Skip to content

/crowdstrike-inspector-expert

Interpret CrowdStrike Falcon findings for sensor coverage, policy visibility, and host group scoping.

shell
$ npx -y skills add GRCEngClub/claude-grc-engineering --skill crowdstrike-inspector-expert --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

  • Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
  • You can call itInvoke it directly when you want it.
  • Slash command/crowdstrike-inspector-expert
How auto-invocation works

Context preview

The summary Claude sees to decide when to auto-load this skill.

Interpret CrowdStrike Falcon findings for sensor coverage, policy visibility, and host group scoping.

SKILL.md

crowdstrike-inspector-expert.SKILL.md
name: crowdstrike-inspector-expert
description: Interpret CrowdStrike Falcon findings for sensor coverage, policy visibility, and host group scoping.
license: MIT

CrowdStrike Inspector Expert

Use this skill when reviewing `crowdstrike-inspector` output.

Findings are written to `~/.cache/claude-grc/findings/crowdstrike-inspector/<run_id>.json`.

Key SCF mappings:

  • `END-03`: endpoint sensor coverage
  • `CFG-02`: prevention policy visibility
  • `MON-01.2`: detection policy visibility
  • `AST-02`: host-group scoping visibility

Treat `inconclusive` as an API permission or plan coverage gap, not a pass.

Read it on GitHub ↗
Ships withtrust-center

Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.

Get the whole plugin, auto-invoked