103
curl -sS -o /dev/null -w 'block: %{http_code}\n' \
Show more
skills/crowdsec/references/appsec/bot-detection/deploy.md, line 104
q(){ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:7422/ \
skills/crowdsec/references/appsec/bot-detection/deploy.md, line 126
curl -s -o /tmp/c.html -w "%{http_code} %{size_download}\n" http://your-site/
skills/crowdsec/references/configure/bouncers/web-servers.md, line 94
curl -sS -o /dev/null -w 'normal: %{http_code}\n' http://127.0.0.1/
skills/crowdsec/references/configure/bouncers/web-servers.md, line 97
curl -sS -o /dev/null -w 'appsec block: %{http_code}\n' \
skills/crowdsec/references/configure/bouncers/web-servers.md, line 103
curl -sS -o /dev/null -w 'banned: %{http_code}\n' http://127.0.0.1/ # → 403
skills/crowdsec/references/configure/bouncers/web-servers.md, line 106
curl -sS -o /dev/null -w 'after unban: %{http_code}\n' http://127.0.0.1/ # → 200
skills/crowdsec/references/configure/bouncers/web-servers.md, line 181
curl -sS -o /dev/null -w 'normal: %{http_code}\n' http://127.0.0.1/ # 200
skills/crowdsec/references/configure/bouncers/web-servers.md, line 182
curl -sS -o /dev/null -w 'waf block: %{http_code}\n' 'http://127.0.0.1/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php' # 403 (inband vpatch)
skills/crowdsec/references/configure/bouncers/web-servers.md, line 184
curl -sS -o /dev/null -w 'banned: %{http_code}\n' http://127.0.0.1/ # 403
skills/crowdsec/references/configure/bouncers/web-servers.md, line 239
curl -sS -o /dev/null -w 'normal: %{http_code}\n' http://127.0.0.1/ # 200
skills/crowdsec/references/configure/bouncers/web-servers.md, line 581
curl -sS -o /dev/null -w 'appsec block: %{http_code}\n' \
skills/crowdsec/references/configure/bouncers/web-servers.md, line 587
curl -sS -o /dev/null -w 'banned: %{http_code}\n' http://<host-ip>:8080/
skills/crowdsec/references/debug/symptoms/not-blocked.md, line 79
curl -sS -o /dev/null -w '%{http_code}\n' \
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
skills/crowdsec/references/appsec/overview.md, line 74
| Patch a known CVE / shut down `/.env` / block obviously bad paths | **inband** (e.g. `crowdsecurity/virtual-patching`) | Per-request 403. `kind: waf` alert with `Remediation: fal
skills/crowdsec/references/configure/bouncers/web-servers.md, line 14
notes: "Traefik plugin: crowdsecLapiKeyFile (compose secret) auth + bouncer registration; crowdsecAppsecFailureBlock/UnreachableBlock fail closed (403 while AppSec down); AppSec bl
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 8802dbe68a05. The docs document an installer that pipes a download into a shell. can reach version.crowdsec.net. The description does not name that host. can reach a host that is not written as a fixed address. can reach your-site. The description does not name that host. can reach admin.api.crowdsec.net. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 8802dbe68a0552fe55dc605b6278f57e57578526
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.