[mraible]

The CLI guard hook and test-skill.sh flagged manual app scaffolding with mkdir.*(api-integrations|workflows|...), matched against the whole command line. A chained command like mkdir -p /tmp/okta-spec && python3 skills/api-integrations/scripts/adapt_spec_for_foundry.py ... tripped it, so the hook gave a false "Manual creation of Foundry app structure" advisory and test-skill.sh counted an anti-pattern that didn't happen. That accounted for both anti-patterns in a recent A/B baseline. Both patterns now stop at ;, &, or |, so only the mkdir's own arguments count. test-hooks.sh adds a case for the chained false positive and one confirming cd my-app && mkdir -p workflows still gets the advisory.

A few skill files also called the foundry-sample repos "production" apps, and the workflows skill said its standard trigger + actions format is used by "all" of them. The samples show developers how to use each building block, so the wording now says "many Foundry sample apps" in workflows-development and "12 Foundry sample apps" in api-integrations.

[app-foundry-fusion-prodsec-142274]

Foundry Skills Eval Results

5/5 evals passed (100%) · model claude-opus-5-5 · commit 3a635a0

Eval	Result	Prompt
abuseipdb-block-workflow	✅	details Can you build a Foundry app that integrates with AbuseIPDB? I want an extension on the detection detail panel that shows the IP reputation score, and an on-demand workflow an analyst can trigger to block a malicious IP when they find one.
okta-api-full-app	✅	details Can you create a Falcon Foundry app for me that has an Okta API integration with openapi? Share its listusers endpoint with Falcon Fusion SOAR. Then, create a workflow that can be run on-demand to email or print the list of users. Finally, create a UI extension that calls the listusers endpoint and displays the results.
sailpoint-oauth-integration	✅	details We're rolling out SailPoint IdentityNow and I need a Foundry app that connects to their API using OAuth2 client credentials. Just need the list identities and get identity endpoints for now.
servicenow-app	✅	details We use ServiceNow for ticketing. Can you make me a Foundry app that integrates with their API so I can create and update incidents without leaving the Falcon console?
virustotal-app	✅	details Can you build me a Foundry app that connects to the VirusTotal API? I need to be able to look up IP addresses and file hashes from inside the Falcon console.

Suggested improvements (4)

• abuseipdb-block-workflow — The workflow never actually blocks traffic (the IOC is detect-only) and creates the IOC without checking the score; it should branch on abuseConfidenceScore and offer real network control, such as a Contain device action (bec9fbeb4999d207937854fd56088107) or a firewall-rule/perimeter API step, plus handle AbuseIPDB's 429 "already reported" response so the run doesn't fail.
• okta-api-full-app — The extension could follow Okta's after cursor to load more than the first 25 users, a limit the agent already told the user about.
• servicenow-app — In home.jsx, handleCreate and the search submit call setOffset(0) and then refresh() right away, so the stale callback fetches the old page and the offset effect fetches again (two requests that can race), and setting the active prop on SlTab may not switch Shoelace tabs; fix both by passing the offset to refresh directly and switching tabs with the tab group's show() method.
• virustotal-app — Remove the unrequested x-cs-operation-config workflow exposure, unless the user wants these operations in Fusion SOAR workflows, and consider fuller response schemas, for example a typed popular_threat_classification and last_analysis_results, so workflow outputs are more useful.

_{On-demand eval run. Re-runs update this comment in place.}