CrowdStrikeCrowdStrike/foundry-skills/skills/app-audit/SKILL.md

app-audit

Skill35 starsChanged 3 days agoMITView on GitHub

Audit an existing Falcon Foundry app for documented anti-patterns and fix the safe ones, like npm audit. TRIGGER when user asks to "audit my Foundry app", "check my app for problems", "review this Foundry app", "scan for anti-patterns", "why might this deploy fail", or runs `audit_app.py`. DO NOT TRIGGER for creating a new app (use development-workflow) or for debugging an error the user already has (use debugging-workflows).

We split this skill into the rules it gives an agent

7 rules. About 0 are common, 0 are distinctive, and 7 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
7
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Very specific:
Run the bundled script against the app directory (the one with manifest.yml).
line 16
Very specific:
Undeclared request properties: add each property to the handler's request_schema.json, then redeploy.
line 53
Very specific:
Missing response keys: add the key to response_schema.json, or fix the workflow's data path if the key is misspelled.
line 54
Very specific:
Too many functions: follow the functions-development skill's references/function-count-and-build-time.md.
line 55
Very specific:
Server URLs and defaults: run the api-integrations skill's spec adapter on the spec rather than editing it by hand.
line 56
Very specific:
UI builds: run npm run build in each page or extension directory, then return to the app root.
line 57
Very specific:
Run the audit again after fixing, and run foundry apps validate --no-prompt before deploying.
line 59

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Auditing a Foundry App

Run the bundled script against the app directory (the one with manifest.yml). It reads the manifest and the files it points to, calls no API, and needs only pyyaml:

python3 skills/app-audit/scripts/audit_app.py path/to/app          # report
python3 skills/app-audit/scripts/audit_app.py path/to/app --json   # machine-readable
python3 skills/app-audit/scripts/audit_app.py path/to/app --fix    # apply the safe fixes, then report

It exits 1 when an error-level finding remains. Each finding names the skill and section that explains it; read that section before changing anything.

What It Checks

Check	Severity	Why
`function-count`	warn	More than 20 functions. Each is a separate container build, and a fresh install with 43 failed where the same handlers in 11 functions deployed.
`handler-name-length`	error	Handler names must be 5 to 64 characters (the CLI's own limits).
`handler-name-duplicate`	error	Handler names must be unique within a function.
`request-property-undeclared`	error	A workflow passes a property the function's `request_schema` doesn't declare, so it's silently dropped.
`response-key-missing`	warn	A workflow reads a `FaaS` output key the handler's `response_schema` doesn't declare.
`unknown-function-action`	error	A workflow calls `functions.<name>.<handler>` that isn't in the manifest.
`missing-workflow-integration`	error	A workflow calls a handler that has no `workflow_integration`, so deploy fails.
`provision-on-install-missing`	warn, fixable	Installing won't create the workflow. Leave it off only when the app provisions the workflow itself through the Workflows API, as rapid-response and scalable-rtr do.
`provision-on-install-false`	info	Fine when deliberate.
`pycache-not-ignored`	warn, fixable	A local `__pycache__/` would deploy. The CLI already skips hidden paths like `.venv/`.
`secret-in-env`	warn	A function reads a key, token, secret, or password from an environment variable, which is visible in app exports.
`server-url-protocol`	error	An OpenAPI server URL with variables starts with `https://` or `http://`, so the protocol doubles.
`server-variable-default`	warn	A server variable has a `default` but no `enum`, which renders as a one-value dropdown.
`ui-not-built`	error	A page or extension has no `dist/`; deploy never builds the UI.
`ui-stale-build`	warn	`src/` is newer than `dist/`, so deploy would ship the previous build.
`invalid-file`	error	`manifest.yml`, a workflow, or an API spec it points to doesn't parse, so the checks that read it were skipped.

Fixing Findings

--fix applies only the fixes marked fixable: it adds the __pycache__ pattern to ignored: and provision_on_install: true to workflows that lack it. Both are single-line insertions that leave the rest of the file as written. Tell the user what --fix will change before running it, and show the diff afterward.

Everything else needs judgment, so handle it with the user:

Undeclared request properties: add each property to the handler's request_schema.json, then redeploy. If the handler has no schema, the function needs one bound at create time (see the functions-development skill → Function I/O Schemas).
Missing response keys: add the key to response_schema.json, or fix the workflow's data path if the key is misspelled.
Too many functions: follow the functions-development skill's references/function-count-and-build-time.md; consolidating changes workflow wiring and needs its checklist.
Server URLs and defaults: run the api-integrations skill's spec adapter on the spec rather than editing it by hand.
UI builds: run npm run build in each page or extension directory, then return to the app root.

Run the audit again after fixing, and run foundry apps validate --no-prompt before deploying. The audit complements validation and doesn't replace it.

Reading Results

The checks are static, so treat a finding as a strong lead, not proof. A warning can be deliberate (a large app may need many functions, and an app that provisions its own workflows skips provision_on_install). If a finding looks wrong for the app in front of you, say why instead of forcing a fix.

Download now (ZIP)

Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 1
apourmd941/selran-devloop★ 0same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository16 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- ai-agents-developmentSkill
- api-integrationsSkill
- app-upgradesSkill
- collections-developmentSkill
- debugging-workflowsSkill
- development-workflowSkill
- e2e-testingSkill
- functions-developmentSkill
- functions-falcon-apiSkill
- fusion-redirectSkill
- security-patternsSkill
- ui-developmentSkill
- workflows-developmentSkill

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free