Agent skill

Sail

by pillar-labs in pillar-labs/sail-skill

Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents.

Custom licenceAuto-check passedSecurity

Install Sail

skills CLI

$ npx skills add pillar-labs/sail-skill --skill sail -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install pillar-labs/sail-skill sail --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/pillar-labs/sail-skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/sail/skills/sail .claude/skills/sail && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "sail" agent skill from https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail into .claude/skills/sail/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sail", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add pillar-labs/sail-skill --skill sail -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install pillar-labs/sail-skill sail --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/pillar-labs/sail-skill.git skills-src && mkdir -p .agents/skills && cp -r skills-src/sail/skills/sail .agents/skills/sail && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "sail" agent skill from https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail into .agents/skills/sail/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sail", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add pillar-labs/sail-skill --skill sail -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install pillar-labs/sail-skill sail --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/pillar-labs/sail-skill.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/sail/skills/sail .cursor/skills/sail && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "sail" agent skill from https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail into .cursor/skills/sail/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sail", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/pillar-labs/sail-skill.git --path sail/skills/sail

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add pillar-labs/sail-skill --skill sail -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install pillar-labs/sail-skill sail --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/pillar-labs/sail-skill.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/sail/skills/sail .gemini/skills/sail && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "sail" agent skill from https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail into .gemini/skills/sail/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sail", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install pillar-labs/sail-skill sail

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add pillar-labs/sail-skill --skill sail -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/pillar-labs/sail-skill.git skills-src && mkdir -p .github/skills && cp -r skills-src/sail/skills/sail .github/skills/sail && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "sail" agent skill from https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail into .github/skills/sail/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sail", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add pillar-labs/sail-skill --skill sail -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install pillar-labs/sail-skill sail --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/pillar-labs/sail-skill.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/sail/skills/sail .opencode/skills/sail && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "sail" agent skill from https://github.com/pillar-labs/sail-skill/tree/main/sail/skills/sail into .opencode/skills/sail/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sail", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: sail
GitHub stars: 113
Token cost: ~5.1k tokens
SKILL.md length: 2,777 words
Files: 13 (incl. references)
Skills in repo: 1
Repo updated: Jul 7, 2026
First seen: Oct 7, 2026
Licence: Custom licence

At a glance

Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents.

Works in 6 steps: Build an AI security roadmap — walk the… → Assess AI security maturity — score each… → Generate a compliance checklist — filter… → …
The user asks about AI
SKILL.md covers Core structure (memorize this,…, Ground every answer in the…, Reference files and Interactive intake — when…, plus 2 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Sail is an agent skill from pillar-labs/sail-skill. Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents. Use this skill whenever the user asks about AI or agent security — assessing an AI system or agent architecture for risks, building an AI security roadmap or maturity assessment, writing or reviewing an AI security policy, creating compliance checklists (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF, AIUC-1), prioritizing AI security controls, evaluating AI vendors or tools (RFPs, security…

Its SKILL.md is about 5.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 13 other files, including reference files (for example `README.md`, `references/definitions.md` and `references/framework.md`).

It sits in Security, covering Prompt injection and agent security, Regulatory compliance and Proposals and quotes. It works with Model Context Protocol. The repository describes itself as: SAIL V2 (Secure AI Lifecycle) as an agent skill — the full 91-risk catalog for AI/agent gap assessments, security roadmaps, and compliance checklists. Installs on Claude Code…

When your agent uses it

The user asks about AI
Agent security — assessing an AI system
Agent architecture for risks
Building an AI security roadmap

Example prompts

“or a”
“/sail”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

Build an AI security roadmap — walk the seven phases in order, assess coverage at each; the gaps, sequenced by phase, become the roadmap.
Assess AI security maturity — score each relevant risk (unaddressed / partially mitigated / mitigated with evidence) into a per-phase…
Generate a compliance checklist — filter the catalog by the framework the user is accountable to (ISO/IEC 42001, EU AI Act, OWASP, DASF…
Prioritize controls — focus on risks that intersect the user's zones, assets, and weakest phase; autonomy tiers (SAIL 1.11) set control…
Run vendor assessments and RFPs — turn the catalog into a general RFP questionnaire (for security vendors or platform vendors), with…
Align security, legal, compliance, and engineering — SAIL IDs give all four teams one shared vocabulary for design reviews, risk…

What it can do on your machine

Read from SKILL.md and the folder at commit 67e1691. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sail loads about 5.1k tokens when it runs, and up to ~39k if it reads all its reference files. Until then it costs about 193 tokens; SKILL.md has 2,777 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~193
When it runs · the whole SKILL.md, loaded when a task matches: ~5.1k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~39k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 2,777 words (~5,059 tokens).

“SAIL is Pillar Security's framework for building, deploying, and operating AI systems and agents securely. It is a working tool, not a reading exercise: users bring real systems, policies, and compliance obligations, and expect concrete, catalog-grounded answers. Whether they are…”

— opening of SKILL.md by pillar-labs, Custom licence

name: sail

Outline of SKILL.md

SAIL V2 — Secure AI Lifecycle Framework
Core structure (memorize this, cite it constantly)
Ground every answer in the catalog
Reference files
Interactive intake — when invoked as /sail or the intent is unclear
Workflows
Assess a system / gap analysis
Build an AI security roadmap
Assess AI security maturity
Generate a compliance checklist
Prioritize controls
Vendor assessment / RFP questions
Align security, legal, compliance, and engineering
Guide secure AI development
Answer questions about SAIL
Output conventions

Read the full SKILL.md on GitHub

Files

SKILL.md and 12 other files (references) in sail/skills/sail of pillar-labs/sail-skill.

SKILL.md
README.md
references/definitions.md
references/framework.md
references/phase-1-policy.md
references/phase-2-discovery.md
references/phase-3-posture.md
references/phase-4-red-teaming.md
references/phase-5-runtime.md
references/phase-6-sandbox.md
references/phase-7-govern.md
references/risk-index.md
references/use-case.md

Open the folder on GitHubat commit 67e1691

Compare with similar skills

Sail next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sail compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Sail this skillpillar-labs/sail-skill	113	—	~5.1k	Automated safety check: Pass	Custom licence	3 mo ago
AI SAFE2 Secure Build CopilotCyberStrategyInstitute/ai-safe2-framework	146	—	~1.2k	Automated safety check: Pass	Custom licence	yesterday
China AI Compliance AuditjnMetaCode/shellward	140	—	~1.1k	Automated safety check: Pass	Apache-2.0	11 days ago
AI GovernanceHack23/cia	239	—	~1.4k	Automated safety check: Pass	Apache-2.0	today
Agent Owasp Compliancegithub/awesome-copilot	40k	1 repos	~3k	Automated safety check: Pass	MIT	today
AI SAFE2 Secure Build CopilotCyberStrategyInstitute/ai-safe2-framework	146	—	~2.7k	Automated safety check: Pass	Custom licence	yesterday

Similar skills

AI SAFE2 Secure Build Copilot
CyberStrategyInstitute/ai-safe2-framework
Applies the AI SAFE2 framework to security reviews, code reviews and compliance mapping for AI agents, RAG pipelines and MCP servers.
146 GitHub stars~1.2k tokensUpdated yesterday
SecurityAuto-check passed
China AI Compliance Audit
jnMetaCode/shellward
按中国法规（网安法 / PIPL / 等保2.0 / 数据出境 / AI生成内容标识）审计一个 AI 项目的代码仓库，产出每条都带文件:行取证、经独立复核、经脚本校验的合规报告。当用户问「这个项目上线合不合规」「调用了 OpenAI/Claude 算不算数据出境」「要不要做 AI 标识」「帮我做合规自查/等保/PIPL 检查」时使用。Audit an AI project's…
140 GitHub stars~1.1k tokensUpdated 11 days ago
SecurityAuto-check passed
AI Governance
Hack23/cia
AI governance, EU AI Act compliance, OWASP LLM security, responsible AI practices for GitHub Copilot agents
239 GitHub stars~1.4k tokensUpdated today
Legal & ComplianceAuto-check passed
Agent Owasp Compliance
github/awesome-copilot
Official
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks.
40k GitHub starsUsed in 1 repo~3k tokens
SecurityAuto-check passed
AI SAFE2 Secure Build Copilot
CyberStrategyInstitute/ai-safe2-framework
Applies the AI SAFE2 v3.1 governance framework to designing, building, auditing and testing AI agents, RAG pipelines, MCP and tool integrations and AI infrastructure.
146 GitHub stars~2.7k tokensUpdated yesterday
SecurityAuto-check passed
MCP Server Security Audit
awarexone/Agentic-Bug-Hunter
Audits MCP servers and their client configs for tool poisoning, prompt injection, over-privileged tools, injection bugs, secret leaks and missing approval gates.
5.3k GitHub stars~1.9k tokensUpdated yesterday
SecurityAuto-check: warnings

Works with

Model Context Protocol

Questions about Sail

What does Sail do?

Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents. Sail is an agent skill from pillar-labs/sail-skill. Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents.

When should I use Sail?

Sail fits situations like: the user asks about AI; agent security — assessing an AI system; agent architecture for risks; building an AI security roadmap.

How do I install Sail in Claude Code?

Run `npx skills add pillar-labs/sail-skill --skill sail -a claude-code`. Or copy the skill folder (sail/skills/sail in pillar-labs/sail-skill) into .claude/skills/sail in your project. Claude Code loads it when a task matches its description.

How do I install Sail in Codex?

Run `npx skills add pillar-labs/sail-skill --skill sail -a codex`. Or copy the skill folder (sail/skills/sail in pillar-labs/sail-skill) into .agents/skills/sail in your project. Codex loads it when a task matches its description.

Can I use Sail in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add pillar-labs/sail-skill --skill sail -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sail, .gemini/skills/sail, .github/skills/sail and .opencode/skills/sail in your project.

What does Sail need to run?

SKILL.md names no scripts, command-line tools or credentials: Sail is instructions for the agent only.

Does Sail access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Sail safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Sail use?

Sail has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.

How many tokens does Sail use?

About 5.1k tokens (SKILL.md is roughly 20k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 34k tokens, read only when the agent opens those files.

What are the alternatives to Sail?

Skills that share tags, products or a category with Sail: AI SAFE2 Secure Build Copilot (CyberStrategyInstitute/ai-safe2-framework, 146 stars), China AI Compliance Audit (jnMetaCode/shellward, 140 stars), AI Governance (Hack23/cia, 239 stars) and Agent Owasp Compliance (github/awesome-copilot, 40k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sail?

pillar-labs (a GitHub organization) maintains it in pillar-labs/sail-skill, which has 113 GitHub stars. The repository was last updated on July 7, 2026.

Source: pillar-labs/sail-skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Sail

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Files

Compare with similar skills

Similar skills

AI SAFE2 Secure Build Copilot

China AI Compliance Audit

AI Governance

Agent Owasp Compliance

AI SAFE2 Secure Build Copilot

MCP Server Security Audit

Related

Questions about Sail