crowdstrike-falcon-fusion — 7 skills

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-18

Run UTC: 2026-10-18T15:09:33Z
Reviewed: 2026-10-18
Published: 2026-10-18
Updated: 2026-10-18

Observations · Limitations · Evidence

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 7 skill declarations. Ran 180 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · skills · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-18T15:09:33Z, tree 9eff04d7b850d90bf8a3db317cb5a42e455926ed42c5170bc57ea6a060a70915.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: crowdstrike-falcon-fusion — 7 skills
slug: source-skills-a431455391f3e363b2b3d374
type: skills
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 7 skill declarations. Ran 180 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared skill names (listing.json): authoring; deployment; execution; foundry-redirect; lookup-files; setup; workflows"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/CrowdStrike/fusion-skills.git
documentation url: https://github.com/CrowdStrike/fusion-skills.git
commit: 38527dc5afa970543859c31ca5dbf69352bfaa28
tree sha256: 9eff04d7b850d90bf8a3db317cb5a42e455926ed42c5170bc57ea6a060a70915
file sha256: {".agents/plugins/marketplace.json":"7db745f694931f093beaa20a149ee041b785855d1b67a201832b09a60024e086",".claude-plugin/marketplace.json":"0db5b67244b502c8b4db323ec88b44073f4485e99b3bd30b60380a9e6812b0e7",".claude-plugin/plugin.json":"39fc58cb04fe0e017a9f3847d2ca98185eb554e5ad5de400e5628ab97d7fb267",".codex-plugin/plugin.json":"b5c2ba0be10a2d3d67fa3d9733181f6c894f6cf10c2ccabde61afc7df3b7dea1",".cursor-plugin/plugin.json":"724558d6898756831e1c92356e264b2ebecdef2bf4ea3e0e4d33bb9b60fd81e0",".github/copilot-instructions.md":"704fa0fa3453495e1ade199ab911618ecbc980535d510f0b49e601a1c78e271b",".github/dependabot.yml":"b158427b595cd0574ef5fe8877ef30202dc09135d7da55a49b8d54352affdb6b",".github/workflows/main.yml":"2e33d7e9a903815a081070f652a723336f693caa3f1a8c071546735a3ace6920",".gitignore":"59e66411e194767eb28dd211dc41942ab5e56ec46ed1b806e15d50c35fab6ba4",".markdownlint.json":"79df006e2df41aec461a46856677090f5725af651e0d935b3faf981cd20a48f4",".pylintrc":"e8e884b08413cfb7c00fa2e16665eb9e3b486af63d414e8db41488afd79a8cce","AGENTS.md":"3c8db684f31c6dce8e20760e0c04d5567a666274bfa645c44c75fe3b73988ee5","CHANGELOG.md":"e3b8cc685f1078845f376e543477e328509652e6eeefb45a84596eb49911caa8","CITATION.cff":"0c52f1e84ada7bb62525127c645f94271a1a8e47439445ae421307c93c8ad922","CLAUDE.md":"9d8b3986f51ca29bdfae7177979861dabedef074d169715e200d6339f05f9ac8","CODE_OF_CONDUCT.md":"b2ad4d0d7e2f4d085403d70ce90f64ecc51c994183d055218922db5ff3c86432","CONTRIBUTING.md":"4d58d1a987bf0164967ce27ef5dc5010f1731f96fd0c5f9a3ef857275100af56","GEMINI.md":"54ecefe3d44ace873096ba36e4d850d55ad53b4eb0c6644f69148ac35e38c85e","LICENSE":"98e0a8035cd69aa3f126e1f6c4f3922d350cb2253ad79807f895d9d04e373d46","README.md":"fb4e6998be790cccd42179bf416c980e6c701bc33d34b55dd05e6f7a465d7a1e","SECURITY.md":"39d87791e3e964a114ad5472f8e8302a573b8a48326a7c4a552017caaaf65c88","SUPPORT.md":"c6e34529a23a6e71e2b9928528c66656980e8c406def111e53976a1553b426e5","assets/crowdstrike-logo.png":"5132bd5af60a22182bd531e1e9e3f0f11784038b0ef2ef611459af7b80cb6ff9","common/scripts/_bootstrap.py":"80b893f7c22f84739a6760e0a5d6816289c9a39b7fe7c08a30f2938b19fd8bd5","common/scripts/auth.py":"0ba9567acf51085d5311c8b184626cbb7d1fa9db03062376be4d4fe4837ca0d6","hooks/bootstrap.sh":"65c9470c1e457bb6160c14f2b6e8c2137af939a79e0c1322086f4df8747e819d","hooks/fusion-foundry-bridge.sh":"25987de507c79a1ba5183e250fd5d076f676642da3908e397dc6853916884543","hooks/fusion-skill-router.sh":"9e40822ffb71af5b3f3bc61b30a29eb862533d9b91a12f3eacd54630e0cc7c88","hooks/hooks-cursor.json":"a4abba41afc8795d0c84079a2d4ec71dc119974f4e7ecd363b835feb9d94d7eb","hooks/hooks.json":"afe738d3cf4ec8fc721a7b8c6ab1beac76dee1e01ea580361c564e8aaac4b69d","hooks/host-output.sh":"999b432871924eec6d64401cb085695cc141738e3339be852233d1383f2a16ca","images/alliance-team.png":"eff8eeff2d447aa0bfd5b5ccac6a565ed5ed42894db58a5c136a2ca82e503dc0","images/cs-logo-footer.png":"77f33b2dc2eae6fb655c257bfa1d8a13f5d945c1c1e8cba358e93274c673c523","images/cs-logo.png":"61f4d2f3d6ec66f6fc081e554339de247cf2cda4f7192cb26fe24e2ef3bce45b","plugin.json":"f9fafcb06d1e891f0f85676967250e35c967905b3e3602f939344cc9c0733f58","pyproject.toml":"0f792d73d83e29f0fb703a46db10647879b1415b0de84941d5c746117996609f","release.sh":"6a96aecf6ffe9648694a1318ec7c5af55e255a797633ef04f2c05024b4a3799e","requirements-test.txt":"88cce7db9d531962578b42bf1a09d9a564fa9d85ee6a34b7c268559a5c5ec716","requirements.txt":"9df301e1198a32e2a6be39f68c35377c6c5b3053f6ec387bdee85c901dc3f9a5","run-ab-test.sh":"feb2869224c421941a3a758e79a3a0f889c86caf0aa17d40d3c0940b880efa89","scripts/agy-plugin-swap.sh":"fc21dcb6057925144026d28723f779de105bd503991c568a9367a47ddab7fea2","scripts/cleanup_workflows.py":"8697dd4145b29114c02465e35c880104d31ad6fb1789951735481a3d5327cdab","scripts/convert_catalog_to_yaml.py":"8967d3704f098624e4ca7bfaad01da34795b1c1bc432c13b6a34d0a724c5e1a0","scripts/export-trigger-yaml.sh":"fc4efa16365b0bd8e9036bae1f1a091575488ba850280c5b444563dd5e04e2c6","scripts/python-detect.sh":"76b6c605f012c4ad39b593e3d17457a934e6bb28709d00dafd8e0a97444506a3","scripts/python.sh":"1dfcbb8df1367c3005853f6882153c9d04b5c92a8e0477585a897b020e949cd3","scripts/setup-python-venv.sh":"ffd25b4fdab82825381e13a9bd0010600faaa3d24ed149400251a4f5a5309207","scripts/skill-isolation.sh":"ac598e4dd3f282aed463a19297703b7c6632fba4cae906d0799dbbd9d4ba2d39","skills/authoring/SKILL.md":"49e3e714c2e42759d89e61a2ae796c1b28436d25304410c849e77ce1c8402d9b","skills/authoring/assets/conditional.yaml":"a448a0a9e39dc34f6b7b88b8c6897680cd62b671b57f8605a92b53c71d7b54cd","skills/authoring/assets/loop-conditional.yaml":"74ffd4ca0630f2c35964c4d7a9aa11e7ccf21322a06bb999538fb9797427949e","skills/authoring/assets/loop.yaml":"369fa39529d2322909ff7f89f4a870783dd635eb0841a08029c132ea1e9bb6e7","skills/authoring/assets/single-action.yaml":"29c6872d4da3f9b59c0553ecb6e10c6e58252be47c4a821341ab3a741f047118","skills/authoring/examples/README.md":"2c33680e6b421857ddf6615d9fed82032699824fcf0f6c07a88301543967157c","skills/authoring/examples/identity-response/email-phishing-playbook-itp.yaml":"5d224f459bc6ef0af1777be3134fa10890daa3d36f7a5d0d2214ea9b56744bd9","skills/authoring/examples/identity-response/identity-detection-auto-resolution.yaml":"9975a817164985568dca78c582e7b75046f5abfef23b66e735f4b56d3b0c7952","skills/authoring/examples/ngsiem/close-duplicate-detections.yaml":"099ccb2d04c08eab85bfce256c9e0eceec96483fe7e0be9d944f54b60a6d5d8d","skills/authoring/examples/notifications/network-contain-endpoint-on-detection.yaml":"8e11871576f19c880a2fce4b439068055fbb10618b296fef8d486f112bbed8d1","skills/authoring/examples/notifications/slack-send-message-to-channel.yaml":"b62be4c7447d2b6b2312254ef07491f1e91bb3aa9a03d2d14cd9d547ba0d9d53","skills/authoring/examples/response-actions/pan-ngfw-allowlist-edl-exception.yaml":"f0d002058aca826f327259ed20ec5cc86755bbc0f5a7258f58aec9ac77f8fac0","skills/authoring/examples/response-actions/pan-ngfw-blocklist-edl-force-refresh.yaml":"f73e2cd354c652791a0f12fe32f26e2dae6aa282d41629eb679995261ac15372","skills/authoring/examples/response-actions/pan-ngfw-get-all-edls.yaml":"d2ea74db1a29d7c2556633a796e6d950ace053143f5ea990c438fb3abd7a85ef","skills/authoring/examples/response-actions/pan-ngfw-monitor-dag-members.yaml":"f4f0ae91684982e7990ef7e77271908fc501b6547c45d3e5c9a95262c3f2d250","skills/authoring/examples/response-actions/pan-ngfw-register-ip-tag-dag.yaml":"5e2a06cdb002a398881975f6bb4a1a11406897d2ae1b1c7e04993f6d9fadfb3e","skills/authoring/examples/response-actions/pan-ngfw-unregister-ip-from-tag-dag.yaml":"b67cd9cc9cc4ad66b5b5a49b54228b29500f7f948b781ac58063cf25e13514ee","skills/authoring/examples/threat-intel/analyze-enrich-epp-detection-llm.yaml":"c19174014006da32fd00e43688eab49b662b8d38127f3726610f73862338cc74","skills/authoring/examples/threat-intel/domain-enrichment-pulsedive.yaml":"2cd0b1090a298a07139033d18bad99a8bc627762c189529b17a691f2093171a5","skills/authoring/examples/threat-intel/domain-enrichment-virustotal.yaml":"3c2e503c8c79bb57c6901904bc3587369a87c1d5c186e60b3a63fc8b615001e6","skills/authoring/examples/threat-intel/enrich-ip-virustotal-llm-email.yaml":"1b0591149a3e7b13a8d356061f1f52a76ab0337be41fc2850cff71a85fc83cd9","skills/authoring/examples/threat-intel/enrich-url-virustotal-zscaler-blocklist.yaml":"489f31bb2e91350d6fdda575c5f01c771cc7f2bbdad865afccc7d4568ce47863","skills/authoring/examples/threat-intel/ip-address-enrichment-abuseipdb.yaml":"780b2d714902b3cb92ed4bbdfdf3cd6458fc00d993407226c9c335060c3dd04e","skills/authoring/examples/tutorials/crowdstrike-http-request-falcon-api.yaml":"95473716af379cf711b59d707b228438c2540a63728adb0e530f262904de37f5","skills/authoring/examples/tutorials/intro-cases-add-event.yaml":"f56cdd8b9d10de8cd98ab83c0df5e62700280909af4fb46e36aea9cd4369102b","skills/authoring/examples/tutorials/intro-data-transforms-ternary.yaml":"911067ac8bf57ff7d41830699c5e05638b6c8b0e4071190375188cdbb2d34c79","skills/authoring/examples/tutorials/intro-deduplicate-third-party-detections.yaml":"6048cef43e71f94a189cb026dcf28bab8e5cc26ac376875da491646420b2b462","skills/authoring/examples/tutorials/intro-error-handling.yaml":"5587d62113b553ff7a4115c53a0462f04025fd48e05fe254c714bf91f3a31c09","skills/authoring/examples/tutorials/intro-lookup-file-actions.yaml":"1cb0357b9e08b18f6f5571f27ec5a836fc2b323f0771b0db9aadac644592f7fa","skills/authoring/examples/tutorials/intro-python-sslbl-lookup.yaml":"10d2b9a82de02753b84dc139e558cef141c445232baa1ba408a355bbc46f6900","skills/authoring/examples/tutorials/intro-receive-email-trigger.yaml":"6cf9b3b917691c1024c79ae126528cb626b1d71e9441f0707a44d2dae546c300","skills/authoring/examples/tutorials/intro-variables-append-array.yaml":"010233267c4a6e4992e4ab174932bc28595bbeedd09c84166946e1e01daa298c","skills/authoring/references/best-practices.md":"d4abed8ab7ab90cfc3d0219346a979b634a3332051a2daf96c6897d1126e52fe","skills/authoring/references/cel-expressions.md":"c1712159db40788ca1bc9bcec1a6a7c478d92be9e9ac6ad755c212901ccae805","skills/authoring/references/charlotte-ai-action.md":"dd20cdd36e5d5d7fc5ad01e2df1b69f51a972400b914f31b832f8a8bdbbd6cfe","skills/authoring/references/deduplicate-ratelimit.md":"1d151847e2e9f7f58d874149ee954472060c5d8ffdc7a9d08451f15a3728a932","skills/authoring/references/event-query-action.md":"4b083d429c65fe5482c83827d17021ac86e692baa62a8bde7afbc23bdcea0a58","skills/authoring/references/event-query-vs-api.md":"4abe7699d7116b16b1467b94d4a6f7a9c63dd543adc56f45383cf0b495075ccf","skills/authoring/references/http-actions.md":"77e5150aeeb43f08466bc478d1bf3324c725a6d2a379c5d75bf8affa8dfbcf53","skills/authoring/references/inline-python-action.md":"0ba85b4f86abe93bd75c7e3884e30844b397811f2a4403dcd5dc9ee66610b624","skills/authoring/references/json-structure.md":"f46bdb3c203ed3d578f022b776f76f5854d9051d472efde63cf18257bff409bf","skills/authoring/references/trigger-types.md":"1b5b30b0a48462b6a189056acc8977335d41b40a2da7019e82c8c3101c06c28c","skills/authoring/references/yaml-schema.md":"9532c3281091840766e99f4e6ef0de21cb5414bd9acb870684580fe732ec8e49","skills/authoring/scripts/action_search.py":"ea384580ebfe807090dec87935fced18c80f161e5e3cb804b8eaaf46315f13ab","skills/authoring/scripts/trigger_search.py":"919dcff9cfecda0f06bc336f954fea066992821a48cc639fe61e2d57351b545b","skills/authoring/scripts/validate.py":"e09bcf7441d2aa5492a23f690a80c4c1c8b84c7dbe46f5b4c1e9a6fc47a78d37","skills/authoring/workflows/ngsiem-detection-ti-enrichment-copilot.yaml":"5dc29c816a33168404f518b8f46ca817781ddb1cb8e1d436eb562800be7bc6bd","skills/deployment/SKILL.md":"4726b5a89a41c05ec4f13bdf815078b7ce375804dc51641ee2336bbe607d6034","skills/deployment/references/console-verification.md":"f06d9d69ecb985bc9eef6fb26d946e5341c5b2fb12d424316005064df9d17dde","skills/deployment/scripts/delete_workflow.py":"470cebc8971595b21f59df838dbd94973d58f77f9788ab4849bfb73b30210f6a","skills/deployment/scripts/export_workflow.py":"4619d67fce5a5b9aa9e4b8fafa7e4caccbf84f83d4057f4544afdbfb1ff38255","skills/deployment/scripts/import_workflows.py":"85d6c34ba6481756119541373e68cfdb846f4cd185b9517850b97a1ccc7b237b","skills/deployment/scripts/query_workflows.py":"dbe5f5bf5c86936d6b730e3e69df0698565ab9a30ab11aa179adda3fdf4549eb","skills/deployment/scripts/release_workflow.py":"bffbb1b857e734bac18608bb58d27a7873de34e80dc94857dce9d00168c96614","skills/execution/SKILL.md":"f3571cfb400b3b4ec4bf2dd85b13c62a66db29aa9de0fa3add3a46765a373507","skills/execution/references/execution-log-queries.md":"bc227bbfd7dccb159b50c8ebe7f610632154f98c02d0c9198e5d2a8e399dc983","skills/execution/references/throttling.md":"761276c04ba7d88d104a488698776e7f562fc725eb5f45a5d8fad637adc95d4c","skills/execution/scripts/get_execution_results.py":"2a77257c2ba688e661c55b231bc21d6131188ee4bce820d1f8a24f8a69255e99","skills/execution/scripts/monitor_execution.py":"9d3b1924678d929eee1a41ae1c6dea998fe363da3b198aa31830757aea81d4b2","skills/execution/scripts/trigger_workflow.py":"7325019566624c4374813a7d61531a3ab1b305cdced91829bc22f7ca436047a0","skills/foundry-redirect/SKILL.md":"4b43b37ece0a82e06883807b2e3b2dce42656e73470683b4f8efe661fc03aac4","skills/lookup-files/SKILL.md":"71dfd68c7d1f3ad25d89934e46d0f2187d1900da841bbbc7e779c2eb59119bb0","skills/lookup-files/assets/example-ip-blocklist.csv":"7d629611ba0f47eab6d9ea8372886d4797a58c2b1c7c2d069a899769867746c1","skills/lookup-files/assets/example-user-risk.csv":"754afebe7a3d7d73a2fc0e0b447018dc97a47c1372ed08fa07b4c10700aeac56","skills/lookup-files/references/cql-match-function.md":"12447a82c1176af2b788ed92c789952671f4010f8081958598c53da2dc08f491","skills/lookup-files/references/lookup-file-formats.md":"df1f8ebb0bd03489b97bacf1217a7c733d71c2218db361afc8ab13bb748789c2","skills/lookup-files/scripts/create_lookup.py":"95c76bf1963f60aeda8d4d168653fe8e93473cc6ff506287c4c0aacee1de2cb5","skills/lookup-files/scripts/delete_lookup.py":"6f9c4f0e32cc35b44a08c50142682660139f22acbb13aff5ff9f7bd56948e972","skills/lookup-files/scripts/get_lookup.py":"e9a23931884557a5557b4e5ff1c604d599ec33c8188570916882521566a552d6","skills/lookup-files/scripts/list_lookups.py":"754eb3c2fe010eb3fe08eb6f929583afdc881d310a03f6ccae5d10c41a939133","skills/lookup-files/scripts/update_lookup.py":"5def3c273a383229900c7d405f0350f72f34d63a8a3b0961ef1b14a28d3116cb","skills/lookup-files/scripts/verify_lookup.py":"c78ff2ef6dd828d9a823856bcbb8f29d9bb1bf930e4ace1abdd1023db65a6072","skills/setup/SKILL.md":"c3f7e71368cb20ab83fa6c5d6abcc591c245454b49f21b86b1f0ebfc905da1a8","skills/workflows/SKILL.md":"570e53904ef8042837836cf927a66ee89824ef43896d74b7408f3b10a9027069","tail-test.sh":"61bac57d0ac63f044a175d89f600b90e4a344579218ea8ae43b26ea04dc29a53","test-agy-plugin-swap.sh":"aa22052cce3899c335051a0af0f0c34e0a5204720085f3e04de63d1b3c3b6cc2","test-assistants.sh":"f85563c1fefa75968e90801ae179bad1b8284c94aff505a9a47deccd41d76820","test-bootstrap-symlink.sh":"f512aace49c23eae49e9a4e0421fa9f8b4cb30cf988a77b70d410b13dc1c87a4","test-hooks.sh":"a3836a6cf7e2593d5bf0430caaf294d7a552f8c4b5739895670e950a10777345","test-result-schema.json":"23a3057267fa5263fd33218f750c6291b978f6c29638336af0b61b00b3d17123","test-scorecard-parser.sh":"a6f82c3e8bf296963400bc4c4252cc62ea73859601d11cf9a32d1aa5875884f6","test-skill-isolation.sh":"630b6cfdf0cf7268a4774c58314d18fa019efdba4e9f8356f9ed0e5f03042a7e","test-skill-scorecard.sh":"53c9301e2c1f032892ef271bd2e2835bdc1304d0dc129f9ef011457b0465b458","test-skill.sh":"5650eb0e11a6caa2056034acd947246ff54472d9401a24ec9895ce45500236b5","test-validate.sh":"c53fc5c15ec90dd1d354aed9a752680f4766df1fe4bcd294acb558f35679b1e2","test-verdict-parser.sh":"e75c4bb7906a37e0f89929e78072c497d23b60a44009dca2a42676e4b67f8c98","tests/conftest.py":"2dac6a380c5beb381eb234bfc1d89d45bc8e32f232789a453bc13df5e6107a46","tests/test_action_search.py":"8de22dd5a8c69d7427f1192ad4e2b354c90e501978a9a6fefca8fb3fba65b11e","tests/test_auth.py":"ffffc710f595be512e3f11aca6070cc9bf140ad18ee51dd52316a457c4421cc0","tests/test_bootstrap.py":"2bcececb2f9e0bb23dd9b0444987ebf23509e940911b2e458eb29137cb4f9032","tests/test_cleanup_workflows.py":"a8414c6719695499be0d485a3c84b28daf52b83a9a0f6807fee4f858fa83778e","tests/test_convert_catalog_to_yaml.py":"867f8ee6e530e34615ac4d005cd6209de7310e03328cb83213997cd29496ac6d","tests/test_create_lookup.py":"dfec19d35c524d2f3bf3998ae8084d816f218a45940854db586144cd928afe66","tests/test_delete_lookup.py":"262505bdd6e9e88ba1dddd542d796a78167d98ae28ffeeccf6186d0caafbcd67","tests/test_delete_workflow.py":"650050277b7bc9226ea78f07516c862f3e4ba496e8e71f6cecff1898626bd2e0","tests/test_export_workflow.py":"0519eed01c459420de1318fd25a281c02fd08a3ddf64fb70bf0af0056db99c45","tests/test_get_execution_results.py":"0f437323c69a49fae0072e07ae24a1a0169f28657bfbfed2edc4a8830781d86d","tests/test_get_lookup.py":"6390bc80ff75d697b3e67076e1a94e8003d9fe1f3dfacb28eea8178010cbd769","tests/test_import_workflows.py":"ba547f509c966ac9af20cab01743983b2cd07354a1fd54bb1840e02124efa7b1","tests/test_list_lookups.py":"fb8b5a239736af155312feb734e045186ca9a304e0836eb67dfacc120b891177","tests/test_monitor_execution.py":"4868853bd40004bf2ccfb3fb26200045a49aeebc356643426179a5a238c4ac3f","tests/test_query_workflows.py":"a334a18238e5aed4018fc484e78a348613976c77a5630060adba40ebf492242b","tests/test_release_workflow.py":"313ae7ade59538e851477c593988e4355419fd58569d45e2cb0b3c09019b358c","tests/test_skill_links.py":"9b63957fb55b626650ad20dfea526960c2255ab7ff368c9abe3a70ec72a3ee14","tests/test_trigger_search.py":"9f7e44036471ba9815070d7095479d69f60c3b65c8e1e251224adc1ca78c404a","tests/test_trigger_workflow.py":"43202c2f9128838d91ddc1390406dd021bbc1ab8658510d19a6e25d303c5a8f5","tests/test_update_lookup.py":"3fac9b8667b9fc727413d0f130fc98b41e4c07dc6a846f2907926a86af4d37b9","tests/test_validate.py":"11812760d3698b05d87072a0b8baf1bd98638173124bf36d691d9ede6fcf2c60","tests/test_verify_lookup.py":"9b963d964e81550b416b9682284ef274097098e39852ec49a2837a5ead0c5951","use-cases/README.md":"0b2865ef8893bf1ca2413c8dcd4c9cbb822caef9d374d13fc89442ad1816ebd7","use-cases/api-pagination.md":"e140a72ee0c8afd35e17fffd118857ee99241ae9d30522da452d32e7dc647d0a","use-cases/case-management.md":"2008c3673e30bd59dcbed7a8071ae72bae5eaaf0770afb8eba005cc03cbf081c","use-cases/charlotte-agent-invocation.md":"95a442172e8f6ce9093e50dafe6a9d137cc2db2b7ad3efef306f2e97cfd3a09e","use-cases/custom-soar-actions.md":"1100e2212ada64616d0934b0252d14350499e570b84748f543cc3b5dd203ec3d","use-cases/detection-deduplication.md":"af4f67a0e29015b52db27ace3ac0cb54dcc15594fe89926becf8694d0b67802c","use-cases/detection-enrichment.md":"a120d655da85921e20330ac180a79d06cd93eeef8d0af4e4aff64ca70912092b","use-cases/event-queries.md":"43b2cf51a3cb73810002e0bdd2d1eb3f07fa2affd54d5377037cec1b4553567d","use-cases/export-query-results-csv.md":"2265cce08bed044229ff0e6e055a68c884eba263ca1f7374976d1fa70afe5f04","use-cases/http-actions.md":"68b23dd6cc94dc69c3940f97ed51afa4983f2cf8bc267700411b670dec02e276","use-cases/human-in-the-loop-containment.md":"62de9ef2284daa0a0695923ab6f818faa6dcdc88275226b05b864dade82b3019","use-cases/identity-detection-response.md":"cf71fa3f665977ec33eea8b0ff302c062be22b80d2b29ed3176d1eafa044f2f6","use-cases/lookup-enrichment.md":"e18636bfb21f9eb2628d8eb557d10e9c7874ca00ee5bdf638842f92f4a3b3a46","use-cases/lookup-file-management.md":"e43fcc68696e716a209b64ed14502589267d233c150a4c709e3fe3ecbc91e2ba","use-cases/ngsiem-detection-response.md":"5b3009af232c7a594678e6ac160006134bcd351c1bfbae66046e3fd078ac2742","use-cases/notifications.md":"a87bc3f012a4e1540c2e7f7129cc6728f06f0473f8982c0dd1bb714f3ca79c68","verify-result-schema.json":"51e3ab7272ae05476111adf2066762925305f21b632bb975c0574c7a524e0ce0","verify-workflows.sh":"29f2755f85bd5aa317c4180af7f5b7f6af5826c4ea1fd26f0e4c33977a59f726"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-18T15:09:33Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-18
reviewed date: 2026-10-18
published date: 2026-10-18
modified date: 2026-10-18
reviewer: Machine-checked
harness version: toolwitness harness at commit c086df0eda39d1552f8cab383c0b4a275ced82c4
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 180 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-18T15:09:33Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"crowdstrike-falcon-fusion — 7 skills","operatingSystem":"Not exercised","softwareVersion":"38527dc5afa970543859c31ca5dbf69352bfaa28"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 7 skill declarations. Ran 180 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared skill names (listing.json): authoring; deployment; execution; foundry-redirect; lookup-files; setup; workflows"}],"evidence_sha256":{"LOCK.json":"3a7daeaa9966412ede5989a1f84bb5050d11b62cc71072aff577e96408ce67dc","commands.json":"093a4c645597a4c636b6ceba1d3980ac158141ba823dddedbcdf5754f7adbad4","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"19f11d73e6fae16628957c19d096e46f8574486b9618ddda5e914d2f693719fd","listing.json":"04ff4b10a83cabc9c7da44b50f35a5c1c5fe42f281bd00616ed48b004c865fd1","selection.json":"0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"},"identity_artifact":"identity.json"}
review: {"codex":"4e9645a157aeac8d06738173cd628c91d6481eef988beecb4c28f18541ec9fc7","date":"2026-10-18","gates":"2080a4c52191e90a1cb65ff45de6d851b74743d6e29bc0479cae4bbc6336f789","grok":"a7f018c5b7d83021d06e0300adc244b49897cfa191fb92a8fd2eef9a1038010d","kind":"machine-checked","reviewed_sha256":"073747ca7c01e856e798b8df10df2beecbbc3224fff67861586423be6e518364","summary":"Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 180 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "skills/authoring/SKILL.md",
        "name": "authoring",
        "description": "Discover Falcon Fusion actions via live API, author workflow YAML with correct schema, validate against Charlotte JSON schema, and use templates/examples. TRIGGER when user asks to write workflow YAML, find actions, validate a workflow, use CEL expressions, or needs action discovery. DO NOT TRIGGER for deploying, importing, executing, or monitoring workflows — use deployment or execution skills. DO NOT TRIGGER when the request is for a Falcon Foundry app, a UI extension/page, an API integration, custom actions from a third-party API, or a manifest.yml — those are foundry-skills territory; advise foundry-skills instead of authoring a workflow.\n",
        "files": {
          "skills/authoring/SKILL.md": "49e3e714c2e42759d89e61a2ae796c1b28436d25304410c849e77ce1c8402d9b",
          "skills/authoring/assets/conditional.yaml": "a448a0a9e39dc34f6b7b88b8c6897680cd62b671b57f8605a92b53c71d7b54cd",
          "skills/authoring/assets/loop-conditional.yaml": "74ffd4ca0630f2c35964c4d7a9aa11e7ccf21322a06bb999538fb9797427949e",
          "skills/authoring/assets/loop.yaml": "369fa39529d2322909ff7f89f4a870783dd635eb0841a08029c132ea1e9bb6e7",
          "skills/authoring/assets/single-action.yaml": "29c6872d4da3f9b59c0553ecb6e10c6e58252be47c4a821341ab3a741f047118",
          "skills/authoring/examples/README.md": "2c33680e6b421857ddf6615d9fed82032699824fcf0f6c07a88301543967157c",
          "skills/authoring/examples/identity-response/email-phishing-playbook-itp.yaml": "5d224f459bc6ef0af1777be3134fa10890daa3d36f7a5d0d2214ea9b56744bd9",
          "skills/authoring/examples/identity-response/identity-detection-auto-resolution.yaml": "9975a817164985568dca78c582e7b75046f5abfef23b66e735f4b56d3b0c7952",
          "skills/authoring/examples/ngsiem/close-duplicate-detections.yaml": "099ccb2d04c08eab85bfce256c9e0eceec96483fe7e0be9d944f54b60a6d5d8d",

Excerpt shown; complete evidence is in the download.

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-18