Initial release of Falcon Foundry Skills

.claude-plugin/marketplace.json

@@ -0,0 +1,29 @@
+{
+  "name": "foundry-marketplace",
+  "owner": {
+    "name": "CrowdStrike"
+  },
+  "plugins": [
+    {
+      "name": "foundry",
+      "source": "./",
+      "description": "CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Foundry platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.",
+      "version": "1.0.0",
+      "author": {
+        "name": "CrowdStrike"
+      },
+      "keywords": [
+        "foundry",
+        "crowdstrike",
+        "cybersecurity",
+        "falcon",
+        "ui-development",
+        "collections",
+        "functions",
+        "workflows",
+        "api-integration",
+        "security"
+      ]
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "foundry",
+  "description": "CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Foundry platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.",
+  "version": "1.0.0",
+  "author": {
+    "name": "CrowdStrike"
+  },
+  "keywords": [
+    "foundry",
+    "crowdstrike",
+    "cybersecurity",
+    "falcon",
+    "ui-development",
+    "collections",
+    "functions",
+    "workflows",
+    "api-integration",
+    "security"
+  ]
+}

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "14:00"
+      timezone: "UTC"
+    ignore:
+      - dependency-name: "actions/checkout"
+        versions: [">=6.0.3"]
+      - dependency-name: "actions/setup-node"
+        versions: [">=6.3.0"]

.github/workflows/main.yml

@@ -0,0 +1,116 @@
+name: Foundry Skills CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: Install ShellCheck
+        run: command -v shellcheck || sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
+      - name: Run ShellCheck
+        run: |
+          shellcheck hooks/*.sh scripts/*.sh
+          shellcheck --severity=error *.sh
+
+  test-hooks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: Install dependencies
+        run: |
+          python -m venv .venv
+          source .venv/bin/activate
+          pip install --upgrade pip
+          pip install pyyaml
+      - name: Run hook tests
+        run: |
+          source .venv/bin/activate
+          ./test-hooks.sh
+      - name: Run spec adaptation tests
+        run: |
+          source .venv/bin/activate
+          python scripts/test-adapt-spec.py
+
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - name: Validate hooks.json
+        run: python -m json.tool hooks/hooks.json > /dev/null
+      - name: Validate plugin.json
+        run: python -m json.tool .claude-plugin/plugin.json > /dev/null
+      - name: Validate SKILL.md frontmatter
+        run: |
+          fail=0
+          for skill in skills/*/SKILL.md; do
+            for field in name description version; do
+              if ! head -20 "$skill" | grep -q "^${field}:"; then
+                echo "FAIL: $skill missing '$field' in frontmatter"
+                fail=1
+              fi
+            done
+          done
+          exit $fail
+      - name: Validate hook scripts exist
+        run: |
+          fail=0
+          for script in hooks/*.sh; do
+            [ -x "$script" ] || { echo "FAIL: $script is not executable"; fail=1; }
+          done
+          exit $fail
+      - name: Validate version consistency
+        run: |
+          fail=0
+          plugin_version=$(jq -r '.version' .claude-plugin/plugin.json)
+          marketplace_version=$(jq -r '.plugins[0].version' .claude-plugin/marketplace.json)
+          echo "plugin.json version: $plugin_version"
+          echo "marketplace.json plugins[0].version: $marketplace_version"
+
+          # marketplace.json must match plugin.json
+          if [ "$marketplace_version" != "$plugin_version" ]; then
+            echo "FAIL: marketplace.json plugins[0].version '$marketplace_version' != plugin.json '$plugin_version'"
+            fail=1
+          fi
+
+          # All SKILL.md versions must match plugin.json
+          for skill in skills/*/SKILL.md; do
+            skill_version=$(sed -n 's/^version: *//p' "$skill")
+            if [ "$skill_version" != "$plugin_version" ]; then
+              echo "FAIL: $skill version '$skill_version' != plugin.json '$plugin_version'"
+              fail=1
+            fi
+          done
+
+          # CHANGELOG must have an entry for this version
+          if ! grep -q "## \[${plugin_version}\]" CHANGELOG.md; then
+            echo "FAIL: CHANGELOG.md missing entry for version $plugin_version"
+            fail=1
+          fi
+
+          # README badge must match
+          if ! grep -q "version-${plugin_version}-blue" README.md; then
+            echo "FAIL: README.md badge doesn't match version $plugin_version"
+            fail=1
+          fi
+
+          [ $fail -eq 0 ] && echo "All versions consistent: $plugin_version"
+          exit $fail
+
+  markdownlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f  # v6.1.0
+        with:
+          node-version: 22
+      - name: Run markdownlint
+        run: npx markdownlint-cli2 "**/*.md"

.gitignore

@@ -0,0 +1,3 @@
+.DS_Store
+.idea/
+__pycache__/

.markdownlint.json

@@ -0,0 +1,19 @@
+{
+  "MD007": false,
+  "MD009": false,
+  "MD012": false,
+  "MD013": false,
+  "MD022": false,
+  "MD028": false,
+  "MD031": false,
+  "MD032": false,
+  "MD033": false,
+  "MD034": false,
+  "MD036": false,
+  "MD040": false,
+  "MD041": false,
+  "MD045": false,
+  "MD051": false,
+  "MD059": false,
+  "MD060": false
+}

CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [1.0.0] - TBD
+
+Initial public release of Falcon Foundry Skills — AI coding assistant skills for building CrowdStrike Falcon Foundry apps.
+
+### Skills
+
+- **foundry-development-workflow** — Orchestrates the full app lifecycle from requirements through deployment. Coordinates all sub-skills and enforces CLI-first scaffolding.
+- **foundry-api-integrations** — Create and configure API integrations with OpenAPI specs. Includes spec adaptation for Foundry compatibility and Falcon Fusion SOAR sharing.
+- **foundry-collections-development** — Design and implement Foundry collections with JSON Schema modeling, CRUD operations via CustomStorage, and access control patterns.
+- **foundry-functions-development** — Build serverless functions in Python or Go with FDK handler patterns, dependency management, and testing.
+- **foundry-functions-falcon-api** — Call CrowdStrike Falcon APIs from within Foundry functions using zero-argument FalconPy authentication.
+- **foundry-ui-development** — Build UI pages and extensions with React, Vue, or vanilla JS. Includes FalconJS SDK patterns, Shoelace theming, and iframe communication.
+- **foundry-workflows-development** — Design Falcon Fusion SOAR workflows with YAML specs, CEL expressions, loop/condition control flow, and platform action integration.
+- **foundry-debugging-workflows** — Systematic troubleshooting for CLI errors, deployment failures, blank pages, and runtime issues.
+- **foundry-security-patterns** — OAuth scoping, input validation, XSS prevention, CSP configuration, and secure coding patterns.
+
+### Infrastructure
+
+- **CLI guard hook** (`hooks/foundry-cli-guard.sh`) — Automatically validates Bash commands to enforce `--no-prompt`, block manual directory creation, and validate socket IDs.
+- **Spec adaptation script** (`scripts/adapt-spec-for-foundry.py`) — Fixes common OpenAPI spec issues (server variables, auth schemes, parameter deduplication) before `foundry api-integrations create`.
+- **Test harness** (`test-skill.sh`, `run-ab-test.sh`, `verify-apps.sh`) — Automated skill evaluation with token counting, anti-pattern detection, deploy verification, and A/B comparison.
+
+### Use Cases
+
+12 real-world implementation patterns extracted from [CrowdStrike Tech Hub](https://www.crowdstrike.com/tech-hub/ng-siem/) blog posts covering API pagination, detection enrichment, LogScale ingestion, custom SOAR actions, collections, and more.

CITATION.cff

@@ -0,0 +1,23 @@
+cff-version: 1.2.0
+title: 'Falcon Foundry Skills'
+message: >-
+  If you use this software, and wish to cite the origins,
+  please use metadata from this file.
+type: software
+authors:
+  - given-names:
+    family-names: CrowdStrike
+    email: oss-questions@crowdstrike.com
+repository-code: 'https://github.com/CrowdStrike/foundry-skills'
+url: 'https://www.crowdstrike.com'
+abstract: >-
+  Falcon Foundry Skills is a community-driven, open source project
+  providing AI coding assistant skills for building CrowdStrike
+  Falcon Foundry apps.
+keywords:
+  - crowdstrike
+  - crowdstrike-foundry
+  - falcon-foundry
+  - ai-skills
+  - claude-code
+license: MIT