[External Plugin]: CrowdStrike Falcon Foundry

[mraible]

Plugin name

crowdstrike-falcon-foundry

Short description

AI coding assistant skills for building CrowdStrike Falcon Foundry apps: scaffolding, deployment, and best practices for API integrations, collections, functions, UI extensions, UI pages, and workflows.

GitHub repository

CrowdStrike/foundry-skills

Plugin path inside the repository

No response

Ref to review

v1.5.0

Commit SHA to review

7f7d46687c16a9a37c9b08ad58ad58999aabe497

Version

1.5.0

License identifier

MIT

Author name

CrowdStrike

Author URL

https://www.crowdstrike.com/

Homepage URL

No response

Keywords

foundry
crowdstrike
cybersecurity
falcon
security

Additional notes for reviewers

We're listed in Anthropic's marketplace, as well as Cursor, and would love to be in yours!

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🛑 External plugin intake failed (submitter fixes required)

This submission passed metadata validation, but quality gates found issues that must be fixed before it can move to maintainer review. Update the issue details or source plugin and then comment /rerun-intake.

• Plugin: crowdstrike-falcon-foundry
• Repository: https://github.com/CrowdStrike/foundry-skills
• Ref: v1.5.0
• SHA: 7f7d46687c16a9a37c9b08ad58ad58999aabe497

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	134 day(s)
Repository activity	no configured signal
Repository counts	24 stars · 1 watchers · 2 forks · 3 open issues/PRs

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	🛑 fail
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: fail
• install smoke test: pass
• version match: pass
• ref/sha consistency: pass
• canvas structure: not_run
• overall: fail

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (🛑 fail)

❌ api-integrations (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 4 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 24, ../../use-cases/http-actions.md (outside-skill-dir) at line 250, ../../use-cases/greynoise-deep-dive.md (outside-skill-dir) at line 251, ../../use-cases/custom-soar-actions.md (outside-skill-dir) at line 252.
❌ collections-development (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 4 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 22, ../functions-development/references/python-patterns.md (outside-skill-dir) at line 245, ../../use-cases/collections.md (outside-skill-dir) at line 348, ../../use-cases/lookup-table-enrichment.md (outside-skill-dir) at line 349.
❌ debugging-workflows (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 1 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 18.
❌ development-workflow (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 2 invalid file reference(s): ../functions-falcon-api/SKILL.md (outside-skill-dir) at line 111, ../workflows-development/references/event-query-vs-api.md (outside-skill-dir) at line 111.
❌ e2e-testing (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 1 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 20.
❌ functions-development (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 4 invalid file reference(s): ../workflows-development/SKILL.md (outside-skill-dir) at line 172, ../../use-cases/python-functions.md (outside-skill-dir) at line 396, ../../use-cases/logscale-ingestion.md (outside-skill-dir) at line 397, ../../use-cases/api-pagination.md (outside-skill-dir) at line 398.
❌ functions-falcon-api (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 2 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 24, ../../use-cases/python-functions.md (outside-skill-dir) at line 428.
✅ fusion-redirect (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
❌ security-patterns (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 1 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 22.
❌ ui-development (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 3 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 28, ../../use-cases/detection-enrichment.md (outside-skill-dir) at line 363, ../../use-cases/first-app.md (outside-skill-dir) at line 364.
❌ workflows-development (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 4 invalid file reference(s): ../development-workflow/SKILL.md (outside-skill-dir) at line 27, ../../use-cases/schemaless-queries.md (outside-skill-dir) at line 392, ../../use-cases/api-pagination.md (outside-skill-dir) at line 393, ../../use-cases/custom-soar-actions.md (outside-skill-dir) at line 394.

11 skill(s) linted, 1 passed, 10 failed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-oqfvfm/copilot-home/.copilot/installed-plugins/external-plugin-intake/crowdstrike-falcon-foundry/plugin.json.

Version match output

- v1.5.0: matched version "1.5.0" at "plugin.json".
- 7f7d46687c16a9a37c9b08ad58ad58999aabe497: matched version "1.5.0" at "plugin.json".

Ref/SHA consistency output

source.ref "v1.5.0" resolves to the same commit as source.sha "7f7d46687c16a9a37c9b08ad58ad58999aabe497".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "crowdstrike-falcon-foundry",
  "description": "AI coding assistant skills for building CrowdStrike Falcon Foundry apps: scaffolding, deployment, and best practices for API integrations, collections, functions, UI extensions, UI pages, and workflows.",
  "version": "1.5.0",
  "author": {
    "name": "CrowdStrike",
    "url": "https://www.crowdstrike.com/"
  },
  "repository": "https://github.com/CrowdStrike/foundry-skills",
  "license": "MIT",
  "keywords": [
    "foundry",
    "crowdstrike",
    "cybersecurity",
    "falcon",
    "security"
  ],
  "source": {
    "source": "github",
    "repo": "CrowdStrike/foundry-skills",
    "ref": "v1.5.0",
    "sha": "7f7d46687c16a9a37c9b08ad58ad58999aabe497"
  }
}

View workflow run

[mraible]

Thanks for the detailed intake report. The valid-refs failures all share one root cause, and we have a fix ready.

Our SKILL.md files link to sibling skills and to a repo-level use-cases/ directory. Those links resolve fine when the whole repository is installed together (how the skills run today on Claude Code, Cursor, and the others), but vally evaluates each skill as a self-contained package, so any link that leaves the skill's own directory shows up as outside-skill-dir. That's why 10 of the 11 skills fail and fusion-redirect, which has no cross-skill links, passes.

The fix converts those cross-directory links to plain-language references that name the target skill or use case, keeping a path in backticks only where it aids discovery. That preserves the routing intent without pointing at files outside the package. It's up in CrowdStrike/foundry-skills#98, and running @microsoft/vally's ValidRefsGrader locally against all 11 skills now passes cleanly.

Since v1.5.0 is immutable, we'll fold this into the next release, then update the ref and SHA on this issue and comment /rerun-intake. Flagging the plan here so it's clear the submission is still active. Thanks for your patience!