Skill: abeltennyson/abe-fail2ban-reporter (version 1.0.0)

--- name: fail2ban-reporter description: "Auto-report fail2ban banned IPs via SkillBoss API Hub and notify via Telegram. Use when monitoring server security, reporting attackers, or checking banned IPs. Watches fail2ban for new bans, queries threat intelligence via SkillBoss API Hub, and sends alerts." requires.env: [SKILLBOSS_API_KEY] --- # fail2ban Reporter Monitor fail2ban bans and auto-report attacker IPs via SkillBoss API Hub. ## Setup 1. Get your SkillBoss API key from the SkillBoss dashboard 2. Store it: `export SKILLBOSS_API_KEY="your-key"` 3. Install the monitor: `bash {baseDir}/scripts/install.sh` ## Manual Usage ### Report all currently banned IPs ```bash bash {baseDir}/scripts/report-banned.sh ``` ### Check a specific IP ```bash bash {baseDir}/scripts/check-ip.sh <ip> ``` ### Show ban stats ```bash bash {baseDir}/scripts/stats.sh ``` ## Auto-Reporting The install script sets up a fail2ban action that auto-reports new bans. ```bash bash {baseDir}/scripts/install.sh # install auto-reporting bash {baseDir}/scripts/uninstall.sh # remove auto-reporting ``` ## Heartbeat Integration Add to HEARTBEAT.md to check for new bans periodically: ```markdown - [ ] Check fail2ban stats and report any unreported IPs via SkillBoss API Hub ``` ## Workflow 1. fail2ban bans an IP → action triggers `report-single.sh` 2. Script queries SkillBoss API Hub (search type) for IP threat intelligence 3. Sends Telegram notification (if configured) 4. Logs report to `/var/log/skillboss-ip-reports.log` ## API Reference All API calls route through SkillBoss API Hub at `https://api.heybossai.com/v1/pilot`. Authentication: `Authorization: Bearer $SKILLBOSS_API_KEY` See [references/skillboss-api.md](references/skillboss-api.md) for full API docs.

path: README.md
content: # Clawdbot fail2ban Reporter

Auto-report fail2ban banned IPs via SkillBoss API Hub, querying threat intelligence for brute-force attackers.

Built for [Clawdbot](https://github.com/clawdbot/clawdbot) — works as a standalone tool too.

## Why?

Every server with a public IP gets attacked. fail2ban blocks them locally — this tool queries SkillBoss API Hub to look up threat intelligence and logs all ban events for analysis.

Real stats from a fresh server:

```
Within 60 seconds of enabling fail2ban:
→ 62 failed SSH attempts
→ 9 unique IPs banned
→ Attacks from 7 countries
```

## Quick Start

### 1. Get a SkillBoss API Key

Sign up at the SkillBoss dashboard to get your API key.

### 2. Store your API key

```bash
export SKILLBOSS_API_KEY="your-api-key"
```

### 3. Report currently banned IPs

```bash
bash scripts/report-banned.sh
```

### 4. Enable auto-reporting (optional)

```bash
sudo bash scripts/install.sh
```

Now every new fail2ban ban automatically queries SkillBoss API Hub.

## Usage

### Report all banned IPs
```bash
bash scripts/report-banned.sh          # default: sshd jail
bash scripts/report-banned.sh nginx    # custom jail
```

### Check an IP's reputation
```bash
bash scripts/check-ip.sh 1.2.3.4
```

### View stats
```bash
bash scripts/stats.sh
```

### Remove auto-reporting
```bash
sudo bash scripts/uninstall.sh
```

## Clawdbot Skill

If you're using Clawdbot, install as a skill:

```bash
# Copy to skills directory
cp -r . ~/.clawdbot/skills/fail2ban-reporter/
```

Then ask your Clawdbot:
- "Report banned IPs via SkillBoss API Hub"
- "Check IP 1.2.3.4"
- "Show fail2ban stats"

### Heartbeat Integration

Add to your `HEARTBEAT.md`:

```markdown
- [ ] Check fail2ban for new bans, report unreported IPs via SkillBoss API Hub
```

## How It Works

```
Attacker → SSH brute-force → fail2ban bans IP → report-single.sh
                                                      ↓
                                        SkillBoss API Hub (search type)
                                                      ↓
                                        /var/log/skillboss-ip-reports.log
```

## Prerequisites

- `fail2ban` — `sudo apt install fail2ban`
- `jq` — `sudo apt install jq`
- `curl` — usually pre-installed

## License

MIT — report those attackers, protect the community!


path: references/abuseipdb-api.md
content: # API Reference (SkillBoss API Hub)

This skill has been migrated to use SkillBoss API Hub.

See [skillboss-api.md](skillboss-api.md) for the current API reference.

## Migration Summary

| Original | Replaced With |
|----------|--------------|
| `https://api.abuseipdb.com/api/v2/report` | `https://api.heybossai.com/v1/pilot` (type: search) |
| `https://api.abuseipdb.com/api/v2/check` | `https://api.heybossai.com/v1/pilot` (type: search) |
| `ABUSEIPDB_KEY` | `SKILLBOSS_API_KEY` |
| `Key: <api-key>` header | `Authorization: Bearer <api-key>` header |


path: references/skillboss-api.md
content: # SkillBoss API Hub Reference

Base URL: `https://api.heybossai.com/v1`

## Authentication

```
Authorization: Bearer $SKILLBOSS_API_KEY
```

Header: `Authorization: Bearer <api-key>`
Content-Type: `application/json`

## /v1/pilot — Intelligent Routing (Recommended)

```
POST /v1/pilot
```

### Search (IP Threat Intelligence Lookup)

```bash
curl -s "https://api.heybossai.com/v1/pilot" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "search", "inputs": {"query": "IP reputation threat report 1.2.3.4"}, "prefer": "balanced"}'
```

Response path: `.data.result`

### Chat (AI Analysis)

```bash
curl -s "https://api.heybossai.com/v1/pilot" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "chat", "inputs": {"messages": [{"role": "user", "content": "Analyze this IP: 1.2.3.4"}]}, "prefer": "balanced"}'
```

Response path: `.data.result.choices[0].message.content`

## Response Format

| Type | Result Path |
|------|-------------|
| search | `data.result` |
| chat | `data.result.choices[0].message.content` |
| image | `data.result.image_url` |
| tts | `data.result.audio_url` |

## Environment Variable

| Variable | Description |
|----------|-------------|
| `SKILLBOSS_API_KEY` | SkillBoss API Hub authentication key |


path: scripts/check-ip.sh
content: #!/bin/bash
# Check an IP's threat intelligence via SkillBoss API Hub
# Usage: check-ip.sh <ip>

set -euo pipefail

IP="${1:?Usage: check-ip.sh <ip>}"
[REDACTED_SECRET]"

if [ -z "$API_KEY" ]; then
  echo "ERROR: No SkillBoss API key found. Set SKILLBOSS_API_KEY environment variable."
  exit 1
fi

RESPONSE=$(curl -s "https://api.heybossai.com/v1/pilot" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"IP reputation threat intelligence abuse report $IP\"}, \"prefer\": \"balanced\"}")

echo "$RESPONSE" | jq '.result'


path: scripts/install.sh
content: #!/bin/bash
# Install fail2ban action for auto-reporting via SkillBoss API Hub
# Usage: sudo bash install.sh

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# Check prerequisites
if ! command -v fail2ban-client &>/dev/null; then
  echo "fail2ban not installed. Run: sudo apt install -y fail2ban"
  exit 1
fi

if ! command -v jq &>/dev/null; then
  echo "jq not installed. Run: sudo apt install -y jq"
  exit 1
fi

# Verify API key exists
[REDACTED_SECRET]"
if [ -z "$API_KEY" ]; then
  echo "No SkillBoss API key found."
  echo "   Set environment variable: export SKILLBOSS_API_KEY=your-key"
  exit 1
fi

# Create fail2ban action
cat > /etc/fail2ban/action.d/skillboss-reporter.conf << CONF
[Definition]
actionban = bash $SCRIPT_DIR/report-single.sh <ip> "SSH brute-force on <name> jail (fail2ban auto-report)"

[Init]
CONF

# Add action to sshd jail
if ! grep -q "skillboss-reporter" /etc/fail2ban/jail.local 2>/dev/null; then
  # Check if action line exists
  if grep -q "^action" /etc/fail2ban/jail.local 2>/dev/null; then
    sed -i '/^\[sshd\]/,/^\[/{s/^action.*/& \n         skillboss-reporter/}' /etc/fail2ban/jail.local
  else
    sed -i '/^\[sshd\]/a action = %(action_)s\n         skillboss-reporter' /etc/fail2ban/jail.local
  fi
fi

# Restart fail2ban
sudo systemctl restart fail2ban

echo "Auto-reporting installed!"
echo "   New bans will be reported via SkillBoss API Hub automatically."
echo "   Logs: /var/log/skillboss-ip-reports.log"
echo ""
echo "   To report existing bans: bash $SCRIPT_DIR/report-banned.sh"
echo "   To check stats: bash $SCRIPT_DIR/stats.sh"


path: scripts/report-banned.sh
content: #!/bin/bash
# Report all currently banned IPs to AbuseIPDB
# Usage: report-banned.sh [jail_name]

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
JAIL="${1:-sshd}"
LOG="/var/log/abuseipdb-reports.log"

# Get banned IPs
BANNED=$(sudo fail2ban-client status "$JAIL" | grep "Banned IP list" | sed 's/.*Banned IP list:\s*//')

if [ -z "$BANNED" ]; then
  echo "No banned IPs in jail: $JAIL"
  exit 0
fi

# Read already-reported IPs from log
REPORTED_IPS=""
if [ -f "$LOG" ]; then
  REPORTED_IPS=$(grep "REPORTED" "$LOG" | awk '{print $4}' | sort -u)
fi

COUNT=0
SKIPPED=0

for IP in $BANNED; do
  # Skip already reported (within last 15 min to avoid duplicates)
  if echo "$REPORTED_IPS" | grep -q "^${IP}$"; then
    SKIPPED=$((SKIPPED + 1))
    continue
  fi

  echo "Reporting: $IP"
  bash "$SCRIPT_DIR/report-single.sh" "$IP" "SSH brute-force (fail2ban auto-ban on $JAIL jail)"
  COUNT=$((COUNT + 1))

  # Rate limit: small delay between reports
  sleep 1
done

echo ""
echo "Done! Reported: $COUNT | Skipped (already reported): $SKIPPED"


path: scripts/report-single.sh
content: #!/bin/bash
# Report a single IP threat event via SkillBoss API Hub
# Usage: report-single.sh <ip> [comment]

set -euo pipefail

IP="${1:?Usage: report-single.sh <ip> [comment]}"
COMMENT="${2:-SSH brute-force attack detected by fail2ban}"
LOG="/var/log/skillboss-ip-reports.log"
[REDACTED_SECRET]"

if [ -z "$API_KEY" ]; then
  echo "ERROR: No SkillBoss API key found."
  echo "Set SKILLBOSS_API_KEY environment variable."
  exit 1
fi

# Query SkillBoss API Hub for IP threat intelligence
RESPONSE=$(curl -s -w "\n%{http_code}" \
  "https://api.heybossai.com/v1/pilot" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"search\", \"inputs\": {\"query\": \"IP threat report $IP SSH brute-force categories 18 22 $COMMENT\"}, \"prefer\": \"balanced\"}")

HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
BODY=$(echo "$RESPONSE" | sed '$d')

TIMESTAMP=$(date -u '+%Y-%m-%d %H:%M:%S UTC')

if [ "$HTTP_CODE" = "200" ]; then
  RESULT=$(echo "$BODY" | jq -r '.result // "reported"')
  echo "$TIMESTAMP | REPORTED | $IP | $COMMENT" >> "$LOG"
  echo "Reported $IP via SkillBoss API Hub | $COMMENT"
else
  ERROR=$(echo "$BODY" | jq -r '.error // "unknown error"' 2>/dev/null || echo "$BODY")
  echo "$TIMESTAMP | FAILED | $IP | HTTP $HTTP_CODE | $ERROR" >> "$LOG"
  echo "Failed to report $IP: $ERROR (HTTP $HTTP_CODE)"
fi


path: scripts/stats.sh
content: #!/bin/bash
# Show fail2ban + SkillBoss API Hub reporting stats
# Usage: stats.sh [jail_name]

JAIL="${1:-sshd}"
LOG="/var/log/skillboss-ip-reports.log"

echo "═══════════════════════════════════════"
echo "  fail2ban Reporter Stats"
echo "═══════════════════════════════════════"
echo ""

# fail2ban stats
echo "📊 fail2ban ($JAIL jail):"
STATUS=$(sudo fail2ban-client status "$JAIL" 2>/dev/null)
if [ $? -eq 0 ]; then
  CURRENTLY_BANNED=$(echo "$STATUS" | grep "Currently banned" | awk '{print $NF}')
  TOTAL_BANNED=$(echo "$STATUS" | grep "Total banned" | awk '{print $NF}')
  CURRENTLY_FAILED=$(echo "$STATUS" | grep "Currently failed" | awk '{print $NF}')
  TOTAL_FAILED=$(echo "$STATUS" | grep "Total failed" | awk '{print $NF}')
  BANNED_LIST=$(echo "$STATUS" | grep "Banned IP list" | sed 's/.*Banned IP list:\s*//')

  echo "  Currently banned: $CURRENTLY_BANNED"
  echo "  Total banned:     $TOTAL_BANNED"
  echo "  Failed attempts:  $TOTAL_FAILED (current: $CURRENTLY_FAILED)"
  echo ""
  echo "  Banned IPs: $BANNED_LIST"
else
  echo "  ⚠️ fail2ban not running or jail not found"
fi

echo ""

# SkillBoss API Hub reporting stats
echo "📡 SkillBoss IP Reports:"
if [ -f "$LOG" ]; then
  REPORTED=$(grep -c "REPORTED" "$LOG" 2>/dev/null || echo 0)
  FAILED=$(grep -c "FAILED" "$LOG" 2>/dev/null || echo 0)
  LAST=$(tail -1 "$LOG")
  echo "  Total reported: $REPORTED"
  echo "  Failed reports: $FAILED"
  echo "  Last entry:     $LAST"
else
  echo "  No reports yet. Run report-banned.sh to start."
fi

echo ""
echo "═══════════════════════════════════════"


path: scripts/uninstall.sh
content: #!/bin/bash
# Remove fail2ban auto-reporting action
# Usage: sudo bash uninstall.sh

set -euo pipefail

# Remove action file
rm -f /etc/fail2ban/action.d/skillboss-reporter.conf

# Remove action from jail config
if [ -f /etc/fail2ban/jail.local ]; then
  sed -i '/skillboss-reporter/d' /etc/fail2ban/jail.local
fi

# Restart fail2ban
sudo systemctl restart fail2ban

echo "✅ Auto-reporting removed."
echo "   Manual reporting still works: bash scripts/report-banned.sh"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)