Claude Code, Plugin
Crowdstrike Falcon Foundry
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform.
Compatibility: Portable across standard formats.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 74bc678c4748.
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED SECRETS_ENV_READ
Why this grade
- INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
requirements.txt, line 3
crowdstrike-falconpy - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
hooks/foundry-skill-router.sh, line 245
rtal. Download the real spec with gh or curl instead of hand-writing one — vendor spe - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
hooks/foundry-skill-router.sh, line 245
rtal. Download the real spec with gh or curl instead of hand-writing one — vendor spe - SECRETS_PATH_DOTENV Low
Mentions a .env file.
skills/e2e-testing/SKILL.md, line 29
│ ├── .env # Local credentials (git-ignored) - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
skills/api-integrations/scripts/adapt_spec_for_foundry.py, line 72
result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, check=False) - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
skills/e2e-testing/SKILL.md, line 221
const password = process.env.SERVICENOW_PASSWORD;
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
skills/api-integrations/scripts/adapt_spec_for_foundry.py, line 72
result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, check=False)
skills/security-patterns/references/security-examples.md, line 58
result = subprocess.run(
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 3
crowdstrike-falconpy
Network
Concern
can reach a host that is not written as a fixed address. can reach raw.githubusercontent.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
hooks/foundry-skill-router.sh, line 245
rtal. Download the real spec with gh or curl instead of hand-writing one — vendor spe
skills/api-integrations/references/spec-adaptation-examples.md, line 28
curl -sL "$(gh api 'repos/{owner}/{repo}/contents/{path}' --jq '.download_url')" \
skills/api-integrations/references/spec-adaptation-examples.md, line 35
# Or download directly with curl when the URL is known
Show more
skills/api-integrations/references/spec-adaptation-examples.md, line 36
curl -o /tmp/VendorApi.yaml https://raw.githubusercontent.com/vendor/repo/main/openapi.yaml
skills/workflows-development/references/action-discovery.md, line 38
TOKEN=$(curl -s -X POST "https://$API_HOST/oauth2/token" \
skills/workflows-development/references/action-discovery.md, line 44
curl -s "https://$API_HOST/workflows/combined/activities/v1?filter=name%3A~%27send+email%27&sort=name&limit=20" \
skills/workflows-development/references/action-discovery.md, line 49
curl -s "https://$API_HOST/workflows/combined/activities/v1?sort=name&limit=50&offset=0" \
skills/functions-development/SKILL.md, line 44
**CRITICAL:** If the API has a REST endpoint and an OpenAPI spec exists, you MUST use an API integration. NEVER use `os.environ` with API keys, `requests.get()` with hardcoded URLs
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/e2e-testing/SKILL.md, line 221
const password = process.env.SERVICENOW_PASSWORD;
skills/e2e-testing/SKILL.md, line 296
await page.getByRole('textbox', { name: 'Client Secret' }).fill(process.env.CLIENT_SECRET!);
skills/e2e-testing/SKILL.md, line 29
│ ├── .env # Local credentials (git-ignored)
Show more
skills/security-patterns/references/security-examples.md, line 336
client_secret = os.environ.get('FALCON_CLIENT_SECRET')
skills/e2e-testing/SKILL.md, line 30
│ ├── .env.sample # Template for other developers
skills/e2e-testing/SKILL.md, line 99
.env
skills/e2e-testing/SKILL.md, line 199
# .env.sample — commit this as a template
skills/e2e-testing/SKILL.md, line 204
# .env — local values, git-ignored
skills/security-patterns/references/security-examples.md, line 367
# .env.development - Local security practices
skills/development-workflow/references/advanced-patterns.md, line 167
- **Hidden paths.** Any path with a component starting with `.` is skipped, so `.venv`, `.pytest_cache`, `.env`, and `.git` never need `ignored:` entries.
skills/development-workflow/references/advanced-patterns.md, line 237
1. **Configure credentials** — copy `.env.sample` to `.env` in the `e2e/` directory and fill in valid Falcon credentials (username, password, TOTP secret, base URL) and app name. `
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 74bc678c4748. requests shell access. The manifest names this permission. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach raw.githubusercontent.com. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 74bc678c474867c2bebe5afb5ccb3c54a665b8a2
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.