pillar-labs

Sail Skill — Security skill for Claude Code

Security community

SAIL V2 (Secure AI Lifecycle) as an agent skill — the full 91-risk catalog for AI/agent gap assessments, security roadmaps, and compliance checklists.

How to install Sail Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open pillar-labs/sail-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Sail Skill does

SAIL V2 (Secure AI Lifecycle) as an agent skill — the full 91-risk catalog for AI/agent gap assessments, security roadmaps, and compliance checklists. Installs on Claude Code, Codex, ChatGPT, Antigravity, and any SKILL.md-compatible agent.

Alternatives in Security

Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Maestro Knowledge — Intent-driven knowledge-store and Run knowledge lifecycle management — audit/prune, stage candidates (with sig 530 ★
Skill Threat Modeling — Code-First Deep Risk Analysis Skill for Claude Code - 8-Phase Workflow with Security design review, STRIDE Thr 207 ★

README

SAIL Skill — Secure AI Lifecycle by Pillar Security

An agent skill that applies **SAIL V2** — [Pillar Security](https://www.pillar.security)'s Secure AI Lifecycle framework — to real systems. It bundles the full SAIL V2 risk catalog (**91 risks across 7 lifecycle phases**, each with mitigations and standards mappings) as reference files the agent reads on demand, so every answer is grounded in the actual catalog: real SAIL IDs, real mappings, no hallucinated controls.

This repository is also a **Claude Code plugin marketplace** — one-command install for Claude Code, prebuilt archives for everything else.

What it does

The skill triggers whenever you work on AI/agent security. It can:

Assess an agent or system — full SAIL gap analysis with a component chart and all 91 risks dispositioned
Build a security roadmap and maturity assessment
Generate compliance checklists (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF, AIUC-1)
Prioritize controls and produce cross-team alignment artifacts
Create vendor RFPs (security-vendor coverage questionnaires or platform-vendor security questionnaires)
Answer questions about SAIL — "What does SAIL 5.17 cover?" cites the catalog row

Example prompts (any harness — the skill triggers automatically):

"We're deploying an autonomous support agent built on LangGraph with MCP servers for Zendesk and Postgres — do a security review I can share with our CISO."
"Generate a security control checklist organized by EU AI Act articles."
"Build me an AI security roadmap — we have agents in production but no AI policy yet."
"Write the security section of an RFP for a managed agent platform."

In **Claude Code** you additionally get five entry points:

| Comma