CrowdStrike Falcon Foundry

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

• Deploys and removes Falcon Foundry applications and workflows: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
• Deletes Foundry apps, agents, knowledge bases, collections and project artifacts: Can delete records, files, projects, messages, or resources that may be difficult to recover.
• Downloads arbitrary vendor OpenAPI specifications and exposes external APIs: Can send prompts, files, queries, or connected-service data to an external service.
• Creates RBAC roles and exposes security-response actions: Can create or change persistent records, files, projects, permissions, settings, or credentials.
• Builds and runs application code, tests, hooks and CLI helpers: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
• Foundry workflows can send email and other platform actions: Can send messages, comments, invitations, posts, or published content attributed to the connected user.