By CrowdStrike
Build and deploy CrowdStrike Falcon Foundry cybersecurity applications with full-stack support: React/Vue UI pages, serverless Go/Python functions, NoSQL collections, Falcon API integration, OAuth/RBAC security, SOAR workflows, Playwright testing, and CLI lifecycle management.
Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead.
Security patterns for Falcon Foundry apps including OAuth scopes, RBAC, input validation, UI security, and credential management. TRIGGER when user asks to "configure OAuth scopes", "secure a Foundry app", "handle secrets", "add input validation", or needs to review a Foundry app for security concerns (XSS, CSP, credential management). Also trigger during pre-deployment security reviews.
Expose external APIs to Falcon Foundry via OpenAPI specs. TRIGGER when user asks to "create an API integration", "adapt an OpenAPI spec for Foundry", "expose an API to workflows", "connect to a third-party API", or runs `foundry api-integrations create`. Also trigger when user has an OpenAPI/Swagger spec and wants it working in Falcon Foundry. DO NOT TRIGGER when user wants to call Falcon platform APIs from function code — use functions-falcon-api instead.
Design JSON Schema collections and CRUD patterns for Falcon Foundry apps. TRIGGER when user asks to "create a collection", "define a JSON schema", "store data in Foundry", runs `foundry collections create`, or needs help with indexable fields, FQL queries, or collection access patterns. DO NOT TRIGGER for workflow YAML, function handlers, or UI components — use the appropriate sub-skill.
Systematic troubleshooting for Falcon Foundry CLI errors, manifest validation failures, deploy failures, and development server issues. TRIGGER when user encounters CLI errors, `foundry ui run` not working, deploy failures, authentication issues, or any unexpected behavior during Foundry app development. Also trigger for headless/CI environment setup failures.
Matches all tools
Hooks run on every tool call, not just specific ones
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Executes bash commands
Executes bash commands
Hook triggers when Bash tool is used
Hook triggers when Bash tool is used

AI coding assistant skills for building CrowdStrike Falcon Foundry apps. Build Foundry apps from a natural language prompt — API integrations, workflows, UI pages, functions, and collections — all scaffolded with the Foundry CLI and deployed to the Falcon console.
brew tap crowdstrike/foundry-cli && brew install crowdstrike/foundry-cli/foundry (macOS/Linux) or download for Windowsfoundry login to authenticateInstall from the Anthropic Plugin Marketplace:
/plugin install crowdstrike-falcon-foundry
Or register this repo as a plugin marketplace, then install:
/plugin marketplace add CrowdStrike/foundry-skills
/plugin install crowdstrike-falcon-foundry@foundry-marketplace
Or install from a local clone for development:
git clone https://github.com/CrowdStrike/foundry-skills.git
claude --plugin-dir /path/to/foundry-skills
The --plugin-dir flag loads the plugin for that session. To make it permanent, add it to your .claude/settings.json:
{
"plugins": ["/path/to/foundry-skills"]
}
Changes to skill files take effect on the next Claude Code session — no reinstall needed.
Codex discovers skills from ~/.agents/skills/. Clone and symlink:
git clone https://github.com/CrowdStrike/foundry-skills.git
mkdir -p ~/.agents/skills
ln -s /path/to/foundry-skills/skills ~/.agents/skills/foundry-skills
Restart Codex to discover the skills. See the Codex skills docs for details.
Copilot CLI shares the ~/.agents/skills/ discovery directory with Codex:
git clone https://github.com/CrowdStrike/foundry-skills.git
mkdir -p ~/.agents/skills
ln -s /path/to/foundry-skills/skills ~/.agents/skills/foundry-skills
Restart Copilot CLI to discover the skills.
Add a rule file to your project's .cursor/rules/ directory:
git clone https://github.com/CrowdStrike/foundry-skills.git
mkdir -p .cursor/rules
cat > .cursor/rules/foundry-skills.mdc << 'EOF'
---
description: Use when building Falcon Foundry apps — API integrations, workflows, UI pages, functions, collections
alwaysApply: false
---
Reference the Falcon Foundry skills in /path/to/foundry-skills/skills/ for building Foundry apps.
The primary orchestrator is development-workflow/SKILL.md.
EOF
Cursor activates the rule automatically when your prompt matches the description.
Link the skills so Gemini discovers them as native Agent Skills:
git clone https://github.com/CrowdStrike/foundry-skills.git
gemini skills link /path/to/foundry-skills/skills --scope user
This creates symlinks in ~/.gemini/skills/ so all skills are available in every workspace. Use --scope workspace to install into the current project's .gemini/skills/ instead. Verify with gemini skills list or /skills list inside a session.
Gemini activates the right skill on demand based on your prompt.
These skills are plain markdown files. Any AI coding assistant that can read local files can use them. See AGENTS.md for the full development guide, or point your tool at the skills/ directory and start with development-workflow/SKILL.md as the entry point.
This prompt exercises the full skill set — API integration, workflow, and UI:
Can you create a Falcon Foundry app for me that has an Okta API integration
with openapi? Share its listusers endpoint with Falcon Fusion SOAR. Then,
create a workflow that can be run on-demand to email or print the list of
users. Finally, create a UI extension that calls the listusers endpoint and
displays the results.
The skills include hooks that ensure the right skills get used:
UserPromptSubmit hook — Matches an action verb paired with a Foundry noun — e.g., "create a foundry app". Explicit CLI commands and skill requests also trigger it.npx claudepluginhub crowdstrike/foundry-skills --plugin crowdstrike-falcon-foundry🛡️ Security Engineer — Security Engineer + Adversarial Security Specialist
Complete DevOps automation platform with CI/CD pipeline management, infrastructure as code, security scanning, and deployment automation. Includes hooks for config validation and MCP server for deployment tracking.
Create, validate, import, execute, and export CrowdStrike Falcon Fusion SOAR workflows using natural language.
Specialized security review subagent
Cybersecurity skills for AI agents — code audit, cloud, recon, IR, AI security, and more
Editorial "Security Developer" bundle for Claude Code from Antigravity Awesome Skills.