crowdstrike falcon fusion — Agent Skill

Falcon Fusion Skills

AI coding assistant skills for building CrowdStrike Falcon Fusion workflows. Go from a natural language prompt to a working Fusion workflow — discover real action IDs from the live API, author the YAML, validate it against the platform schema, import it to a CID, and trigger and monitor its execution.

fusion-skills is a community-driven, open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.

Getting Started

Prerequisites

• CrowdStrike Account with the Workflow API scope (plus NGSIEM Lookup Files for the lookup-files skill)
• AI Coding Assistant: Claude Code, Codex, Copilot CLI, Cursor, Antigravity CLI, or any tool that can read local reference documentation
• [jq](https://jqlang.org/) for the skill-routing hooks (without it, the hooks stay silent)

Install

| Assistant | Command | Marketplace | |-----------|---------|-------------| | Claude Code | /plugin install crowdstrike-falcon-fusion | Anthropic | | Codex | codex plugin add crowdstrike-falcon-fusion@openai-api-curated | OpenAI | | Copilot CLI | copilot plugin install CrowdStrike/fusion-skills | GitHub | | Cursor | /plugins (CLI) or /add-plugin crowdstrike-falcon-fusion (IDE) | Cursor | | Antigravity CLI | agy plugin install https://github.com/CrowdStrike/fusion-skills | Google |

[!NOTE] Codex has two install paths depending on how you signed in. The command above installs from the curated CLI marketplace, which API-key and Amazon Bedrock sessions load. If you authenticated Codex with a ChatGPT account, that marketplace isn't loaded — instead run /plugins inside Codex, search for crowdstrike, and install from the results.

In a live-tenant run, all five assistants (Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI) each authored a valid workflow from the example prompt below and imported it to the tenant.

These skills follow the Agent Plugins format, with a root plugin.json and a Codex .codex-plugin/plugin.json so the non-Claude assistants can discover them. See the blog post for a full walkthrough.

<details> <summary><strong>Install from a local clone</strong> (for development or testing a branch)</summary>

git clone https://github.com/CrowdStrike/fusion-skills.git

| Assistant | Command | |-----------|---------| | Claude Code | claude --plugin-dir /path/to/fusion-skills | | Copilot CLI | copilot --plugin-dir /path/to/fusion-skills | | Cursor | agent --plugin-dir /path/to/fusion-skills --trust | | Antigravity CLI | agy plugin install /path/to/fusion-skills |