CrowdStrike · mraible · Jul 31, 2026 · Jul 31, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -9,7 +9,7 @@
       "name": "crowdstrike-falcon-foundry",
       "source": "./",
       "description": "CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.",
-      "version": "1.3.0",
+      "version": "1.4.0",
       "author": {
         "name": "CrowdStrike"
       },

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "crowdstrike-falcon-foundry",
   "description": "CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows. Swagger 2.0 specs are auto-converted to OpenAPI 3.0 via npx swagger2openapi (requires Node.js; network call to npm registry).",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "author": {
     "name": "CrowdStrike"
   },

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [1.4.0] - TBD
+## [1.4.0] - 2026-07-31
 
 ### Added
 

diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 
 # Falcon Foundry Skills
 
-![Version](https://img.shields.io/badge/version-1.3.0-blue)
+![Version](https://img.shields.io/badge/version-1.4.0-blue)
 [![CI](https://github.com/CrowdStrike/foundry-skills/actions/workflows/main.yml/badge.svg)](https://github.com/CrowdStrike/foundry-skills/actions/workflows/main.yml)
 
 AI coding assistant skills for building [CrowdStrike Falcon Foundry](https://www.crowdstrike.com/en-us/platform/next-gen-siem/falcon-foundry/) apps. Build Foundry apps from a natural language prompt — API integrations, workflows, UI pages, functions, and collections — all scaffolded with the Foundry CLI and deployed to the Falcon console.

diff --git a/skills/api-integrations/SKILL.md b/skills/api-integrations/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: api-integrations
 description: Expose external APIs to Falcon Foundry via OpenAPI specs. TRIGGER when user asks to "create an API integration", "adapt an OpenAPI spec for Foundry", "expose an API to workflows", "connect to a third-party API", or runs `foundry api-integrations create`. Also trigger when user has an OpenAPI/Swagger spec and wants it working in Falcon Foundry. DO NOT TRIGGER when user wants to call Falcon platform APIs from function code — use functions-falcon-api instead.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, openapi, api, workflows]
 author: CrowdStrike
 license: MIT

diff --git a/skills/collections-development/SKILL.md b/skills/collections-development/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: collections-development
 description: Design JSON Schema collections and CRUD patterns for Falcon Foundry apps. TRIGGER when user asks to "create a collection", "define a JSON schema", "store data in Foundry", runs `foundry collections create`, or needs help with indexable fields, FQL queries, or collection access patterns. DO NOT TRIGGER for workflow YAML, function handlers, or UI components — use the appropriate sub-skill.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, collections, json-schema, nosql]
 author: CrowdStrike
 license: MIT

diff --git a/skills/debugging-workflows/SKILL.md b/skills/debugging-workflows/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: debugging-workflows
 description: Systematic troubleshooting for Falcon Foundry CLI errors, manifest validation failures, deploy failures, and development server issues. TRIGGER when user encounters CLI errors, `foundry ui run` not working, deploy failures, authentication issues, or any unexpected behavior during Foundry app development. Also trigger for headless/CI environment setup failures.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, debugging, cli, deployment]
 author: CrowdStrike
 license: MIT

diff --git a/skills/development-workflow/SKILL.md b/skills/development-workflow/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: development-workflow
 description: Orchestrates the complete Falcon Foundry app lifecycle from requirements through deployment. TRIGGER when user asks to "create a Foundry app", "build a Foundry app", "plan a Foundry app", runs any `foundry apps` CLI command, or discusses Foundry app architecture. DO NOT TRIGGER when user is working on a specific capability (UI, function, workflow, collection) within an existing app — use the appropriate sub-skill instead. This skill OWNS the entire Foundry development flow. Do not delegate Foundry app creation to superpowers:brainstorming or superpowers:writing-plans — those skills do not know about the Foundry CLI.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, lifecycle, cli, deployment]
 author: CrowdStrike
 license: MIT

diff --git a/skills/e2e-testing/SKILL.md b/skills/e2e-testing/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: e2e-testing
 description: End-to-end testing for Falcon Foundry apps using Playwright and @crowdstrike/foundry-playwright. TRIGGER when user asks to "add e2e tests", "add playwright tests", "write end-to-end tests", "test my app", or mentions "e2e", "playwright", or "end-to-end" in the context of testing a Foundry app. DO NOT TRIGGER during normal app creation, UI development, or function development. This skill is opt-in; not all apps need e2e tests.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, e2e, playwright, testing]
 author: CrowdStrike
 license: MIT

diff --git a/skills/functions-development/SKILL.md b/skills/functions-development/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: functions-development
 description: Build serverless Go or Python functions for Falcon Foundry apps. TRIGGER when user asks to "create a function", "write a serverless function", "build backend logic", runs `foundry functions create`, or needs help with FDK handler patterns, function testing, or collection integration from functions. DO NOT TRIGGER for calling Falcon platform APIs from functions — use functions-falcon-api instead. DO NOT TRIGGER for workflow YAML or UI components.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, functions, serverless, python, go]
 author: CrowdStrike
 license: MIT

diff --git a/skills/functions-falcon-api/SKILL.md b/skills/functions-falcon-api/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: functions-falcon-api
 description: Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, functions, falcon-api, falconpy, gofalcon]
 author: CrowdStrike
 license: MIT

diff --git a/skills/security-patterns/SKILL.md b/skills/security-patterns/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: security-patterns
 description: Security patterns for Falcon Foundry apps including OAuth scopes, RBAC, input validation, UI security, and credential management. TRIGGER when user asks to "configure OAuth scopes", "secure a Foundry app", "handle secrets", "add input validation", or needs to review a Foundry app for security concerns (XSS, CSP, credential management). Also trigger during pre-deployment security reviews.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, oauth, rbac, xss, csp]
 author: CrowdStrike
 license: MIT

diff --git a/skills/ui-development/SKILL.md b/skills/ui-development/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: ui-development
 description: Build UI pages and extensions for Falcon Foundry apps using React or Vue with the Shoelace design system and Foundry-JS. TRIGGER when user asks to "create a UI page", "build a UI extension", "add a Shoelace component", "call an API from the UI", runs `foundry ui pages create` or `foundry ui run`, or needs help with Vite config, Foundry-JS, or Falcon console theming. DO NOT TRIGGER for backend functions, workflow YAML, or collection schemas.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, ui, react, vue, shoelace]
 author: CrowdStrike
 license: MIT

diff --git a/skills/workflows-development/SKILL.md b/skills/workflows-development/SKILL.md
@@ -1,8 +1,8 @@
 ---
 name: workflows-development
 description: Create and configure Falcon Fusion SOAR workflow YAML for Falcon Foundry apps. TRIGGER when user asks to "create a workflow", "build an automation", "configure Fusion SOAR", "add an on-demand workflow", runs `foundry workflows create`, or needs help with Fusion YAML syntax, triggers, actions, or variable references. DO NOT TRIGGER for UI pages, functions, or collection schemas — use the appropriate sub-skill.
-version: 1.3.0
-updated: 2026-06-11
+version: 1.4.0
+updated: 2026-07-31
 tags: [foundry, workflows, fusion-soar, yaml]
 author: CrowdStrike
 license: MIT