SAIL Skill — Secure AI Lifecycle by Pillar Security

An agent skill that applies SAIL V2 — Pillar Security's Secure AI Lifecycle framework — to real systems. It bundles the full SAIL V2 risk catalog (91 risks across 7 lifecycle phases, each with mitigations and standards mappings) as reference files the agent reads on demand, so every answer is grounded in the actual catalog: real SAIL IDs, real mappings, no hallucinated controls.

This repository is also a Claude Code plugin marketplace — one-command install for Claude Code, prebuilt archives for everything else.

What it does

The skill triggers whenever you work on AI/agent security. It can:

• Assess an agent or system — full SAIL gap analysis with a component chart and all 91 risks dispositioned
• Build a security roadmap and maturity assessment
• Generate compliance checklists (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF, AIUC-1)
• Prioritize controls and produce cross-team alignment artifacts
• Create vendor RFPs (security-vendor coverage questionnaires or platform-vendor security questionnaires)
• Answer questions about SAIL — "What does SAIL 5.17 cover?" cites the catalog row

Example prompts (any harness — the skill triggers automatically):

• "We're deploying an autonomous support agent built on LangGraph with MCP servers for Zendesk and Postgres — do a security review I can share with our CISO."
• "Generate a security control checklist organized by EU AI Act articles."
• "Build me an AI security roadmap — we have agents in production but no AI policy yet."
• "Write the security section of an RFP for a managed agent platform."

In Claude Code you additionally get five entry points:

Command	What it does
/sail	Interactive launcher — guided intake, picks the right workflow
/sail:assess [path]	Full gap analysis of the agent in the current repo (or path) — all 91 risks dispositioned, written to SAIL-assessment.md
/sail:roadmap [hints]	7-phase security roadmap + per-phase maturity profile
/sail:comply [frameworks]	Compliance checklist — all five frameworks, or just those named (eu-ai-act, iso-42001, owasp, dasf, aiuc-1)
/sail:rfp [security|platform] [vendor]	Vendor RFP questionnaire — security-vendor coverage by default

The /sail:* commands run immediately with smart defaults — no intake questions.

Installation

Pick your harness/software in the matrix, then follow its section below.