[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92360":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":10,"languages":10,"totalLinesOfCode":10,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":30,"readmeContent":31,"aiSummary":32,"trendingCount":15,"starSnapshotCount":15,"syncStatus":12,"lastSyncTime":33,"discoverSource":34},92360,"sail-skill","pillar-labs\u002Fsail-skill","pillar-labs","SAIL V2 (Secure AI Lifecycle) as an agent skill — the full 91-risk catalog for AI\u002Fagent gap assessments, security roadmaps, and compliance checklists. Installs on Claude Code, Codex, ChatGPT, Antigravity, and any SKILL.md-compatible agent.","https:\u002F\u002Fwww.pillar.security\u002Fsail",null,140,2,116,1,0,24,43.83,"Other",false,"main",[22,23,24,25,26,27,28,29],"agent-skills","agentic-ai","ai-security","claude-code","claude-code-plugin","compliance","llm-security","security-framework","2026-07-22 04:02:05","\u003Cp align=\"center\">\n  \u003Cpicture>\n    \u003Csource media=\"(prefers-color-scheme: dark)\" srcset=\"assets\u002Fsail-logo-dark.png\">\n    \u003Cimg src=\"assets\u002Fsail-logo-light.png\" alt=\"SAIL — Secure AI Lifecycle\" width=\"346\">\n  \u003C\u002Fpicture>\n\u003C\u002Fp>\n\n# SAIL Skill — Secure AI Lifecycle by Pillar Security\n\nAn agent skill that applies **SAIL V2** — [Pillar Security](https:\u002F\u002Fwww.pillar.security)'s Secure AI Lifecycle framework — to real systems. It bundles the full SAIL V2 risk catalog (**91 risks across 7 lifecycle phases**, each with mitigations and standards mappings) as reference files the agent reads on demand, so every answer is grounded in the actual catalog: real SAIL IDs, real mappings, no hallucinated controls.\n\nThis repository is also a **Claude Code plugin marketplace** — one-command install for Claude Code, prebuilt archives for everything else.\n\n## What it does\n\nThe skill triggers whenever you work on AI\u002Fagent security. It can:\n\n- **Assess an agent or system** — full SAIL gap analysis with a component chart and all 91 risks dispositioned\n- **Build a security roadmap** and **maturity assessment**\n- **Generate compliance checklists** (ISO\u002FIEC 42001, EU AI Act, OWASP LLM\u002FAgentic, DASF, AIUC-1)\n- **Prioritize controls** and produce **cross-team alignment artifacts**\n- **Create vendor RFPs** (security-vendor coverage questionnaires or platform-vendor security questionnaires)\n- **Answer questions about SAIL** — \"What does SAIL 5.17 cover?\" cites the catalog row\n\nExample prompts (any harness — the skill triggers automatically):\n\n- *\"We're deploying an autonomous support agent built on LangGraph with MCP servers for Zendesk and Postgres — do a security review I can share with our CISO.\"*\n- *\"Generate a security control checklist organized by EU AI Act articles.\"*\n- *\"Build me an AI security roadmap — we have agents in production but no AI policy yet.\"*\n- *\"Write the security section of an RFP for a managed agent platform.\"*\n\nIn **Claude Code** you additionally get five entry points:\n\n| Command | What it does |\n| :-- | :-- |\n| `\u002Fsail` | Interactive launcher — guided intake, picks the right workflow |\n| `\u002Fsail:assess [path]` | Full gap analysis of the agent in the current repo (or `path`) — all 91 risks dispositioned, written to `SAIL-assessment.md` |\n| `\u002Fsail:roadmap [hints]` | 7-phase security roadmap + per-phase maturity profile |\n| `\u002Fsail:comply [frameworks]` | Compliance checklist — all five frameworks, or just those named (`eu-ai-act`, `iso-42001`, `owasp`, `dasf`, `aiuc-1`) |\n| `\u002Fsail:rfp [security\\|platform] [vendor]` | Vendor RFP questionnaire — security-vendor coverage by default |\n\nThe `\u002Fsail:*` commands run immediately with smart defaults — no intake questions.\n\n## Installation\n\nPick your harness\u002Fsoftware in the matrix, then follow its section below.\n\n| Harness \u002F software | Install | Details |\n| :-- | :-- | :-- |\n| **Claude Code** (CLI \u002F IDE \u002F desktop) | `\u002Fplugin marketplace add pillar-labs\u002Fsail-skill`\u003Cbr>`\u002Fplugin install sail@pillar-security` | [§ Claude Code](#claude-code) |\n| **Claude.ai \u002F Desktop \u002F Cowork** | **Customize → Skills** → upload `dist\u002Fsail-skill.zip` | [§ Claude.ai \u002F Desktop \u002F Cowork](#claudeai--desktop--cowork) |\n| **OpenAI Codex CLI** | `$skill-installer install https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail` | [§ OpenAI Codex CLI](#openai-codex-cli) |\n| **Google Antigravity** (IDE \u002F CLI) | `npx skills add https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail -a antigravity -g -y` | [§ Google Antigravity](#google-antigravity) |\n| **pi** | `pi install https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill` | [§ pi](#pi) |\n| **ChatGPT** (all plans) | [chatgpt.com\u002Fskills](https:\u002F\u002Fchatgpt.com\u002Fskills) → **New skill** → upload `dist\u002Fsail-skill.zip` | [§ ChatGPT](#chatgpt) |\n| **opencode** | `cp -r sail\u002Fskills\u002Fsail ~\u002F.config\u002Fopencode\u002Fskills\u002Fsail` | [§ opencode](#opencode) |\n| **Other SKILL.md-compatible agents** | `npx skills add https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail -g -y` | [§ Other agents](#other-skillmd-compatible-agents) |\n\n> **Slash commands are Claude Code-only.** Everywhere else you get the full skill — it triggers automatically on AI\u002Fagent-security intent, and the guided intake replaces the commands.\n>\n> 🤖 **AI agents:** reading this README to install the skill yourself? Jump straight to [§ For agents](#for-agents).\n\n### For agents\n\n> **If you are an AI agent reading this README to install the skill, follow these steps — no human input needed.**\n>\n> 1. **Locate the skill source.** If you are inside a clone of this repo, the skill folder is `sail\u002Fskills\u002Fsail\u002F` (it contains `SKILL.md` and `references\u002F`). If not, clone the repo first, or unzip `dist\u002Fsail-skill.zip` — it extracts to a top-level `sail\u002F` skill folder.\n> 2. **If your harness has a skill installer, prefer it:**\n>\n> ```\n> # OpenAI Codex (in-session):\n> $skill-installer install https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail\n> # Google Antigravity (and 20+ other agents via Vercel's skills CLI):\n> npx skills add https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail -a antigravity -g -y\n> # pi:\n> pi install https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\n> ```\n>\n>    **Otherwise, copy the skill folder to your harness's skills directory:**\n>\n> ```bash\n> # Claude Code (or if unsure — most harnesses read this path):\n> mkdir -p ~\u002F.claude\u002Fskills && cp -r sail\u002Fskills\u002Fsail ~\u002F.claude\u002Fskills\u002Fsail\n>\n> # Shared directory read by Codex, Antigravity, pi, and opencode:\n> mkdir -p ~\u002F.agents\u002Fskills && cp -r sail\u002Fskills\u002Fsail ~\u002F.agents\u002Fskills\u002Fsail\n>\n> # opencode (native path):\n> mkdir -p ~\u002F.config\u002Fopencode\u002Fskills && cp -r sail\u002Fskills\u002Fsail ~\u002F.config\u002Fopencode\u002Fskills\u002Fsail\n>\n> # Project-scoped variants: .claude\u002Fskills\u002F · .agents\u002Fskills\u002F · .opencode\u002Fskills\u002F at the repo root\n> ```\n>\n> 3. **Verify:** the file `\u003Cskills-dir>\u002Fsail\u002FSKILL.md` exists and its frontmatter `name` is `sail`. The skill loads in the **next session** — tell your user to restart\u002Freload, then test with *\"What does SAIL 5.17 cover?\"* (expected: cites *Maker-Identity Inheritance in Low-Code Agents*).\n> 4. **Claude Code bonus:** for the `\u002Fsail:*` commands, tell your user to run `\u002Fplugin marketplace add pillar-labs\u002Fsail-skill` and `\u002Fplugin install sail@pillar-security` instead of (or in addition to) the copy — plugin slash commands can't be installed by copying files.\n> 5. **Sandboxed harnesses with no filesystem skills dir** (Claude.ai, Cowork, ChatGPT): you cannot self-install; point your user to the matching section below and hand them `dist\u002Fsail-skill.zip`.\n\n### Claude Code\n\n```\n\u002Fplugin marketplace add pillar-labs\u002Fsail-skill\n\u002Fplugin install sail@pillar-security\n```\n\n\nManual copy (no plugin system):\n\n```bash\ncp -r sail\u002Fskills\u002Fsail ~\u002F.claude\u002Fskills\u002Fsail         # personal, all projects\ncp -r sail\u002Fskills\u002Fsail \u003Cproject>\u002F.claude\u002Fskills\u002Fsail # per-project\n```\n\n### Claude.ai \u002F Desktop \u002F Cowork\n\nOne skills system across claude.ai, the Claude Desktop app, and Cowork — install once, it syncs with your claude.ai account and works everywhere.\n\n1. Enable **Code execution** under **Settings → Capabilities** (once).\n2. Go to **Customize → Skills → + → Upload a skill** (in Cowork: **Customize** in the left sidebar → **Skills**).\n3. Upload `dist\u002Fsail-skill.zip`. (If you use `dist\u002Fsail.skill`, rename it to `.zip` first — same archive.)\n4. Claude applies the skill automatically; in Cowork you can also type `\u002F` and pick **sail**. Test with *\"What does SAIL 5.17 cover?\"* — the answer should cite the catalog row. Team\u002FEnterprise admins can share it org-wide (Organization settings → Skills).\n\n### OpenAI Codex CLI\n\nEasiest — inside a Codex session, the built-in installer takes this repo's URL directly:\n\n```\n$skill-installer install https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail\n```\n\nCodex picks up new skills automatically (restart if it doesn't appear). Manual alternative — Codex discovers skills in `~\u002F.agents\u002Fskills` (personal) or `.agents\u002Fskills` (project):\n\n```bash\nmkdir -p ~\u002F.agents\u002Fskills && cp -r sail\u002Fskills\u002Fsail ~\u002F.agents\u002Fskills\u002Fsail\n```\n\nInvoke explicitly with `$sail` (type `$` or `\u002Fskills` in the TUI) or just ask about AI\u002Fagent security and let the description trigger it.\n\n### Google Antigravity\n\nAntigravity (IDE and CLI) reads SKILL.md skills from `.agents\u002Fskills` (workspace) and `~\u002F.agents\u002Fskills` (user). Google's codelabs endorse the `skills` CLI for installation:\n\n```bash\nnpx skills add https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail -a antigravity -g -y\n```\n\n(Drop `-g` for a workspace-level install.) On older CLI builds that only read `~\u002F.gemini\u002Fantigravity-cli\u002Fskills\u002F`, move or copy the installed `sail\u002F` folder there. Manual alternative: `cp -r sail\u002Fskills\u002Fsail ~\u002F.agents\u002Fskills\u002Fsail`.\n\n### pi\n\nThe repo ships a pi package manifest, so it's a one-liner:\n\n```bash\npi install https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\n```\n\npi also reads `~\u002F.agents\u002Fskills`, so a Codex or Antigravity install covers pi too (and vice versa via the shared directory).\n\n### ChatGPT\n\nSkills are available on **all ChatGPT plans** at **[chatgpt.com\u002Fskills](https:\u002F\u002Fchatgpt.com\u002Fskills)**:\n\n1. Open [chatgpt.com\u002Fskills](https:\u002F\u002Fchatgpt.com\u002Fskills) → **New skill** → **Upload from your computer**.\n2. Upload `dist\u002Fsail-skill.zip`.\n3. ChatGPT scans the upload and the skill becomes available; workspace admins (Business\u002FEnterprise\u002FEdu) can share it org-wide.\n\n### opencode\n\n```bash\n# per-project\nmkdir -p \u003Cproject>\u002F.opencode\u002Fskills && cp -r sail\u002Fskills\u002Fsail \u003Cproject>\u002F.opencode\u002Fskills\u002Fsail\n# global\nmkdir -p ~\u002F.config\u002Fopencode\u002Fskills && cp -r sail\u002Fskills\u002Fsail ~\u002F.config\u002Fopencode\u002Fskills\u002Fsail\n```\n\nopencode also reads `~\u002F.claude\u002Fskills` and `.agents\u002Fskills`, so a Claude Code or Codex install covers it too.\n\n### Other SKILL.md-compatible agents\n\nThe skill is a plain folder — `SKILL.md` + `references\u002F` — following the open agent-skills format. Vercel's `skills` CLI installs it for 20+ agents:\n\n```bash\nnpx skills add https:\u002F\u002Fgithub.com\u002Fpillar-labs\u002Fsail-skill\u002Ftree\u002Fmain\u002Fsail\u002Fskills\u002Fsail -g -y\n```\n\nOr copy `sail\u002Fskills\u002Fsail\u002F` into whatever skills directory your tool documents \u002F unzip `dist\u002Fsail-skill.zip` there.\n\n## Usage\n\n**Guided mode** (Claude Code): type `\u002Fsail` with no arguments.\n\n- **Inside a repo that contains an agent**, the skill detects it and leads with **\"Assess the agent in this repository\"** — a full SAIL gap analysis of the code in front of it.\n- **Elsewhere**, it runs a short top-down intake: what kind of program this is (governance, agent security, AI transformation, vendor assessment, red-team readiness) → what you have to protect → which deliverable you want.\n\n**Direct mode** (any harness): just describe your task — the skill triggers automatically on AI\u002Fagent-security intent.\n\n## What's inside the skill\n\n```\nsail\u002Fskills\u002Fsail\u002F\n├── SKILL.md                      # entry point: framework structure + workflows\n├── README.md                     # thin pointer to this page\n└── references\u002F\n    ├── risk-index.md             # all 91 risks in one table (the navigation map)\n    ├── framework.md              # exec summary, the 3 zones, the 7 phases, how to use SAIL\n    ├── phase-1-policy.md         # full risk catalog, one file per phase:\n    ├── …                         #   descriptions, examples, assets affected,\n    ├── phase-7-govern.md         #   mitigations, standards mappings\n    ├── definitions.md            # Appendix A: component definitions\n    └── use-case.md               # Appendix B: worked FinTech example\n```\n\n## Repository layout\n\n```\nsail-skill\u002F                        marketplace repo root\n├── .claude-plugin\u002F\n│   └── marketplace.json           marketplace manifest\n├── sail\u002F                          the \"sail\" plugin\n│   ├── .claude-plugin\u002Fplugin.json plugin manifest\n│   ├── commands\u002F                  \u002Fsail:assess · \u002Fsail:roadmap · \u002Fsail:comply · \u002Fsail:rfp\n│   ├── README.md                  thin plugin readme\n│   └── skills\u002Fsail\u002F               the skill itself (see above)\n├── dist\u002F                          prebuilt zip \u002F .skill archives (rebuild: dist\u002FBUILD.md)\n└── package.json                   pi package manifest (`pi install \u003Crepo-url>`)\n```\n\nAfter editing the skill, rebuild `dist\u002Fsail-skill.zip` \u002F `dist\u002Fsail.skill` — see [`dist\u002FBUILD.md`](dist\u002FBUILD.md).\n\n## About SAIL\n\nSAIL (Secure AI Lifecycle) V2 covers the agentic attack surface across three zones (code & pipeline, cloud agents, endpoint agents) and seven lifecycle phases (Policy → Discovery → Posture → Red Teaming → Runtime Controls → Sandbox → Govern), with 91 risks mapped to external standards (ISO\u002FIEC 42001, EU AI Act, OWASP LLM & Agentic Top 10, DASF, AIUC-1). Standards mappings indicate alignment, not automatic compliance. Learn more at [pillar.security](https:\u002F\u002Fwww.pillar.security).\n\n## License\n\n© Pillar Security. This repository is licensed under [CC BY-NC-SA 4.0](LICENSE): share and adapt for non-commercial purposes, credit \"SAIL by Pillar Security\", and distribute adaptations under the same license.\n\n**Additional permission:** you may use this material internally within your organization, including for commercial purposes — installing the skill, running assessments, and embedding the catalog in internal documentation and tooling. Redistribution or incorporation into products or services offered to third parties requires a separate license — contact [Pillar Security](https:\u002F\u002Fwww.pillar.security).\n\nThe SAIL name and the Pillar Security name and logo are trademarks of Pillar Security and are not licensed.\n","SAIL Skill 是一个面向AI系统安全治理的智能体技能插件，将 Pillar Security 提出的 SAIL V2 框架（含91项跨7个生命周期阶段的风险项、对应缓解措施及标准映射）嵌入主流AI开发环境，支持自动化AI\u002FAgent安全差距评估、合规性检查（如EU AI Act、ISO\u002FIEC 42001）、安全路线图生成与供应商RFP编制。其核心特点是基于真实风险目录实时检索、零幻觉输出，并兼容Claude Code、Codex、ChatGPT等SKILL.md协议支持的智能体平台。适用于AI产品团队、安全工程师和合规负责人在AI系统设计、部署与审计阶段开展标准化、可落地的安全治理工作。","2026-07-08 04:30:11","CREATED_QUERY"]