Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CrowdStrike/foundry-skills --skill debugging-workflowsgit clone --depth 1 https://github.com/CrowdStrike/foundry-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/crowdstrike/foundry-skills/debugging-workflows)<a href="https://agentmods.dev/skills/crowdstrike/foundry-skills/debugging-workflows"><img src="https://agentmods.dev/badge/skills/crowdstrike/foundry-skills/debugging-workflows/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/crowdstrike/foundry-skills/debugging-workflows"><img src="https://agentmods.dev/badge/skills/crowdstrike/foundry-skills/debugging-workflows.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.04320 |
| Opus 5.5 | $0.00036 | $0.01728 |
| Sonnet 5.5 | $0.00018 | $0.00864 |
| Haiku 4.5 | $0.00009 | $0.00432 |
Grade B, and why
debugging-workflows scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST http://localhost:8081/api/process -d '{"key":"value"}' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST http://localhost:8081/api/process -d '{"key":"value"}' How it starts
The opening of the file, as written. The whole thing — 352 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Foundry Debugging Workflows
Systematic procedures for diagnosing and resolving common CrowdStrike Falcon Foundry development issues.
Part of a suite. If
development-workflowhas not already run, and this is a new app or its first capability, load thedevelopment-workflowskill first — it owns the CLI prerequisite check, scaffolding order, and manifest coordination.
Quick Diagnosis
What's happening?
CLI command hangs
├── In headless/CI environment → Missing --no-prompt or required flags (see Headless section)
└── In interactive terminal → Check network/auth with foundry profile active
Deploy fails
├── Validation error → Check manifest YAML syntax, then deploy again
├── "Unknown error" → Duplicate workflow name across apps in tenant
├── "no deployable artifacts found" → Diff is only manifest/logo/metadata; deploy needs an artifact change (function/collection/UI/agent). No --force; bundle it or put the logo in the first deploy
├── "Failed" with no reason in the CLI → Falcon console: App manager > app > "Show errors (N)" (per capability)
├── validate says "deployment is currently in progress" → A deploy is still running; poll list-deployments, then retry
└── Silent failure → Tenant may be missing required module (SKU) for requested scopes
foundry ui run fails
├── On new app → Deploy backend capabilities first (API integrations, functions, collections resolve from cloud)
├── Permission errors → Check manifest OAuth scopes, restart server, verify auth
└── Blank page / CORS error → noAttr() or base path removed from vite.config.js (see ui-development)
Function execution fails
├── Status 500 + "Server Error" → Check function logs: foundry functions logs <exec_id>
├── Status 202 + no result → Async execution: foundry functions exec status <exec_id>
├── 403 "app is not installed" → Deployed but not released + installed from App Catalog; FalconPy calls need an installed app
├── 401 on every FalconPy call, scopes correct → Client constructed at module scope; move it inside the handler
├── "authorization failed" → Confirm the CLI profile's API client has Apps read + write; if it does, it's a platform permission problem: report the trace ID, don't edit scopes
├── "artifact is not deployed" → Deploy first: foundry apps deploy --no-prompt
├── No logs available → Wait 5-10 min, then: foundry functions logs <exec_id> --refresh
│ └── Still "Log query failed" → Temporarily return the diagnostic values in the handler's response body, redeploy, exec once, then remove them
├── UI page: repeated 404s on /api2/faas-gateway/entities/execution/v1 in the browser console → foundry-js polling for the cloud-function result before it is ready; non-fatal if the data still loads, not a failure
└── Unexpected response → Read logs + source, correlate timestamps against handler code
Auth fails
├── 401/403 from API → Check OAuth scopes in manifest
├── Login hangs → Headless environment, no browser — use env vars or profile create --no-prompt
└── Works locally, fails in CI → Set FOUNDRY_API_CLIENT_ID env vars in CI config
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +2 lines a6f9723884a3
- 17d ago Changed 6fc704a7b8a1
- 25d ago Changed · +11 lines 80a6dabc7d8f
- 27d ago Changed 3eebe149cba0
- 1mo ago First seen · 339 lines · 90 tokens per session scan B 85a96dd26bf1
debugging-workflows is a skill published in the GitHub repository CrowdStrike/foundry-skills (35 stars, last pushed 2d ago), licensed MIT. It adds 90 tokens to every session and 4,320 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lastlight-debug
Debug a running Last Light instance over its admin API with the lastlight CLI — no SSH. Use when the user wants to "look at / debug a failed or stuck workflow", "why didn't the bot do X", "check a bad agent run / phase error on ", "tail a session", "search the logs", "read the server/docker logs", "list/trigger a…
doris-debug-deployment
Use for Doris FE/BE startup failures, port conflicts, prioritynetworks misrouting, metadir corruption, and ADD/DROP BACKEND issues.
dekko-verify
Sanity-check a suspiciously low or zero call-graph result from dekko (getcallers, getcallees, findusages, impactedtests, unused) before concluding "no callers" or "dead code," or a heritage/throws-provenance result (query supertypes, query subtypes, query throws) that labels something (external) when you expect it to…
dekko-debug
Work a stack trace, exception, or error report from dekko's map instead of reading each frame's file. Trigger when given a traceback, an exception type or message, a failing test's error, or a question like "why does X raise", "who handles this error", "how does control get from A to B", or "where is this env var…
dekko-refactor
List every site a rename, move, or signature change must touch before editing, then prove nothing was missed after. Trigger when about to rename a function, method, class or type, rename or move a file or module, change a parameter list or return type, move a symbol between files, or remove a symbol, in a repo with a…
repo-analyze
The map, not the contents. One call replaces the cold-start dance — file-tree exploration, finding entrypoints, reading every manifest, scanning README. Session mining showed 67 grep + 60 ls ops on a typical fresh-repo session, almost all of it answerable from one structured payload.