CrowdStrike AgentWorks

agents

Manage Charlotte AI AgentWorks agent lifecycle. Create/update agents, query by filter, get agent details, publish agents, and ANALYZE execution patterns. **Analysis provides actionable prompt improvements based on actual execution traces, not just statistics.** Uses the native FalconPy `Agents` and `AgentVersions` classes. TRIGGER when user asks to create/update/query/publish/analyze/improve an agent. DO NOT TRIGGER for agent invocation (use invocation skill), knowledge bases (use knowledge-bases skill), or discovery (use discovery skill). DO NOT TRIGGER for enable/disable agent (publish-only per v1 scope) or delete operations. DO NOT TRIGGER for agents defined in a Falcon Foundry app (manifest.yml `ai.agents`, `foundry agents create`); foundry-redirect handles those.

agentworks

Orchestrator skill for Charlotte AI AgentWorks. Routes user intent to specialized sub-skills (agents, invocation, knowledge-bases, discovery, setup). Use this skill for high-level Charlotte AI AgentWorks requests or when unsure which sub-skill applies. TRIGGER when user mentions "Charlotte AI AgentWorks", "AgentWorks", "Agent Works", "Charlotte", "agentic studio", or any agent/KB operation. DO NOT TRIGGER for other CrowdStrike products (Fusion, Foundry, etc.). Agents or knowledge bases defined in a Falcon Foundry app (manifest.yml `ai.agents` / `ai.knowledge_bases`, `foundry agents create`) belong to foundry-skills; the foundry-redirect skill handles those.

discovery

Discover available models, tools, templates, agent versions, and trace spans in Charlotte AI AgentWorks. Read-only queries using native FalconPy classes (`Models`, `Tools`, `AgentTemplates`, `AgentVersions`, `Spans`). TRIGGER when user asks to list/query/discover models, tools, templates, versions, or spans. DO NOT TRIGGER for agent creation/invocation (use agents/invocation skills) or knowledge bases.

foundry-redirect

TRIGGER when the user asks for an AI agent or knowledge base that lives inside a Falcon Foundry app: mentions "Foundry app", manifest.yml, the `ai.agents` or `ai.knowledge_bases` manifest blocks, `foundry agents create`, `foundry knowledge-bases create`, or exposing a collection or API operation as an agent tool. DO NOT TRIGGER for an agent or knowledge base created and managed directly through the Falcon API (no app, no manifest.yml); the agents and knowledge-bases skills own those. This skill declines Foundry-app requests and points to the crowdstrike-falcon-foundry plugin, so the redirect works even without plugin hooks; it yields to the real Foundry plugin when that plugin is also installed.

invocation

Invoke Charlotte AI AgentWorks agents and manage invocations. Invoke published agents or specific versions, stream results, get messages, and cancel runs. Uses native FalconPy classes (`AgentInvocation`, `Stream`). TRIGGER when user asks to invoke an agent, run an agent, get agent results/messages, or cancel an invocation. DO NOT TRIGGER for agent creation (use agents skill), knowledge bases (use knowledge-bases skill), or discovery (use discovery skill).

knowledge-bases

Manage Charlotte AI AgentWorks knowledge bases. Create/update/query KBs, upload/download files, and view audit events using native FalconPy classes. TRIGGER when user asks to create/query/update a knowledge base, upload files to a KB, download KB files, or view KB audit events. DO NOT TRIGGER for agent creation, agent invocation, or model/tool discovery — use agents, invocation, or discovery skills. DO NOT TRIGGER for knowledge bases defined in a Falcon Foundry app (manifest.yml `ai.knowledge_bases`, `foundry knowledge-bases create`); foundry-redirect handles those.

setup

Configure credentials for Charlotte AI AgentWorks API access. Guides users through manual TOML configuration or environment variable setup. TRIGGER when user explicitly asks to "set up Charlotte AI AgentWorks", "configure credentials", or has auth errors. DO NOT TRIGGER for general Charlotte AI AgentWorks usage (orchestrator handles routing).