Do I need an existing LimaCharlie organization?

Yes, you must have a LimaCharlie account and select an organization. You can use the '/init-lc' command to initialize your context before deploying a sensor.

How do I remove the sensor after I am finished testing?

The skill provides a cleanup command using 'pkill' and 'rm' to stop the sensor process and delete the temporary directory where the binary was stored.

What operating systems are supported?

The skill supports Linux x64, Mac Intel (x64), and Mac Apple Silicon (arm64) architectures.

Does this skill require root access?

Yes, the LimaCharlie EDR sensor requires sudo or root privileges to monitor system-level events such as process creation, file modifications, and network activity.

LimaCharlie Test Sensor Deployment

Name: LimaCharlie Test Sensor Deployment
Author: refractionPOINT

byrefractionPOINT

•

Security & Testing

Deploys a temporary LimaCharlie EDR agent to local Linux or macOS environments for rapid security testing and detection rule validation.

About

This skill enables developers and security engineers to spin up a fully functional LimaCharlie EDR sensor in a controlled, temporary environment directly from Claude Code. It automates the entire lifecycle of a test sensor, including platform detection, installation key management, binary retrieval, and background execution. It is particularly useful for testing Detection & Response (D&R) rules, investigating sensor behavior, or debugging security integrations without committing to a permanent system installation.

Key Features

3 GitHub stars
Automated multi-platform deployment for Linux and macOS (Intel/Silicon)
Integrated LimaCharlie installation key creation and management
Live connectivity verification between the local sensor and LimaCharlie cloud
Non-blocking background execution using detached process patterns
Single-command cleanup for processes and temporary file directories

Use Cases

Validating Detection & Response (D&R) rules against live system telemetry
Investigating specific EDR event generation for security research or debugging
Rapid prototyping and testing of LimaCharlie API integrations in a sandbox

About

Key Features

3 GitHub stars
Automated multi-platform deployment for Linux and macOS (Intel/Silicon)
Integrated LimaCharlie installation key creation and management
Live connectivity verification between the local sensor and LimaCharlie cloud
Non-blocking background execution using detached process patterns
Single-command cleanup for processes and temporary file directories

Use Cases

Validating Detection & Response (D&R) rules against live system telemetry
Investigating specific EDR event generation for security research or debugging
Rapid prototyping and testing of LimaCharlie API integrations in a sandbox