Back to Skills

limacharlie-call

verified

**REQUIRED for ALL LimaCharlie operations** - list orgs, sensors, rules, detections, queries, and 179 functions. NEVER call LimaCharlie MCP tools directly. Use cases: 'what orgs do I have', 'list sensors', 'search IOCs', 'run LCQL query', 'create detection rule'. This skill loads function docs and delegates to sub-agent.

View on GitHub

Marketplace

lc-marketplace

refractionPOINT/lc-ai

Plugin

lc-essentials

Repository

refractionPOINT/lc-ai
5stars

marketplace/plugins/lc-essentials/skills/limacharlie-call/SKILL.md

Last Verified

January 23, 2026

Install Skill

Select agents to install to:

Scope:
npx add-skill https://github.com/refractionPOINT/lc-ai/blob/main/marketplace/plugins/lc-essentials/skills/limacharlie-call/SKILL.md -a claude-code --skill limacharlie-call

Installation paths:

Claude
.claude/skills/limacharlie-call/
Powered by add-skill CLI

Instructions

# LimaCharlie API Operations

Perform any LimaCharlie operation by dynamically loading function references.

---

## LimaCharlie Integration

> **Prerequisites**: Run `/init-lc` to initialize LimaCharlie context.

### Critical Rules

| Rule | Wrong | Right |
|------|-------|-------|
| **MCP Access** | Call `mcp__*` directly | Use `limacharlie-api-executor` sub-agent |
| **LCQL Queries** | Write query syntax manually | Use `generate_lcql_query()` first |
| **D&R Rules** | Write YAML manually | Use `generate_dr_rule_*()` + `validate_dr_rule_components()` |
| **Timestamps** | Calculate epoch values | Use `date +%s` or `date -d '7 days ago' +%s` |
| **OID** | Use org name | Use UUID (call `list_user_orgs` if needed) |

---

## How to Use

**Critical**: Always load the relevant function file BEFORE calling it. Never assume you know how just from the name and description.

### Step 1: Check Function Documentation

Before calling any function, **read its documentation** to get correct parameter names:
```
Read ./functions/{function-name}.md
```

**Why this matters:** Parameter names are often prefixed (e.g., `secret_name` not `name`). Using wrong names causes silent failures. Function docs have warnings for commonly confused parameters.

### Step 2: Spawn the Executor

All API operations go through the `limacharlie-api-executor` sub-agent:

```
Task(
  subagent_type="lc-essentials:limacharlie-api-executor",
  model="sonnet",
  prompt="Execute LimaCharlie API call:
    - Function: <function-name>
    - Parameters: {<params>}
    - Return: RAW | <what data you need>
    - Script path: {skill_base_directory}/../../scripts/analyze-lc-result.sh"
)
```

**Return field is REQUIRED:**
- `RAW` → Complete API response
- `<instructions>` → Extract specific data (e.g., "Count of sensors", "Only hostnames")

**Script path is REQUIRED:** The agent needs this path to handle large API results. Skills have access to `{skill_base_directory}` (shown at the top of this prompt), which resolves

Validation Details

Front Matter
Required Fields
Valid Name Format
Valid Description
Has Sections
Allowed Tools
Instruction Length:
17129 chars