v1.0.1

This patch release makes the plugin installable on claude.ai and Cowork, and renames the deployment skill so its command lines up with the others.

Fixed

• Installs on claude.ai and Cowork — helper scripts moved from bin/ to scripts/. A top-level bin/ directory is added to the CLI's PATH but isn't shown on the web admin approval surface, so those hosts rejected the plugin. The scripts are internal helpers, not entry points, and moving them out of bin/ clears the block. Command-line installs were never affected

Changed

• deploy skill renamed to deployment — it was the only imperative-verb name among six otherwise nominal skills, and it now matches its siblings (authoring, execution) and the foundry-skills convention. The command is /crowdstrike-falcon-fusion:deployment, and the picker no longer rewrites :deploy to :deployment on submit

Getting started

Install:

/plugin install crowdstrike-falcon-fusion

Already installed? Update to 1.0.1:

/plugin update crowdstrike-falcon-fusion

Full Changelog

v1.0.0...v1.0.1

v1.0.0

First public release of Falcon Fusion Skills — AI coding assistant skills for building CrowdStrike Falcon Fusion workflows. Tell your assistant what you want to automate in plain language, and it finds the real action IDs in your tenant, writes the workflow YAML, checks it against the platform schema, imports it to your CID, and runs it.

What's included

Six skills behind one entry point. The workflows orchestrator reads what you asked for and hands off to the right one: authoring for action discovery and YAML with schema validation, deployment for import and release, execution for triggering and monitoring runs, lookup-files for the Next-Gen SIEM lookups behind CQL match(), and setup for credentials (you type the secret into your own editor, not the chat).

The local validator is the part that saves you the most time. It catches the mistakes that usually fail at release or, worse, quietly return nothing: a bad action ID, a malformed reference, the wrong trigger shape, an Event Query reading data that isn't there. You hear about it in seconds instead of after a failed deploy.

There are also 25 working examples from the CrowdStrike Content Library and 15 use cases that map common asks — "enrich a detection," "close duplicate detections" — to the workflow that handles them. The examples import cleanly and open in the Falcon visual editor, so they double as references.

Editor and CLI support

Built and tested with Claude Code. There are setup notes for Codex, Copilot CLI, Cursor, and Antigravity CLI, but treat those as experimental — written from each tool's docs, not yet run end to end. The skills are plain markdown, so anything that reads local files can use them.

Getting started

/plugin marketplace add CrowdStrike/fusion-skills
/plugin install crowdstrike-falcon-fusion@fusion-marketplace

Then describe the workflow you want. The README covers credential setup and has a full example prompt.