specification: API Commons Agent Skills
specificationVersion: '0.1'
provider: CrowdStrike
providerId: crowdstrike
generated: '2026-09-19'
method: searched
source: https://github.com/CrowdStrike/foundry-skills
description: PROVIDER-PUBLISHED Agent Skills, saved verbatim — nothing here is generated by API Evangelist. CrowdStrike
  ships an Anthropic-marketplace plugin, crowdstrike-falcon-foundry, whose eleven skills drive the full Falcon Foundry
  app lifecycle from an agent, plus a twelfth skill in the gofalcon SDK repo for regenerating the Go client. CrowdStrike
  documents the plugin on its own developer center at /foundry/getting-started/ai-skills/ and lists Claude Code
  as tested, with Codex, Copilot CLI, Cursor and Gemini CLI experimental.
install:
  claude_code: /plugin install crowdstrike-falcon-foundry
  marketplace: https://github.com/CrowdStrike/foundry-skills
  plugin_version: 1.5.0
  license: MIT
docs: https://developer.crowdstrike.com/foundry/getting-started/ai-skills/
skill_count: 12
skills:
- file: crowdstrike-foundry-api-integrations.md
  name: api-integrations
  description: Expose external APIs to Falcon Foundry via OpenAPI specs. TRIGGER when user asks to "create an API
    integration", "adapt an OpenAPI spec for Foundry", "expose an API to workflows", "connect to a third-party API",
    or runs `foundry api-integrations create`. Also trigger when user has an OpenAPI/Swagger spec and wants it working
    in Falcon Foundry. DO NOT TRIGGER when user wants to call Falcon platform
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-collections-development.md
  name: collections-development
  description: Design JSON Schema collections and CRUD patterns for Falcon Foundry apps. TRIGGER when user asks
    to "create a collection", "define a JSON schema", "store data in Foundry", runs `foundry collections create`,
    or needs help with indexable fields, FQL queries, or collection access patterns. DO NOT TRIGGER for workflow
    YAML, function handlers, or UI components — use the appropriate sub-skill.
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-debugging-workflows.md
  name: debugging-workflows
  description: Systematic troubleshooting for Falcon Foundry CLI errors, manifest validation failures, deploy failures,
    artifact runtime errors, and development server issues. TRIGGER when user encounters CLI errors, `foundry ui
    run` not working, deploy failures, authentication issues, function execution failures, "debug my function",
    "why did this fail", or any unexpected behavior during Foundry app development
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-development-workflow.md
  name: development-workflow
  description: Orchestrates the complete Falcon Foundry app lifecycle from requirements through deployment. TRIGGER
    when user asks to "create a Foundry app", "build a Foundry app", "plan a Foundry app", runs any `foundry apps`
    CLI command, or discusses Foundry app architecture. DO NOT TRIGGER when user is working on a specific capability
    (UI, function, workflow, collection) within an existing app — use the appro
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-e2e-testing.md
  name: e2e-testing
  description: End-to-end testing for Falcon Foundry apps using Playwright and @crowdstrike/foundry-playwright.
    TRIGGER when user asks to "add e2e tests", "add playwright tests", "write end-to-end tests", "test my app",
    or mentions "e2e", "playwright", or "end-to-end" in the context of testing a Foundry app. DO NOT TRIGGER during
    normal app creation, UI development, or function development. This skill is opt-in;
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-functions-development.md
  name: functions-development
  description: 'Build serverless Go or Python functions for Falcon Foundry apps. TRIGGER when user asks to "create
    a function", "write a serverless function", "build backend logic", runs `foundry functions create`, or needs
    help with FDK handler patterns, function testing, or collection integration from functions. Also TRIGGER when
    user asks to "execute a function", "run my function", "debug this function", "get '
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-functions-falcon-api.md
  name: functions-falcon-api
  description: Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function
    handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon
    in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when
    user wants to expose external third-party APIs to Foundry — use api-inte
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-fusion-redirect.md
  name: fusion-redirect
  description: TRIGGER when user asks for a "standalone Falcon Fusion workflow" that needs NO Foundry app — just
    a trigger plus actions that already exist in their CID, with no UI, function, collection, or custom API integration
    to build. DO NOT TRIGGER when the request needs anything built (a custom action, a UI page, a function, a collection)
    — that is a Foundry app and development-workflow owns it. This skill
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-security-patterns.md
  name: security-patterns
  description: Security patterns for Falcon Foundry apps including OAuth scopes, RBAC, input validation, UI security,
    and credential management. TRIGGER when user asks to "configure OAuth scopes", "secure a Foundry app", "handle
    secrets", "add input validation", or needs to review a Foundry app for security concerns (XSS, CSP, credential
    management). Also trigger during pre-deployment security reviews.
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-ui-development.md
  name: ui-development
  description: Build UI pages and extensions for Falcon Foundry apps using React or Vue with the Shoelace design
    system and Foundry-JS. TRIGGER when user asks to "create a UI page", "build a UI extension", "add a Shoelace
    component", "call an API from the UI", runs `foundry ui pages create` or `foundry ui run`, or needs help with
    Vite config, Foundry-JS, or Falcon console theming. DO NOT TRIGGER for backend func
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-foundry-workflows-development.md
  name: workflows-development
  description: Create and configure Falcon Fusion SOAR workflow YAML for Falcon Foundry apps. TRIGGER when user
    asks to "create a workflow", "build an automation", "configure Fusion SOAR", "add an on-demand workflow", runs
    `foundry workflows create`, or needs help with Fusion YAML syntax, triggers, actions, or variable references.
    DO NOT TRIGGER for UI pages, functions, or collection schemas — use the appropriat
  version: 1.5.0
  updated: '2026-08-19'
  author: CrowdStrike
  license: MIT
- file: crowdstrike-gofalcon-regenerate.md
  name: gofalcon-regenerate
  description: Regenerate gofalcon SDK code after modifying the swagger spec or transformation.jq. Use when the
    user asks to make a field nullable, fix a swagger definition, add a model, rename an operationId, regenerate
    a model/operation/collection/endpoint, or make any change to the gofalcon generated code.
  version: null
  updated: null
  author: github.com/ffalor
  license: MIT
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com