skills.rest
kyle9021
kyle9021COMMUNITY
Explore all skills by this author →
GitHub

skill-template

Guides creation of new Falcon security investigation skills with structured SKILL.md playbooks.

3|1|Updated Sep 1, 2026
Search Tags:#playbook#skill authoring#runbook#falcon#crowdstrike#security investigation#fql
One-click install
npx skills add https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp --skill skill-template-kyle9021
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-template
Source: https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp/tree/main/.claude/skills/skill-template
Command: npx skills add https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp --skill skill-template-kyle9021

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Recurring security investigations done by hand are hard to repeat consistently. This meta-skill turns a repeatable investigation workflow into a reusable SKILL.md playbook with proper frontmatter, FQL queries, safety boundaries, and evidence provenance so the same method runs reliably every time. ## Core Features & Use Cases - Skill authoring guidance: Defines the four traits that make an investigation worth codifying and explains how to write discovery-friendly frontmatter descriptions. - Structure and safety templates: Provides a proven SKILL.md body structure covering context discipline, step-by-step pivots, explicit safety boundaries, and data handling rules. - Evidence and provenance rules: Enforces recording every query, zero-result queries, failures, and verbatim pivot evidence so findings remain auditable. - Use Case: A security analyst who repeatedly traces CVE exposure across cloud assets uses this skill to codify that workflow into a new /cve-exposure-sweep skill with tested FQL and a defined output shape. ## Quick Start Ask the AI to help you write a new skill that codifies your recurring investigation workflow into a reusable SKILL.md playbook.

Frequently Asked Questions about skill-template

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a new skill for Falcon security investigations?▼

Create a directory under .claude/skills/ with a SKILL.md file containing YAML frontmatter with name and description, followed by a body with step-by-step investigation instructions, tested FQL filters, safety boundaries, and evidence provenance rules.

What makes an investigation worth codifying into a skill?▼

A good candidate has been done more than twice, is multi-step, has stable steps with varying inputs, and involves judgement between steps. Purely mechanical tasks should become deterministic scripts instead of skills.

Why is the skill description field so important?▼

The description is the only part of the skill the model sees before deciding whether to invoke it. It must state what the skill does, when to use it, and include the exact phrasing operators would type, or the skill will never be triggered.

When should I write a script instead of a skill?▼

Write a script when the task is purely mechanical with no judgement required between steps. Scripts are faster, cheaper, and deterministic, while skills are reserved for work needing interpretation between steps.

How do I test a new skill before trusting it?▼

Run four passes: the happy path for correct output shape, the empty path to confirm it reports not found instead of inventing answers, the wrong path to check it declines out-of-scope requests, and the provenance path to trace any number back to a recorded query.

Related Skills

Explore More Software Engineering Skills→
lc0rplc0rp

session-close-instruction-review

Review chat sessions to identify durable instructions for AGENTS.md or new Skill units.

Community
Intermediate
stakworkstakwork
109

investigation-add

Process new investigation evidence against documented pull criteria and update records.

Official
Intermediate
talesofaitalesofai
1

bing-image-search

Extract and validate direct image URLs from Bing image search results.

Official
Advanced
pikakitpikakit

execution-reporter

Render task routing, loaded skills, and execution context at task start.

Community
Advanced