**REQUIRED for ALL LimaCharlie operations** - list orgs, sensors, rules, detections, queries, and 179 functions. NEVER call LimaCharlie MCP tools directly. Use cases: 'what orgs do I have', 'list sensors', 'search IOCs', 'run LCQL query', 'create detection rule'. This skill loads function docs and delegates to sub-agent.
View on GitHubrefractionPOINT/lc-ai
lc-essentials
January 23, 2026
Select agents to install to:
npx add-skill https://github.com/refractionPOINT/lc-ai/blob/main/marketplace/plugins/lc-essentials/skills/limacharlie-call/SKILL.md -a claude-code --skill limacharlie-callInstallation paths:
.claude/skills/limacharlie-call/# LimaCharlie API Operations
Perform any LimaCharlie operation by dynamically loading function references.
---
## LimaCharlie Integration
> **Prerequisites**: Run `/init-lc` to initialize LimaCharlie context.
### Critical Rules
| Rule | Wrong | Right |
|------|-------|-------|
| **MCP Access** | Call `mcp__*` directly | Use `limacharlie-api-executor` sub-agent |
| **LCQL Queries** | Write query syntax manually | Use `generate_lcql_query()` first |
| **D&R Rules** | Write YAML manually | Use `generate_dr_rule_*()` + `validate_dr_rule_components()` |
| **Timestamps** | Calculate epoch values | Use `date +%s` or `date -d '7 days ago' +%s` |
| **OID** | Use org name | Use UUID (call `list_user_orgs` if needed) |
---
## How to Use
**Critical**: Always load the relevant function file BEFORE calling it. Never assume you know how just from the name and description.
### Step 1: Check Function Documentation
Before calling any function, **read its documentation** to get correct parameter names:
```
Read ./functions/{function-name}.md
```
**Why this matters:** Parameter names are often prefixed (e.g., `secret_name` not `name`). Using wrong names causes silent failures. Function docs have warnings for commonly confused parameters.
### Step 2: Spawn the Executor
All API operations go through the `limacharlie-api-executor` sub-agent:
```
Task(
subagent_type="lc-essentials:limacharlie-api-executor",
model="sonnet",
prompt="Execute LimaCharlie API call:
- Function: <function-name>
- Parameters: {<params>}
- Return: RAW | <what data you need>
- Script path: {skill_base_directory}/../../scripts/analyze-lc-result.sh"
)
```
**Return field is REQUIRED:**
- `RAW` → Complete API response
- `<instructions>` → Extract specific data (e.g., "Count of sensors", "Only hostnames")
**Script path is REQUIRED:** The agent needs this path to handle large API results. Skills have access to `{skill_base_directory}` (shown at the top of this prompt), which resolves