Update to CrowdStrike AgentWorks

{
  "description": "Manage Charlotte AI AgentWorks agent lifecycle. Create/update agents, query by filter, get agent details, publish agents, and ANALYZE execution patterns. **Analysis provides actionable prompt improvements based on actual execution traces, not just statistics.** Uses the native FalconPy `Agents` and `AgentVersions` classes. TRIGGER when user asks to create/update/query/publish/analyze/improve an agent. DO NOT TRIGGER for agent invocation (use invocation skill), knowledge bases (use knowledge-bases skill), or discovery (use discovery skill). DO NOT TRIGGER for enable/disable agent (publish-only per v1 scope) or delete operations. DO NOT TRIGGER for agents defined in a Falcon Foundry app (manifest.yml `ai.agents`, `foundry agents create`); foundry-redirect handles those.\n",
  "included_files": [
    {
      "relative_path": "references/api-reference.md",
      "size_in_bytes": 4273
    },
    {
      "relative_path": "references/fql-filters.md",
      "size_in_bytes": 5987
    },
    {
      "relative_path": "scripts/agent_get.py",
      "size_in_bytes": 2180
    },
    {
      "relative_path": "scripts/agent_list.py",
      "size_in_bytes": 7209
    },
    {
      "relative_path": "scripts/agent_publish.py",
      "size_in_bytes": 2513
    },
    {
      "relative_path": "scripts/agent_search.py",
      "size_in_bytes": 2789
    },
    {
      "relative_path": "scripts/agent_upsert.py",
      "size_in_bytes": 16629
    },
    {
      "relative_path": "scripts/analyze_agent.py",
      "size_in_bytes": 40322
    },
    {
      "relative_path": "scripts/compare_versions.py",
      "size_in_bytes": 7919
    }
  ],
  "name": "agents",
  "skill_md_contents": "---\nname: agents\ndescription: >\n  Manage Charlotte AI AgentWorks agent lifecycle.\n  Create/update agents, query by filter, get agent details, publish agents, and ANALYZE execution patterns.\n  **Analysis provides actionable prompt improvements based on actual execution traces, not just statistics.**\n  Uses the native FalconPy `Agents` and `AgentVersions` classes.\n  TRIGGER when user asks to create/update/query/publish/analyze/improve an agent.\n  DO NOT TRIGGER for agent invocation (use invocation skill), knowledge bases (use knowledge-bases skill),\n  or discovery (use discovery skill).\n  DO NOT TRIGGER for enable/disable agent (publish-only per v1 scope) or delete operations.\n  DO NOT TRIGGER for agents defined in a Falcon Foundry app (manifest.yml `ai.agents`, `foundry agents create`);\n  foundry-redirect handles those.\nversion: 1.0.1\nupdated: 2026-10-21\ntags: [agentworks, charlotte, agents, lifecycle, falcon, analysis, optimization]\nauthor: CrowdStrike\nlicense: MIT\ncompatibility: Claude Code >=1.0\nallowed-tools: Bash(cd *), Bash(../../scripts/python.sh:*)\nmetadata:\n  category: agent-management\n---\n\n# Agents Lifecycle & Analysis\n\n> **Read this first.**\n>\n> You are an AI assistant with expertise in Charlotte AI AgentWorks agent lifecycle management\n> and **execution trace analysis for prompt optimization**.\n> Your role is to help users create, update, query, get, publish, and **ANALYZE** agents\n> using the native FalconPy `Agents` and `AgentVersions` service classes.\n>\n> **IMMEDIATE ACTIONS REQUIRED:**\n> 1. Read this entire skill file before taking any action\n> 2. Verify credentials are configured (TOML profile or env vars)\n> 3. Only use the scripts documented below — never guess agent IDs or parameters\n> 4. Run scripts via `cd ${CLAUDE_PLUGIN_ROOT}/skills/agents && ../../scripts/python.sh scripts/<script>.py`\n> 5. Parse script output and present results clearly to the user\n> 6. **When user asks to improve/optimize an agent, ALWAYS run analyze_agent.py first**\n>\n> **MUST NOT:**\n> - Enable or disable agents (publish-only per v1 scope)\n> - Delete agents (delete operations excluded)\n> - Guess agent IDs — always query first\n> - Give generic advice — always analyze actual execution traces first\n\n## Running the scripts\n\nAll scripts must be invoked through the managed venv wrapper:\n\n```bash\ncd ${CLAUDE_PLUGIN_ROOT}/skills/agents\n../../scripts/python.sh scripts/<script_name>.py [args]\n```\n\n- **Claude Code**: `${CLAUDE_PLUGIN_ROOT}` is substituted with the plugin's install path before this text reaches the model. Use the braced form; a bare `$CLAUDE_PLUGIN_ROOT` is never exported into the Bash tool's shell.\n- **Other hosts (Codex, Copilot CLI, Cursor, Antigravity)**: these don't set `CLAUDE_PLUGIN_ROOT`. `cd` to the folder you loaded this SKILL.md from (e.g. `~/.agents/skills/agents`) and run `../../scripts/python.sh scripts/<script_name>.py [args]` from there.\n\nUses the native FalconPy `Agents` and `AgentVersions` service classes.\n\n## Prerequisites\n\n- **Credentials**: Same as knowledge-bases skill (TOML profile or env vars)\n- **API scopes**: `csrn:charlotte-ai:agent:definition` (read + write)\n- **Python 3.14+**: Auto-managed\n- **FalconPy 1.6.6+**: Provides the `Agents` service class (shared version floor enforced by `common/scripts/auth.py` across all skills, not just this one)\n\n## Core Workflows\n\n### 📋 Inspecting Agent Definitions Before Recommending\n\n**CRITICAL:** When evaluating agents from Claude Code's available agent types list (visible in system reminders) or from tool metadata, you MUST inspect the full agent definition before recommending or using it.\n\n#### ID Disambiguation - CRITICAL\n\n**Use `version_group_id`, NOT `agent_id` (or just `id`):**\n\n- **`version_group_id`** → The stable identifier across all versions of an agent → **USE THIS**\n- **`agent_id` or `id`** → A specific version instance → Using this will fail with \"failed to retrieve agent\"\n\n**Where to find `version_group_id`:**\n- In agent types list metadata: Look for `version_group_id` field\n- In tool discovery output: Listed as \"Version group:\" or `version_group_id`\n- In agent metadata: Extract from `version_group` or `version_group_id` field\n\n#### What Version You'll See - CRITICAL\n\nWhen you inspect an agent using `version_group_id`, `agent_get.py` returns:\n\n1. **Latest PUBLISHED version** (if one exists) ← Most common case\n2. **Latest version** (if no published version exists) ← Draft only\n\n**Important implications:**\n\n- **Modifying a published agent creates a DRAFT version** → The draft is NOT returned by `agent_get.py`\n- **Inspection shows production behavior** → You see what's actually running, not work-in-progress\n- **Draft changes are invisible until published** → If an agent was recently modified but not published, you won't see those changes\n\n**Example:**\n```\nPublished agent: v1 (system prompt: \"You are a security analyst...\")\n↓ User modifies agent\nDraft version: v2 (system prompt: \"You are an expert security analyst...\")\n↓ Inspect with agent_get.py\nResult: Shows v1 (published), NOT v2 (draft)\n↓ Publish v2\n↓ Inspect with agent_get.py\nResult: Shows v2 (now published)\n```\n\n**Example from tool discovery:**\n```\n• Vulnerability Response Agent\n  - ID: agents/0ad0ec8a-c49a-4784-9541-8c931aa0a365/...  ← DON'T USE THIS\n  - Version group: 4ff1fc7a-2181-405d-a6d7-95b549eb7a10    ← USE THIS\n```\n\n#### Workflow for Agent Inspection:\n\n1. **Extract `version_group_id`** (NOT `agent_id` or `id`) from the metadata\n2. **Get the complete definition**:\n   ```bash\n   cd ${CLAUDE_PLUGIN_ROOT}/skills/agents\n   ../../scripts/python.sh scripts/agent_get.py --ids <version_group_id>\n   ```\n3. **Inspect the full definition**:\n   - System prompt - does it match the task's needs?\n   - Tools - does it have the right capabilities?\n   - Model - is it appropriate for the complexity?\n   - Knowledge base IDs - does it have relevant context?\n4. **Only recommend/use** if the actual definition is a strong fit for the task\n\n**Why:** Agent names and brief descriptions can be misleading. A \"security-agent\" might be configured for compliance checks, not threat hunting. The system prompt and tool configuration reveal the true capabilities.\n\n**Example - Correct ID Usage:**\n```bash\n# Tool metadata shows:\n#   ID: agents/0ad0ec8a-c49a-4784-9541-8c931aa0a365/vulnerability_response_agent\n#   Version group: 4ff1fc7a-2181-405d-a6d7-95b549eb7a10\n\n# ❌ WRONG - Using agent_id:\n../../scripts/python.sh scripts/agent_get.py --ids 0ad0ec8a-c49a-4784-9541-8c931aa0a365\n# Result: \"failed to retrieve agent\"\n\n# ✅ CORRECT - Using version_group_id:\ncd ${CLAUDE_PLUGIN_ROOT}/skills/agents\n../../scripts/python.sh scripts/agent_get.py --ids 4ff1fc7a-2181-405d-a6d7-95b549eb7a10\n# Result: Full agent definition with system prompt, tools, model\n\n# Review output to confirm it has:\n# - System prompt mentioning the specific security domain (e.g., \"vulnerability triage\")\n# - Relevant tools (e.g., falcon_platform:get_vulnerabilities, not just generic tools)\n# - Appropriate model for the task complexity\n```\n\n### 🔍 Analyze Agent Execution (START HERE for optimization)\n\n**When to use:** User asks to \"improve\", \"optimize\", \"debug\", or \"analyze\" an agent.\n\n1. **Analyze execution patterns** → `analyze_agent.py --agent-id <uuid> --days 7 --verbose`\n   - Examines actual execution traces (not just statistics)\n   - Identifies tool usage patterns, error contexts, version changes\n   - Provides **actionable prompt improvements** with specific guidance\n   - Shows performance anomalies and root causes\n\n2. **Review recommendations** → Parse output for:\n   - 🔧 **Unused tools** → Remove or add usage guidance to prompt\n   - ⚠️ **Error-prone tools** → Add validation/error handling guidance\n   - ⏱️ **Slow tools** → Add timeout warnings or optimization hints\n   - 📊 **Common tool sequences** → Optimize prompt to guide workflows\n   - 💭 **Excessive LLM calls** → Make prompt more decisive\n   - 🔄 **Version changes** → Compare definitions to understand performance shifts\n\n3. **Deep-dive specific traces** → Use invocation IDs from analysis with `inspect_invocation.py` (invocation skill)\n\n4. **Apply improvements** → Update agent with `agent_upsert.py` using recommended prompt changes\n\n**Example output:**\n```\n💡 Recommendations\n1. 🔧 Unused tools: falcon_platform:get_host_details\n   Either remove OR add: 'When user asks about host details, use falcon_platform:get_host_details to...'\n\n2. ⚠️ Tool 'falcon_platform:search_hosts' has high error rate: 45%\n   Add validation: 'Before calling search_hosts, verify filter syntax...'\n\n3. 📊 Common tool patterns:\n    - search_hosts → get_host_details → format_response (12x)\n   Consider optimizing prompt to guide this workflow explicitly.\n```\n\n### Create/Update Agent\n\n**CRITICAL FOR UPDATES:** When updating an existing agent, preserve existing configuration unless explicitly instructed otherwise:\n1. **Get current agent details** → `agent_get.py --ids <agent-id>` → read current model, tools, model_config\n2. **Only modify what's requested** → Keep existing model, tools, model_config unless user specifically asks to change them or you have strong reasoning\n3. **Pass all fields to upsert** → Even unchanged fields must be included in the upsert call\n\n**Workflow:**\n\n1. **For updates: Read existing agent first** → `agent_get.py --ids <id>` → capture current config\n2. **Discover prerequisites only if changing tools/model**:\n   - `models_search.py --limit 50` (discovery skill) → capture a model ID if changing model\n   - `tools_get.py --search \"specific capability\"` (discovery skill) → capture tool IDs if changing tools\n   - If the tool family is known, filter it first with\n     `tools_get.py --category <category> --search \"specific capability\"`; see the discovery\n     skill's category guide. This avoids similarly named tools from unrelated providers.\n     - ⚠️ **Use specific search terms**: \"host search\", \"detection query\", \"vulnerability scan\", \"logscale\"\n     - ❌ **Avoid generic terms**: \"falcon\", \"crowdstrike\" (matches everything in Falcon platform, useless results)\n3. **Query agents by filter** (if you don't have agent ID) → `agent_search.py --filter \"active_version.name:~'topic'\"` (substring, case-insensitive) → returns agent IDs\n4. **Create or update agent** → `agent_upsert.py`:\n   - Create: omit `--id`, specify all required fields (returns agent ID + version ID)\n   - Update: include `--id <uuid>`, pass existing values for unchanged fields (creates new version, returns version ID)\n5. **PROPOSE test invocation before publishing** → Offer to test the new version:\n   - Use invocation skill: `invoke_version.py --agent-id <agent-id> --version-id <version-id> --message \"Test prompt\"`\n   - Note: Draft versions CAN be invoked via `invoke_version.py` (no publish required for testing)\n   - Poll for completion: `get_messages.py --id <invocation-id>`\n   - If issues found, return to step 4 to adjust\n6. **Publish agent** → `agent_publish.py --id <agent-uuid> --version-id <version-uuid>` → makes version the published default\n\nStop after each script; confirm with user before proceeding.\n\n## Script Reference\n\n| Script | Purpose | Key Flags |\n|--------|---------|-----------|\n| `agent_search.py` | Query agent IDs by FQL filter | `--filter \"active_version.name:~'term'\"` (substring), `--limit 100` |\n| `agent_get.py` | Get agent entities by IDs | `--ids <id> [id...]` |\n| `agent_list.py` | List agents as a table (Name/Description/Last modified/Last modified by/Created by/Status) | `--name-contains`, `--created-by`, `--modified-since`, `--modified-before`, `--status {published,unpublished}`, `--sort {name,updated_at}` (default `updated_at`), `--order {asc,desc}` (default `desc`), `--limit` |\n| `agent_upsert.py` | Create or update an agent | `--name`, `--model`, `--system-prompt`, `--tools`, `--knowledge-base-ids`, optional `--id` |\n| `agent_publish.py` | Publish agent (make invocable) | `--id <uuid>`, `--version-id <uuid>` |\n| `analyze_agent.py` | Analyze execution patterns & suggest improvements | `--agent-id <uuid>`, `--days 7`, `--verbose` |\n\nAll scripts support `--help` and `--json`.\n\n### Finding/listing agents by topic, name, date, or status\n\n**For a plain topic/name substring search**, use `agent_search.py` with the `:~` fuzzy operator —\none API call, works at any tenant size:\n\n```bash\n../../scripts/python.sh scripts/agent_search.py --filter \"active_version.name:~'root access'\"\n../../scripts/python.sh scripts/agent_search.py --filter \"active_version.description:~'privilege escalation'\"\n```\n\n**For combined criteria** (name substring + date range + publish status all at once), sorted\ntable output, or pagination — use `agent_list.py` instead, which pages through all agents and\nfilters/sorts client-side (slower on large tenants, but supports multiple simultaneous filters\nthat `agent_search.py`'s single `--filter` string doesn't conveniently combine):\n\n```bash\n../../scripts/python.sh scripts/agent_list.py --name-contains \"root access\"\n../../scripts/python.sh scripts/agent_list.py --modified-since 2026-09-01 --status published\n../../scripts/python.sh scripts/agent_list.py --limit 5  # most recently modified first (default sort)\n```\n\nSee `references/fql-filters.md` for the full confirmed filter/operator behavior — it has a\n\"History\" section on how the wrong conclusion got written into this doc twice before the `:~`\noperator was found; read it before trusting a new negative finding of your own.\n\n`--sort` only accepts `name` or `updated_at` — there is no `modified` value, even though the\nflag is about modification date; the sortable field is named `updated_at`. Since `updated_at desc`\nis already the default, \"most recent N agents\" needs only `--limit N`, no `--sort`/`--order`.\n\n**Always paste the resulting table directly into your chat response — do not just point at the\ntool output.** Script stdout is plain text to the harness; it is not markdown-rendered. Only text\nyou write directly in your own reply renders as an actual table for the user.\n\n**Pagination:** `agent_list.py` defaults to `--limit 20` and prints a trailer line after the table:\n`Showing 1-20 of 47 matching agent(s).` and, if more remain, `MORE_RESULTS_AVAILABLE\nnext_offset=20 remaining=27`. When you see that trailer, do NOT silently fetch/dump everything or\nsilently truncate — tell the user how many more there are and ask if they want the next page (e.g.\nvia AskUserQuestion or a plain question). If they say yes, re-run with `--offset <next_offset>`\n(same filters/sort) to get the next page.\n\n**Always paste the resulting table directly into your chat response — do not just point at the\ntool output.** Script stdout is plain text to the harness; it is not markdown-rendered. Only text\nyou write directly in your own reply renders as an actual table for the user.\n\n## Input/Output Format Types\n\nAgents support structured input validation and output formatting:\n\n### Input Formats\n- **`unstructured`** (default): Free-form text or JSON input, no schema validation\n- **`json_with_schema`**: JSON input validated against a JSON Schema\n\n### Output Formats\n- **`unstructured`** (default): Free-form text response\n- **`html`**: HTML-formatted response\n- **`markdown`**: Markdown-formatted response\n- **`json`**: JSON-formatted response (no schema enforcement)\n- **`json_with_schema`**: JSON response validated against a JSON Schema\n\n### Usage Examples\n\n**Add input validation:**\n```bash\n../../scripts/python.sh scripts/agent_upsert.py \\\n  --id <agent-id> \\\n  --input-format json_with_schema \\\n  --input-schema '{\n    \"type\": \"object\",\n    \"properties\": {\n      \"prompt\": {\"type\": \"string\", \"description\": \"User question\"},\n      \"severity\": {\"type\": \"string\", \"enum\": [\"low\", \"medium\", \"high\"]}\n    },\n    \"required\": [\"prompt\"]\n  }'\n```\n\n**Request structured JSON output:**\n```bash\n../../scripts/python.sh scripts/agent_upsert.py \\\n  --id <agent-id> \\\n  --output-format json_with_schema \\\n  --output-schema '{\n    \"type\": \"object\",\n    \"properties\": {\n      \"risk_score\": {\"type\": \"number\"},\n      \"recommendations\": {\"type\": \"array\", \"items\": {\"type\": \"string\"}}\n    },\n    \"required\": [\"risk_score\"]\n  }'\n```\n\n## Usage Examples\n\n### Query agents by name\n```bash\n../../scripts/python.sh scripts/agent_search.py --filter \"active_version.name:~'Security'\" --limit 10\n```\n\n### Get agent details\n```bash\n../../scripts/python.sh scripts/agent_get.py --ids <agent-id>\n```\n\n### Create a new agent\n```bash\n../../scripts/python.sh scripts/agent_upsert.py \\\n  --name \"Root Access Hunter\" \\\n  --description \"Detects unauthorized root access\" \\\n  --model bedrock.claude-4-6-sonnet \\\n  --system-prompt \"You are a security agent that analyzes root access patterns...\" \\\n  --tools <tool-id-1> <tool-id-2> \\\n  --knowledge-base-ids <kb-id>\n```\n\n### Update existing agent (creates new version)\n```bash\n# CRITICAL: Read current agent first to preserve existing config\n../../scripts/python.sh scripts/agent_get.py --ids <agent-id>\n# Note current: model, tools, model_config, knowledge_base_ids\n\n# Update ONLY the system prompt, keep everything else the same\n../../scripts/python.sh scripts/agent_upsert.py \\\n  --id <agent-id> \\\n  --system-prompt \"Updated prompt with better instructions...\" \\\n  --model <same-model-from-get> \\\n  --tools <same-tools-from-get> \\\n  --knowledge-base-ids <same-kbs-from-get>\n# Pass ALL fields even if unchanged - API requires complete definition\n```\n\n### Publish agent\n```bash\n../../scripts/python.sh scripts/agent_publish.py \\\n  --id <agent-id> \\\n  --version-id <version-id>\n```\n\n### Analyze agent performance (last 7 days)\n```bash\n../../scripts/python.sh scripts/analyze_agent.py \\\n  --agent-id <agent-id> \\\n  --days 7 \\\n  --verbose\n```\n\n**What the analysis provides:**\n\n1. **Version Detection** - Shows if agent definition changed\n2. **Tool Usage Patterns** - Actual execution sequences (e.g., \"search → get → format (12x)\")\n3. **Actionable Prompt Improvements** - Specific guidance with examples\n4. **Error Context** - Which tools fail and why\n5. **Performance Anomalies** - Version comparison with root cause\n6. **Missing Capabilities** - Suggests additional tools based on patterns\n\nSee \"Core Workflows → Analyze Agent Execution\" above for detailed examples.\n\n## Common Pitfalls / Counter-Rationalizations\n\n| Thought | Reality |\n|---------|---------|\n| \"The agent name tells me what it does\" | **Inspect first.** Names can be misleading. Get the full definition with `agent_get.py --ids <version_group_id>` to see the actual system prompt, tools, and capabilities before recommending. |\n| \"I'll use the agent ID from the tool metadata\" | **Use version_group_id instead.** The `agent_id` or `id` field refers to a specific version instance. Use `version_group_id` to retrieve the current definition. Using `agent_id` returns \"failed to retrieve agent\". |\n| \"I just modified the agent, so inspection will show my changes\" | **Modifications create drafts.** `agent_get.py` returns the latest **published** version, not draft versions. Your changes are invisible until you publish them with `agent_publish.py`. |\n| \"I'll guess the agent ID\" | **Query first.** Agent IDs are UUIDs; guessing fails. Use `agent_search.py`. |\n| \"I can update just the prompt\" | **Read agent first, pass all fields.** When updating, get current config with `agent_get.py`, then pass ALL fields (model, tools, model_config, etc) even if unchanged. Omitted fields may be lost. |\n| \"I'll give generic optimization advice\" | **Analyze first.** Run `analyze_agent.py` to get actionable insights from actual traces. Generic advice doesn't account for version changes, tool patterns, or error contexts. |\n| \"The agent is slow because of the model\" | **Check execution patterns.** Could be tool sequences, excessive LLM calls, or unused/misconfigured tools. Analysis shows root cause. |\n| \"I'll enable the agent after publishing\" | **Publish-only scope.** No enable/disable in v1. Publish = make invocable. |\n| \"I can delete an agent\" | **Delete excluded.** No DELETE operations per v1 design. Agents persist. |\n| \"Model ID is just the model name\" | **Model ID is a UUID.** Query models first with discovery skill, or user provides the UUID. |\n| \"agent_upsert returns only the agent ID\" | **It also returns the version ID.** The version ID is required for `agent_publish.py --version-id`. |\n| \"Publish just needs the agent ID\" | **Publish needs BOTH agent ID and version ID.** Use `PATCH` with `params={id}` and `body={version_id, is_published:true}`. |\n| \"I need to list invocations to analyze an agent\" | **Use spans APIs instead.** Query spans by `agent_id`, hydrate them, extract `invocation_id` from attributes. Use `analyze_agent.py`. |\n| \"I'll filter agent_search by name\" | **Top-level `name` doesn't work; `active_version.name:~'term'` does — use that.** `name:'...'` on `queries/agents/v2` silently matches nothing regardless of quoting/wildcard. The correct nested field is `active_version.name`, and the correct substring operator is `:~` (fuzzy, case-insensitive, matches anywhere) — NOT wildcard `*'...'` syntax, which also silently returns zero on this endpoint. `active_version.description:~'term'` works too. See `references/fql-filters.md` (which itself was wrong twice before this was nailed down — read the \"History\" section there before trusting a new negative finding). |\n| \"I'll pass multiple ids to agent_get as a comma-joined string\" | **Must be a real list param.** `params={\"ids\": \",\".join(ids)}` gets treated as one literal id and fails with \"failed to retrieve agent\". Use `params={\"ids\": ids}` (a list). See `references/api-reference.md`. |\n| \"I'll show the user a table by printing it from the script\" | **Tool stdout isn't markdown-rendered.** Paste the table into your own chat response text, or the user just sees raw pipe-delimited text. |\n| \"I'll pass `--sort modified` since the flag is about modification date\" | **`--sort` only accepts `name` or `updated_at`.** The sortable field is named `updated_at`, not `modified`, even though `--modified-since`/`--modified-before` exist as separate filter flags. Run `agent_list.py --help` if unsure, don't infer flag values from naming patterns. |\n| \"I'll write a severity/status/category enum from what sounds right\" | **Query the tenant's actual values first.** A rewritten system prompt or `--input-schema`/`--output-schema` that hardcodes an assumed enum (e.g. `\"enum\": [\"low\", \"medium\", \"high\"]`) can silently mismatch the tenant's real configured values, breaking the workflow it was meant to automate. Check real invocation inputs/outputs (e.g. via `analyze_agent.py`, or `inspect_invocation.py` on a known trace) or whatever source of truth the workflow already uses before encoding an enum. |\n\n## Reading Guide\n\n| Task | Reference Doc |\n|------|---------------|\n| API endpoints and parameters | `references/api-reference.md` |\n| FQL filter syntax | `references/fql-filters.md` |\n| OAuth 2.0 + scopes | `../setup/SKILL.md` |\n\n## FalconPy classes\n\nThis skill uses the native typed `Agents` class (`query_studio_agents`, `get_studio_agents`,\n`create_or_update_agent`, `update_agent`) and `AgentVersions`, via `auth.get_agents_client()` and\n`auth.call_native()`.\n\n"
}