SAIL Skill — Secure AI Lifecycle by Pillar Security

An agent skill that applies SAIL V2 — Pillar Security's Secure AI Lifecycle framework — to real systems. It bundles the full SAIL V2 risk catalog (91 risks across 7 lifecycle phases, each with mitigations and standards mappings) as reference files the agent reads on demand, so every answer is grounded in the actual catalog: real SAIL IDs, real mappings, no hallucinated controls.

This repository is also a Claude Code plugin marketplace — one-command install for Claude Code, prebuilt archives for everything else.

What it does

The skill triggers whenever you work on AI/agent security. It can:

• Assess an agent or system — full SAIL gap analysis with a component chart and all 91 risks dispositioned
• Build a security roadmap and maturity assessment
• Generate compliance checklists (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF, AIUC-1)
• Prioritize controls and produce cross-team alignment artifacts
• Create vendor RFPs (security-vendor coverage questionnaires or platform-vendor security questionnaires)
• Answer questions about SAIL — "What does SAIL 5.17 cover?" cites the catalog row

Example prompts (any harness — the skill triggers automatically):

• "We're deploying an autonomous support agent built on LangGraph with MCP servers for Zendesk and Postgres — do a security review I can share with our CISO."
• "Generate a security control checklist organized by EU AI Act articles."
• "Build me an AI security roadmap — we have agents in production but no AI policy yet."
• "Write the security section of an RFP for a managed agent platform."

In Claude Code you additionally get five entry points:

The /sail:* commands run immediately with smart defaults — no intake questions.

Installation

Pick your harness/software in the matrix, then follow its section below.

Slash commands are Claude Code-only. Everywhere else you get the full skill — it triggers automatically on AI/agent-security intent, and the guided intake replaces the commands.

🤖 AI agents: reading this README to install the skill yourself? Jump straight to § For agents.

For agents

If you are an AI agent reading this README to install the skill, follow these steps — no human input needed.

1. Locate the skill source. If you are inside a clone of this repo, the skill folder is sail/skills/sail/ (it contains SKILL.md and references/). If not, clone the repo first, or unzip dist/sail-skill.zip — it extracts to a top-level sail/ skill folder.
2. If your harness has a skill installer, prefer it:

# OpenAI Codex (in-session):
$skill-installer install https://github.com/pillar-security/sail-skill/tree/main/sail/skills/sail
# Google Antigravity (and 20+ other agents via Vercel's skills CLI):
npx skills add https://github.com/pillar-security/sail-skill/tree/main/sail/skills/sail -a antigravity -g -y
# pi:
pi install https://github.com/pillar-security/sail-skill

Otherwise, copy the skill folder to your harness's skills directory:

# Claude Code (or if unsure — most harnesses read this path):
mkdir -p ~/.claude/skills && cp -r sail/skills/sail ~/.claude/skills/sail

# Shared directory read by Codex, Antigravity, pi, and opencode:
mkdir -p ~/.agents/skills && cp -r sail/skills/sail ~/.agents/skills/sail

# opencode (native path):
mkdir -p ~/.config/opencode/skills && cp -r sail/skills/sail ~/.config/opencode/skills/sail

# Project-scoped variants: .claude/skills/ · .agents/skills/ · .opencode/skills/ at the repo root

3. Verify: the file <skills-dir>/sail/SKILL.md exists and its frontmatter name is sail. The skill loads in the next session — tell your user to restart/reload, then test with "What does SAIL 5.17 cover?" (expected: cites Maker-Identity Inheritance in Low-Code Agents).
4. Claude Code bonus: for the /sail:* commands, tell your user to run /plugin marketplace add pillar-security/sail-skill and /plugin install sail@pillar-security instead of (or in addition to) the copy — plugin slash commands can't be installed by copying files.
5. Sandboxed harnesses with no filesystem skills dir (Claude.ai, Cowork, ChatGPT): you cannot self-install; point your user to the matching section below and hand them dist/sail-skill.zip.

Claude Code

/plugin marketplace add pillar-security/sail-skill
/plugin install sail@pillar-security

Manual copy (no plugin system):

cp -r sail/skills/sail ~/.claude/skills/sail         # personal, all projects
cp -r sail/skills/sail <project>/.claude/skills/sail # per-project

Claude.ai / Desktop / Cowork

One skills system across claude.ai, the Claude Desktop app, and Cowork — install once, it syncs with your claude.ai account and works everywhere.

1. Enable Code execution under Settings → Capabilities (once).
2. Go to Customize → Skills → + → Upload a skill (in Cowork: Customize in the left sidebar → Skills).
3. Upload dist/sail-skill.zip. (If you use dist/sail.skill, rename it to .zip first — same archive.)
4. Claude applies the skill automatically; in Cowork you can also type / and pick sail. Test with "What does SAIL 5.17 cover?" — the answer should cite the catalog row. Team/Enterprise admins can share it org-wide (Organization settings → Skills).

OpenAI Codex CLI

Easiest — inside a Codex session, the built-in installer takes this repo's URL directly:

$skill-installer install https://github.com/pillar-security/sail-skill/tree/main/sail/skills/sail

Codex picks up new skills automatically (restart if it doesn't appear). Manual alternative — Codex discovers skills in ~/.agents/skills (personal) or .agents/skills (project):

mkdir -p ~/.agents/skills && cp -r sail/skills/sail ~/.agents/skills/sail

Invoke explicitly with $sail (type $ or /skills in the TUI) or just ask about AI/agent security and let the description trigger it.

Google Antigravity

Antigravity (IDE and CLI) reads SKILL.md skills from .agents/skills (workspace) and ~/.agents/skills (user). Google's codelabs endorse the skills CLI for installation:

npx skills add https://github.com/pillar-security/sail-skill/tree/main/sail/skills/sail -a antigravity -g -y

(Drop -g for a workspace-level install.) On older CLI builds that only read ~/.gemini/antigravity-cli/skills/, move or copy the installed sail/ folder there. Manual alternative: cp -r sail/skills/sail ~/.agents/skills/sail.

pi

The repo ships a pi package manifest, so it's a one-liner:

pi install https://github.com/pillar-security/sail-skill

pi also reads ~/.agents/skills, so a Codex or Antigravity install covers pi too (and vice versa via the shared directory).

ChatGPT

Skills are available on all ChatGPT plans at chatgpt.com/skills:

1. Open chatgpt.com/skills → New skill → Upload from your computer.
2. Upload dist/sail-skill.zip.
3. ChatGPT scans the upload and the skill becomes available; workspace admins (Business/Enterprise/Edu) can share it org-wide.

opencode

# per-project
mkdir -p <project>/.opencode/skills && cp -r sail/skills/sail <project>/.opencode/skills/sail
# global
mkdir -p ~/.config/opencode/skills && cp -r sail/skills/sail ~/.config/opencode/skills/sail

opencode also reads ~/.claude/skills and .agents/skills, so a Claude Code or Codex install covers it too.

Other SKILL.md-compatible agents

The skill is a plain folder — SKILL.md + references/ — following the open agent-skills format. Vercel's skills CLI installs it for 20+ agen