crowdstrike-falcon-foundry

Falcon Foundry Skills

AI coding assistant skills for building CrowdStrike Falcon Foundry apps. Build Foundry apps from a natural language prompt — API integrations, workflows, UI pages, functions, and collections — all scaffolded with the Foundry CLI and deployed to the Falcon console.

Getting Started

Prerequisites

• Foundry CLI: Install with brew tap crowdstrike/foundry-cli && brew install crowdstrike/foundry-cli/foundry (macOS/Linux) or download for Windows
• CrowdStrike Account: With Falcon Foundry access
• Authentication: Run foundry login to authenticate
• AI Coding Assistant: Claude Code, Codex, Copilot CLI, Cursor, Antigravity CLI, or any tool that supports loading reference documentation

Install

Assistant	Command	Marketplace
Claude Code	/plugin install crowdstrike-falcon-foundry	Anthropic
Codex	codex plugin add crowdstrike-falcon-foundry@openai-api-curated	OpenAI
Copilot CLI	copilot plugin install CrowdStrike/foundry-skills	GitHub
Cursor	/plugins (CLI) or /add-plugin crowdstrike-falcon-foundry (IDE)	Cursor
Antigravity CLI	agy plugin install https://github.com/CrowdStrike/foundry-skills	Google

[!NOTE] Codex has two install paths depending on how you signed in. The command above installs from the curated CLI marketplace, which API-key and Amazon Bedrock sessions load. If you authenticated Codex with a ChatGPT account, that marketplace isn't loaded — instead run /plugins inside Codex, search for crowdstrike, and install from the results.

All five assistants have been verified end to end: the skills were loaded from a local clone, then used to build and deploy an app to a live Falcon Foundry tenant from the example prompt below.

For local development with Claude Code, use claude --plugin-dir /path/to/foundry-skills. These skills follow the Agent Plugins format and include a .codex-plugin/plugin.json manifest for native Codex discovery. See the blog post for a full walkthrough.

git clone https://github.com/CrowdStrike/foundry-skills.git

Assistant	Command
Claude Code	claude --plugin-dir /path/to/foundry-skills
Copilot CLI	copilot --plugin-dir /path/to/foundry-skills
Cursor	agent --plugin-dir /path/to/foundry-skills
Antigravity CLI	agy plugin install /path/to/foundry-skills

Codex has no --plugin-dir. It discovers skills from ~/.agents/skills/ instead, one symlink per skill:

mkdir -p ~/.agents/skills
for skill in /path/to/foundry-skills/skills/*/; do
  ln -s "${skill%/}" ~/.agents/skills/
done

~/.agents/skills/ is a flat, shared namespace: foundry-skills' skill names don't overlap with fusion-skills', so both can be symlinked in together. A marketplace or --plugin-dir install namespaces the skills as crowdstrike-falcon-foundry:<skill> and sidesteps the question entirely. Edits are live immediately. Restart Codex to re-index.

Usage

Example prompt

This prompt exercises the full skill set — API integration, workflow, and UI:

Create a Falcon Foundry app for me that has an Okta API integration with openapi. Share its listusers endpoint with Falcon Fusion SOAR. Then, create a workflow that can be run on-demand to email or print the list of users. Finally, create a UI extension that calls the listusers endpoint and displays the results.

How Claude Code skill routing works

The Claude Code plugin includes hooks that ensure the right skills get used:

1. UserPromptSubmit hook — Matches an action verb paired with a Foundry noun — e.g., "create a foundry app". Explicit CLI commands and skill requests also trigger it.

2. PreToolUse hook — When Foundry intent is detected, injects a non-blocking advisory reminder to use the Foundry workflow skill. Claude can still use all tools normally. If superpowers is installed, also intercepts superpowers:brainstorming and redirects to the Foundry workflow skill.

3. PreToolUse hook (CLI guard) — Validates all Bash commands to ensure Foundry CLI commands include --no-prompt flag (prevents Error: EOF failures) and blocks manual directory creation for app structure (prevents invalid manifest.yml). This enforcement is automatic and transparent — you'll only see it when it catches an error.

Hooks observe prompts and tool I/O to keyword-match Foundry-specific actions; no data leaves the session.

Other assistants discover and follow the skills but do not run these Claude Code hooks. They must apply the documented --no-prompt guardrails and run the OpenAPI adaptation helper explicitly. Skill-specific helpers live beside their SKILL.md files so Agent Skills and plugin installations remain self-contained; this packaging is separate from Falcon Foundry CLI connectivity, which is covered by the sandbox diagnostics in the debugging skill.

Skills

Skill	Purpose
development-workflow	Primary orchestrator — coordinates the full app lifecycle
api-integrations	OpenAPI spec import, auth scheme configuration, SOAR sharing
functions-falcon-api	Calling Falcon APIs from within Functions (OAuth, SDKs)
workflows-development	YAML workflow creation, Falcon Fusion SOAR actions and triggers
ui-development	React/Vue UI pages with Shoelace components and Falcon theming
functions-development	Go/Python serverless functions with CrowdStrike SDK
collections-development	JSON Schema data modeling and CRUD operations
security-patterns	OAuth scoping, input validation, content security
debugging-workflows	Systematic troubleshooting for CLI, manifest, and deployment issues
e2e-testing	End-to-end testing with @crowdstrike/foundry-playwright
fusion-redirect	Declines standalone Falcon Fusion workflow requests and points to the crowdstrike-falcon-fusion plugin

Architecture

The skills follow a hub-and-spoke pattern. development-workflow is the orchestrator that parses your requirements, runs CLI commands for scaffolding, and delegates capability-specific implementation to sub-skills:

graph TD
    O["development-workflow<br/>(Orchestrator)"]

    O --> UI["UI Development"]
    O --> FN["Functions Development"]
    O --> CO["Collections Development"]
    O --> WF["Workflows Development"]
    O --> AI["API Integrations"]
    O --> FA["Functions — Falcon API"]

    UI -.-> SP["Security Patterns"]
    FN -.-> SP
    CO -.-> SP
    WF -.-> SP
    AI -.-> SP

    UI -.-> DB["Debugging Workflows"]
    FN -.-> DB
    CO -.-> DB
    WF -.-> DB
    AI -.-> DB

    style O fill:#6366f1,stroke:#4f46e5,color:#fff
    style SP fill:#f59e0b,stroke:#d97706,color:#fff
    style DB fill:#f59e0b,stroke:#d97706,color:#fff

Use Cases

The use-cases/ directory contains real-world implementation patterns extracted from CrowdStrike Tech Hub blog posts:

• API pagination strategies
• Detection enrichment with UI extensions
• LogScale data ingestion from functions
• Lookup table enrichment with 3rd-party data
• Custom SOAR actions
• NGSIEM query export to CSV/JSON
• Publishing certified apps
• And more (see use-cases/README.md)

Recommended Companion: Superpowers

These skills pair well with obra/superpowers, which adds structured planning, TDD discipline, and code review workflows. Foundry skills handle the Foundry-specific CLI and platform knowledge while superpowers provides general software engineering best practices.

See skills/development-workflow/references/superpowers-integration.md for details on how they work together.

Note: The without-superpowers path produces more reliable results because the Foundry skill has full control from the start. Superpowers brainstorming loads first and creates a plan before the Foundry skills are read, which may not follow Foundry-specific patterns.

Foundry CLI Quick Reference

foundry login                                                    # Authenticate
foundry apps create --name "My App" --no-prompt --no-git         # Create app
foundry api-integrations create --name "X" --spec /tmp/spec.json --no-prompt  # Add API integration
foundry ui pages create --name "X" --from-template React --no-prompt          # Add UI page
foundry ui extensions create --name "X" --from-template React --sockets "activity.detections.details" --no-prompt  # Add UI extension
foundry functions create --name "X" --language python --no-prompt              # Add function
foundry collections create --name "X" --schema /tmp/schema.json --no-prompt   # Add collection
foundry workflows create --name "X" --spec /tmp/workflow.yaml --no-prompt     # Add workflow
foundry apps deploy --change-type Patch --change-log "msg" --no-prompt  # Deploy to cloud
foundry apps release                                             # Release to catalog

Troubleshooting

Skills not invoked

If Claude doesn't use Foundry skills automatically, phrase your prompt with a clear action verb and Foundry noun (e.g., "create a foundry app", "fix the foundry function"). You can also say "Use Foundry skills" at any point to redirect.

CLI authentication

foundry profile active    # Check current profile
foundry login             # Re-authenticate
foundry profile list      # List all profiles

Deployment failures

1. Validate immediately after foundry api-integrations create (foundry apps validate --no-prompt) — Foundry's server-side OpenAPI parser is stricter than redocly lint and may reject large vendor specs
2. Run foundry apps deploy from the project root directory
3. Check the debugging-workflows skill for systematic troubleshooting

Testing

Three scripts validate skill changes at different levels. All require macOS or Linux (bash).

Tip: Wrap long-running tests with caffeinate -i to prevent macOS from sleeping mid-run:

caffeinate -i ./run-ab-test.sh --fresh 5

Hook tests

./test-hooks.sh

Unit tests for the three hook scripts (skill router, superpowers bridge, CLI guard). Fast, no API calls, no Foundry CLI needed. Run after any hook change.

Skill test (single run)

./test-skill.sh                    # 5 runs against local plugin
./test-skill.sh --runs 1           # Quick single run
./test-skill.sh --plugin-dir .     # Explicit plugin path (default is ".")

Runs the example Okta prompt end-to-end: scaffolds an app, deploys it, and scores the result. Each run takes 5-10 minutes and costs ~5-10M tokens. Results go to /tmp/foundry-skill-test/.

Verify apps (after test-skill)