Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

SAIL V2 — Secure AI Lifecycle Framework · pillar-labs | DecimalAI

Securityby pillar-labs

SAIL V2 — Secure AI Lifecycle Framework

Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents.

SkillScore

SkillScore82/100

Test results 82

Safety

3/3 safety checks passed

Code scan
Intent
Content

What it changes

18%82%of test cases passed +64 pts

Without skill4 of 22

With skill18 of 22

15 fixed3 passed either way3 still failing1 broke

Measured on gemini-3.6-flash8/3/2026v120 comparable

Track record

Agent runs: 0; All time

See one task, with and without the skill

One test taskWhat is SAIL 5.17 and which lifecycle phase and zone does it belong to?

Without the skillMissed

With the skillPassed

Same model, same task. Answers are capped and redacted.

Use this skill

Your agent runs on

Adds every file the skill has, pinned so you can update it. No account needed.

pip install "decimalai>=0.15"
decimalai skills add pillar-labs-sail
claude --plugin-dir "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.agents"

The same install from Python, for a notebook or a setup script.

Install

pip install "decimalai>=0.15"

Add the skill

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

print("Added. Start Claude Code with the command below.")

Start Claude Code with it

claude --plugin-dir "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.agents"

Type these in a Claude Code session. No account or API key. It writes the skill and any files it bundles, and asks first when its safety rating isn't Passed.

Add the DecimalAI plugin, once

/plugin marketplace add decimal-labs/decimalai-claude-plugins
/plugin install decimalai@decimalai

Install this skill

/decimalai:install pillar-labs-sail

The plugin needs python3 and curl on your machine.

No Python or account. Claude Code picks it up in its next session.

Save it into your project

curl -fsSL --create-dirs -o .claude/skills/pillar-labs-sail/SKILL.md https://app.decimal.ai/s/pillar-labs-sail/SKILL.md

Copy SKILL.md

Save it in your project, as

.claude/skills/pillar-labs-sail/SKILL.md

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Claude Code docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[claude-agent-sdk]"
decimalai skills add pillar-labs-sail

Add it to your agent

import asyncio

from claude_agent_sdk import ClaudeAgentOptions
from decimalai.claude_agent_sdk import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

async def main():
    question = "Hello!"
    async with support.run(question) as run:  # one user message, one run
        async for message in run.query(options=ClaudeAgentOptions(max_turns=6)):
            print(message)

# In a notebook or async code: await main()
asyncio.run(main())

Prefer its own loader? ClaudeAgentOptions(plugins=[skills_plugin()], skills="all") reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

The same install from Python, for a notebook or a setup script. agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[claude-agent-sdk]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

import asyncio

from claude_agent_sdk import ClaudeAgentOptions
from decimalai.claude_agent_sdk import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

async def main():
    question = "Hello!"
    async with support.run(question) as run:  # one user message, one run
        async for message in run.query(options=ClaudeAgentOptions(max_turns=6)):
            print(message)

# In a notebook or async code: await main()
asyncio.run(main())

Prefer its own loader? ClaudeAgentOptions(plugins=[skills_plugin()], skills="all") reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

import asyncio
from pathlib import Path
from claude_agent_sdk import ClaudeAgentOptions, query

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
options = ClaudeAgentOptions(system_prompt=f"You are a helpful agent.\n\n{skill}", max_turns=6)

async def main():
    async for message in query(prompt="Hello!", options=options):
        print(message)

# In a notebook or async code: await main()
asyncio.run(main())

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Claude Agent SDK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[openai-agents]"
decimalai skills add pillar-labs-sail

Add it to your agent

from agents import Agent, Runner
from decimalai.openai_agents import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    name=support.name,
    instructions=support.instructions,  # your prompt, then the skill list
    tools=[*support.tools],             # your tools, then load_skill
)
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

Using SandboxAgent? capabilities=[Shell(), decimalai.openai_agents.sandbox_skills()] points its own loader at the same folder.

Install

pip install "decimalai[openai-agents]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

from agents import Agent, Runner
from decimalai.openai_agents import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    name=support.name,
    instructions=support.instructions,  # your prompt, then the skill list
    tools=[*support.tools],             # your tools, then load_skill
)
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

Using SandboxAgent? capabilities=[Shell(), decimalai.openai_agents.sandbox_skills()] points its own loader at the same folder.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from agents import Agent, Runner

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = Agent(name="support", instructions=f"You are a helpful agent.\n\n{skill}")
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

OpenAI Agents docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[openai]"
decimalai skills add pillar-labs-sail

Add it to your agent

import json

from openai import OpenAI
from decimalai.openai import agent_config

client = OpenAI()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your tools, as Chat Completions takes them, and what answers each.
TOOLS = [{"type": "function", "function": {
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters": {"type": "object", "properties": {"order_id": {"type": "string"}},
                   "required": ["order_id"]},
}}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    # run.system is your prompt, then the skill list.
    messages = [{"role": "system", "content": run.system}, run.message]
    while True:
        reply = client.chat.completions.create(
            model="gpt-5.4-mini",
            messages=messages,
            tools=[*TOOLS, *run.tools],  # your tools, then load_skill
        ).choices[0].message
        messages.append(reply)
        if not reply.tool_calls:
            break
        for call in reply.tool_calls:
            # load_skill is answered by the run; your own tools by FUNCTIONS.
            function = FUNCTIONS.get(call.function.name)
            messages.append(run.tool_result(call) or {
                "role": "tool", "tool_call_id": call.id,
                "content": function(**json.loads(call.function.arguments)) if function
                else f"There is no tool named {call.function.name!r}.",
            })
print(reply.content)

# The Responses API takes run.response_tools instead of run.tools.

Install

pip install "decimalai[openai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

import json

from openai import OpenAI
from decimalai.openai import agent_config

client = OpenAI()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your tools, as Chat Completions takes them, and what answers each.
TOOLS = [{"type": "function", "function": {
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters": {"type": "object", "properties": {"order_id": {"type": "string"}},
                   "required": ["order_id"]},
}}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    # run.system is your prompt, then the skill list.
    messages = [{"role": "system", "content": run.system}, run.message]
    while True:
        reply = client.chat.completions.create(
            model="gpt-5.4-mini",
            messages=messages,
            tools=[*TOOLS, *run.tools],  # your tools, then load_skill
        ).choices[0].message
        messages.append(reply)
        if not reply.tool_calls:
            break
        for call in reply.tool_calls:
            # load_skill is answered by the run; your own tools by FUNCTIONS.
            function = FUNCTIONS.get(call.function.name)
            messages.append(run.tool_result(call) or {
                "role": "tool", "tool_call_id": call.id,
                "content": function(**json.loads(call.function.arguments)) if function
                else f"There is no tool named {call.function.name!r}.",
            })
print(reply.content)

# The Responses API takes run.response_tools instead of run.tools.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from openai import OpenAI

client = OpenAI()
skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
reply = client.chat.completions.create(
    model="gpt-5.4-mini",
    messages=[
        {"role": "system", "content": f"You are a helpful agent.\n\n{skill}"},
        {"role": "user", "content": "Hello!"},
    ],
).choices[0].message

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

OpenAI SDK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[anthropic]"
decimalai skills add pillar-labs-sail

Add it to your agent

import anthropic
from decimalai.anthropic import agent_config

client = anthropic.Anthropic()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

question = "Hello!"
with support.run(question) as run:  # one user message, one run
    answer = client.beta.messages.tool_runner(
        model="claude-haiku-5-5",
        max_tokens=4096,
        system=run.system,     # your prompt, then the skill list
        tools=[*run.tools],    # your tools, then load_skill
        messages=[{"role": "user", "content": question}],
    ).until_done()

Install

pip install "decimalai[anthropic]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

import anthropic
from decimalai.anthropic import agent_config

client = anthropic.Anthropic()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

question = "Hello!"
with support.run(question) as run:  # one user message, one run
    answer = client.beta.messages.tool_runner(
        model="claude-haiku-5-5",
        max_tokens=4096,
        system=run.system,     # your prompt, then the skill list
        tools=[*run.tools],    # your tools, then load_skill
        messages=[{"role": "user", "content": question}],
    ).until_done()

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
import anthropic

client = anthropic.Anthropic()
skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
reply = client.messages.create(
    model="claude-haiku-5-5",
    max_tokens=4096,
    system=f"You are a helpful agent.\n\n{skill}",
    messages=[{"role": "user", "content": "Hello!"}],
)

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Anthropic docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[google-genai]"
decimalai skills add pillar-labs-sail

Add it to your agent

from google import genai
from google.genai import types
from decimalai.google_genai import agent_config

client = genai.Client()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your functions, as declarations for the model, and what answers each.
TOOLS = [{"function_declarations": [{
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters_json_schema": {"type": "object", "properties": {"order_id": {"type": "string"}},
                               "required": ["order_id"]},
}]}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    config = types.GenerateContentConfig(
        system_instruction=run.system,     # your prompt, then the skill list
        tools=[*TOOLS, *run.tool_params],  # your functions, then load_skill
    )
    contents = [{"role": "user", "parts": [{"text": run.message}]}]
    while True:
        response = client.models.generate_content(
            model="gemini-3.5-flash", contents=contents, config=config,
        )
        if not response.function_calls:
            break
        contents.append(response.candidates[0].content)
        parts = []
        for call in response.function_calls:
            # load_skill is answered by the run; your own functions by FUNCTIONS.
            # A loop of your own rather than automatic function calling, which
            # raises KeyError when the model asks for a function you did not pass.
            function = FUNCTIONS.get(call.name)
            parts.append(run.tool_result(call) or {"function_response": {
                "name": call.name, "id": call.id,
                "response": {"result": function(**(call.args or {})) if function
                             else f"There is no function named {call.name!r}."},
            }})
        contents.append({"role": "user", "parts": parts})
print(response.text)

Install

pip install "decimalai[google-genai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

from google import genai
from google.genai import types
from decimalai.google_genai import agent_config

client = genai.Client()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your functions, as declarations for the model, and what answers each.
TOOLS = [{"function_declarations": [{
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters_json_schema": {"type": "object", "properties": {"order_id": {"type": "string"}},
                               "required": ["order_id"]},
}]}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    config = types.GenerateContentConfig(
        system_instruction=run.system,     # your prompt, then the skill list
        tools=[*TOOLS, *run.tool_params],  # your functions, then load_skill
    )
    contents = [{"role": "user", "parts": [{"text": run.message}]}]
    while True:
        response = client.models.generate_content(
            model="gemini-3.5-flash", contents=contents, config=config,
        )
        if not response.function_calls:
            break
        contents.append(response.candidates[0].content)
        parts = []
        for call in response.function_calls:
            # load_skill is answered by the run; your own functions by FUNCTIONS.
            # A loop of your own rather than automatic function calling, which
            # raises KeyError when the model asks for a function you did not pass.
            function = FUNCTIONS.get(call.name)
            parts.append(run.tool_result(call) or {"function_response": {
                "name": call.name, "id": call.id,
                "response": {"result": function(**(call.args or {})) if function
                             else f"There is no function named {call.name!r}."},
            }})
        contents.append({"role": "user", "parts": parts})
print(response.text)

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from google import genai
from google.genai import types

client = genai.Client()
skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
response = client.models.generate_content(
    model="gemini-3.5-flash",
    contents="Hello!",
    config=types.GenerateContentConfig(system_instruction=f"You are a helpful agent.\n\n{skill}"),
)

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Gemini API docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[langchain]" langchain-openai
decimalai skills add pillar-labs-sail

Add it to your agent

from langchain.agents import create_agent
from decimalai.langchain import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = create_agent(
    "openai:gpt-5.4-mini",
    tools=[],                         # your tools; the middleware adds load_skill
    middleware=[support.middleware],  # your prompt, the skill list and load_skill
)
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

Install

pip install "decimalai[langchain]" langchain-openai

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

from langchain.agents import create_agent
from decimalai.langchain import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = create_agent(
    "openai:gpt-5.4-mini",
    tools=[],                         # your tools; the middleware adds load_skill
    middleware=[support.middleware],  # your prompt, the skill list and load_skill
)
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from langchain.agents import create_agent

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = create_agent("openai:gpt-5.4-mini", tools=[], system_prompt=f"You are a helpful agent.\n\n{skill}")
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

LangChain docs

CrewAI's own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" "crewai>=1.15.27"
decimalai skills add pillar-labs-sail

Add it to your agent

import decimalai.crewai
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                               # your own CrewAI LLM
    skills=decimalai.crewai.skills(),      # the installed folder
    tools=decimalai.crewai.skill_tools(),  # reads a skill's files, runs its scripts
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

The same install from Python, for a notebook or a setup script. CrewAI's own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" "crewai>=1.15.27"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

import decimalai.crewai
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                               # your own CrewAI LLM
    skills=decimalai.crewai.skills(),      # the installed folder
    tools=decimalai.crewai.skill_tools(),  # reads a skill's files, runs its scripts
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

No DecimalAI package. CrewAI's own loader reads the folder, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                         # your own CrewAI LLM
    skills=[Path(".agents/skills")],
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

CrewAI docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[adk]"
decimalai skills add pillar-labs-sail

Add it to your agent

from decimalai.adk import DecimalAIPlugin, agent_config
from google.adk.agents import LlmAgent
from google.adk.apps import App

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = LlmAgent(
    name="support",          # ADK needs a Python identifier
    model="gemini-3.5-flash",
    instruction=support.instruction,  # your prompt, then the skill list
    tools=[*support.tools],           # your tools, then load_skill
)
# DecimalAIPlugin makes each invocation of runners built from this App one trace.
app = App(name="support", root_agent=agent, plugins=[DecimalAIPlugin()])

Prefer ADK's own loader? SkillToolset(skills=decimalai.adk.skills(), ...) reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

Install

pip install "decimalai[adk]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

from decimalai.adk import DecimalAIPlugin, agent_config
from google.adk.agents import LlmAgent
from google.adk.apps import App

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = LlmAgent(
    name="support",          # ADK needs a Python identifier
    model="gemini-3.5-flash",
    instruction=support.instruction,  # your prompt, then the skill list
    tools=[*support.tools],           # your tools, then load_skill
)
# DecimalAIPlugin makes each invocation of runners built from this App one trace.
app = App(name="support", root_agent=agent, plugins=[DecimalAIPlugin()])

Prefer ADK's own loader? SkillToolset(skills=decimalai.adk.skills(), ...) reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from google.adk.agents import LlmAgent

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = LlmAgent(
    name="support",
    model="gemini-3.5-flash",
    instruction=lambda context: f"You are a helpful agent.\n\n{skill}",
)

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Google ADK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[pydantic-ai]"
decimalai skills add pillar-labs-sail

Add it to your agent

from pydantic_ai import Agent
from decimalai.pydantic_ai import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    "openai:gpt-4o-mini",
    name=support.name,
    tools=[],                 # your tools; the capability adds load_skill
    capabilities=[support],   # your prompt, the skill list and load_skill
)
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

On the Pydantic AI harness, decimalai.pydantic_ai_harness.skills(project) uses its own loader instead.

Install

pip install "decimalai[pydantic-ai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

from pydantic_ai import Agent
from decimalai.pydantic_ai import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    "openai:gpt-4o-mini",
    name=support.name,
    tools=[],                 # your tools; the capability adds load_skill
    capabilities=[support],   # your prompt, the skill list and load_skill
)
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

On the Pydantic AI harness, decimalai.pydantic_ai_harness.skills(project) uses its own loader instead.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from pydantic_ai import Agent

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = Agent("openai:gpt-4o-mini", instructions=f"You are a helpful agent.\n\n{skill}")
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Pydantic AI docs

Deep Agents' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" deepagents
decimalai skills add pillar-labs-sail

Add it to your agent

import decimalai.deepagents
from deepagents import create_deep_agent

agent = create_deep_agent(model=model, **decimalai.deepagents.skills())
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

The default backend reads files but has no shell. To run a skill's scripts, pass skills(backend=LocalShellBackend(...)).

The same install from Python, for a notebook or a setup script. Deep Agents' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" deepagents

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

import decimalai.deepagents
from deepagents import create_deep_agent

agent = create_deep_agent(model=model, **decimalai.deepagents.skills())
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

The default backend reads files but has no shell. To run a skill's scripts, pass skills(backend=LocalShellBackend(...)).

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from deepagents import create_deep_agent

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = create_deep_agent(model=model, system_prompt=f"You are a helpful agent.\n\n{skill}")
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Deep Agents docs

Its own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" agent-framework
decimalai skills add pillar-labs-sail

Add it to your agent

import asyncio

from agent_framework import Agent
from decimalai.agent_framework import skills

agent = Agent(client=client, instructions="You are a helpful agent.", context_providers=[skills()])
asyncio.run(agent.run("Hello!"))

It caches skills by default, so restart the process after decimalai skills update.

The same install from Python, for a notebook or a setup script. Its own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" agent-framework

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

import asyncio

from agent_framework import Agent
from decimalai.agent_framework import skills

agent = Agent(client=client, instructions="You are a helpful agent.", context_providers=[skills()])
asyncio.run(agent.run("Hello!"))

It caches skills by default, so restart the process after decimalai skills update.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

import asyncio
from pathlib import Path
from agent_framework import Agent

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = Agent(client=client, instructions=f"You are a helpful agent.\n\n{skill}")
asyncio.run(agent.run("Hello!"))

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Microsoft Agent Framework docs

Strands' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" strands-agents
decimalai skills add pillar-labs-sail

Add it to your agent

from decimalai.strands import skills
from strands import Agent
from strands.vended_tools import file_editor, shell

agent = Agent(
    model=model,                # always pass one: the default is Amazon Bedrock
    system_prompt="You are a helpful agent.",
    tools=[file_editor, shell],
    plugins=[skills()],
)
agent("Hello!")

Strands loads an agent's skills once, so build the agent again after decimalai skills update.

The same install from Python, for a notebook or a setup script. Strands' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" strands-agents

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("pillar-labs-sail")
if result.exit_code:
    raise SystemExit(result.problems)

from decimalai.strands import skills
from strands import Agent
from strands.vended_tools import file_editor, shell

agent = Agent(
    model=model,                # always pass one: the default is Amazon Bedrock
    system_prompt="You are a helpful agent.",
    tools=[file_editor, shell],
    plugins=[skills()],
)
agent("Hello!")

Strands loads an agent's skills once, so build the agent again after decimalai skills update.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

Give it to your agent

from pathlib import Path
from strands import Agent

skill = Path(".agents/skills/pillar-labs-sail/SKILL.md").read_text()
agent = Agent(model=model, system_prompt=f"You are a helpful agent.\n\n{skill}")
agent("Hello!")

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Strands docs

Adds every file the skill has, pinned so you can update it. Cursor, Copilot, Cline and Warp read this folder by themselves.

pip install "decimalai>=0.15"
decimalai skills add pillar-labs-sail

No Python or account. Cursor, Copilot, Cline and Warp read this folder by themselves.

Save it into your project

curl -fsSL --create-dirs -o .agents/skills/pillar-labs-sail/SKILL.md https://app.decimal.ai/s/pillar-labs-sail/SKILL.md

Copy SKILL.md

Save it in your project, as

.agents/skills/pillar-labs-sail/SKILL.md

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Cursor and other editors docs

Fetch the file and give its text to your model as instructions. No account or package needed.

Get the file

curl -fsSL https://app.decimal.ai/s/pillar-labs-sail/SKILL.md

Read the summary as JSON

curl -fsSL https://app.decimal.ai/s/pillar-labs-sail.json

This gets SKILL.md only. The skill's 11 other files are not included.

Other ways to add it

Other setups docs

You don't need a DecimalAI account.

Version: v1, tested 8/3/2026
Source: pillar-labs/sail-skill ↗
License: NOASSERTION

Manage it in DecimalAI

Saved prompts and skills, pinned versions, and traces of this skill in your runs. DecimalAI does not run your agent.

Claude Code reads files from your project, so DecimalAI config does not apply there.

On Claude Agent SDK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On OpenAI Agents: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On OpenAI SDK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Anthropic: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Gemini API: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On LangChain: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On CrewAI: set DECIMAL_API_KEY and add decimalai.init(crewai=True) to record runs and skill use. The skill version stays in your repo.

On Google ADK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Pydantic AI: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Deep Agents: set DECIMAL_API_KEY and add decimalai.init(langchain=True) to record runs and skill use. The skill version stays in your repo.

On Microsoft Agent Framework: set DECIMAL_API_KEY and add decimalai.init(otel=True, agent_name="support") to record runs and skill use. The skill version stays in your repo.

On Strands: set DECIMAL_API_KEY and add decimalai.init(otel=True, agent_name="support") to record runs and skill use. The skill version stays in your repo.

Editors read files from your project, so DecimalAI config does not apply there.

Anywhere else: record a use with decimalai.log_skill_activation() inside a trace.

Use this skill

SKILL.md

SAIL V2 — Secure AI Lifecycle Framework

SAIL is Pillar Security's framework for building, deploying, and operating AI systems and agents securely. It is a working tool, not a reading exercise: users bring real systems, policies, and compliance obligations, and expect concrete, catalog-grounded answers. Whether they are writing their first AI policy or already operating hundreds of agents, SAIL is used to:

Build an AI security roadmap — walk the seven phases in order, assess coverage at each; the gaps, sequenced by phase, become the roadmap.
Assess AI security maturity — score each relevant risk (unaddressed / partially mitigated / mitigated with evidence) into a per-phase maturity profile trendable over time.
Generate a compliance checklist — filter the catalog by the framework the user is accountable to (ISO/IEC 42001, EU AI Act, OWASP, DASF, AIUC-1).
Prioritize controls — focus on risks that intersect the user's zones, assets, and weakest phase; autonomy tiers (SAIL 1.11) set control intensity per agent.
Run vendor assessments and RFPs — turn the catalog into a general RFP questionnaire (for security vendors or platform vendors), with questions mapped back to SAIL risk clusters.
Align security, legal, compliance, and engineering — SAIL IDs give all four teams one shared vocabulary for design reviews, risk registers, and exception requests.

Each has a workflow below.

Core structure (memorize this, cite it constantly)

Three zones define where agentic risk materializes (drawn by where the risk lands, not where the process runs):

Zone 1 — AI Assets in Code & Pipeline: models, datasets, prompts, agent configs, AI-generated code as artifacts in repos and CI/CD. Static surface; a poisoned artifact propagates into every build.
Zone 2 — Cloud Agents: agents executing inside managed platforms (Copilot Studio, Agentforce, Bedrock AgentCore, etc.) under platform-issued identities.
Zone 3 — Endpoint Agents: agents running on user devices with user credentials (Claude Code, Cursor, browser agents).

Seven lifecycle phases define when controls apply. Each phase has a numbered risk catalog — 91 risks total, each with an ID like SAIL 3.4:

Phase	Name	Lifecycle stage	Risk IDs
1	AI Policy	Plan	SAIL 1.x
2	AI Discovery	Code/No Code	SAIL 2.x
3	Agentic Posture Management	Build	SAIL 3.x
4	Agentic Red Teaming	Test	SAIL 4.x
5	Runtime Controls	Deploy	SAIL 5.x
6	Sandbox	Operate	SAIL 6.x
7	Govern	Monitor & Retire	SAIL 7.x

Every risk row in the catalog carries: description, concrete example, assets affected, mitigations, and standards mappings (ISO/IEC 42001, EU AI Act, OWASP LLM Top 10, OWASP Agentic, DASF, AIUC-1). SAIL IDs are the shared vocabulary — always cite them (e.g., "this maps to SAIL 5.17") so security, legal, compliance, and engineering can reference the same rows in risk registers and design reviews.

Ground every answer in the catalog

Do not answer SAIL questions from general knowledge. The value of this skill is the actual catalog text — the mitigations, examples, and standards mappings the user's auditors and vendors will check against. Before making claims:

Read references/risk-index.md first — all 91 risks in one compact table (ID, name, one-line summary, phase, file). Use it to decide which risks are in scope.
Read the full phase file(s) for every risk you cite, so mitigations and standards mappings are quoted accurately, not paraphrased from memory.

Reference files

File	Contents	Read when
`references/risk-index.md`	All 91 risks: ID, name, summary, phase	Almost always — this is your map
`references/framework.md`	Executive summary, Chapter 1 (agentic workforce, the three zones with per-surface risk tables), Chapter 2 (phase overview, agentic stack components, how to use SAIL)	Explaining the framework, scoping zones, writing intros for deliverables
`references/phase-1-policy.md` … `phase-7-govern.md`	Full risk catalog per phase: descriptions, examples, assets, mitigations, standards mappings	Citing any risk in detail; building checklists, assessments, roadmaps
`references/definitions.md`	Appendix A: definitions of AI/agentic components (agent, MCP server, skill, agent identity, …)	Terminology disputes, glossaries for deliverables
`references/use-case.md`	Appendix B: worked FinTech example (agentic investment research platform)	User wants an example of SAIL applied end-to-end

Interactive intake — when invoked as `/sail` or the intent is unclear

In Claude Code (plugin install), four commands skip this intake and run their workflow immediately: /sail:assess, /sail:roadmap, /sail:comply, /sail:rfp. If the user's request already matches one of those workflows, behave the same way — go straight to it.

If the user invoked this skill directly with no task attached (e.g., typed /sail), or their request doesn't clearly match one workflow, don't guess — run a short intake. Use the AskUserQuestion tool if available; otherwise ask in plain text. Batch related questions — don't interrogate one at a time.

Step 0 — Detect the working context first. Before asking anything, look at where the skill was invoked. Quickly scan the current repo for agent artifacts: agent framework imports (LangGraph, CrewAI, AutoGen, LlamaIndex, the Agents SDK), agent/tool configs (agent.yaml, AGENTS.md, .cursor/rules, MCP configs like mcp.json / claude_desktop_config.json), system-prompt files, or tool/MCP-server definitions.

If the repo contains an agent, lead with assessing it. Make the first option "Assess the agent in this repository (SAIL gap analysis)" — the user is standing in an agent project; the highest-value move is to run the gap-analysis workflow on the code in front of you (extract the component inventory from the repo yourself; don't ask the user to describe what you can read). Offer the other deliverables after it. A good option list in this context:

Assess the agent in this repo — full SAIL gap analysis of the code here (default)
Create a vendor RFP — generate a security-vendor or platform RFP questionnaire from SAIL
Build a security roadmap / maturity assessment for the broader AI program
Generate a compliance checklist (ISO/IEC 42001, EU AI Act, OWASP, DASF, AIUC-1)
Prioritize controls / team-alignment artifact
Just ask questions about SAIL

Pick the chosen deliverable, then jump to the workflow (for agent assessment, run "Assess a system / gap analysis" directly against the repo). Only ask the remaining scoping that workflow needs.

If the repo has no agent (or the skill isn't in a code context), run the top-down program intake below — establish the program first, then what they're protecting, then the deliverable.

Question 1 — What kind of program is this? (single-select) This frames everything: the same catalog is filtered and sequenced differently depending on the mandate. Offer:

AI governance & compliance — policy, standards mapping, audit-readiness (leans Phases 1, 7 + compliance frameworks)
Agent / application security — securing specific agents or AI apps you build or run (leans Phases 3–6, gap analysis)
AI transformation / adoption — standing up AI safely at scale, building the security roadmap from scratch (leans full 7-phase roadmap + maturity)
Vendor / third-party assessment — evaluating a platform, tool, or MCP server before adoption
Incident / red-team readiness — testing and runtime defense posture (leans Phases 4–6)

Question 2 — What do you have in your org to protect? (MULTI-select) Users rarely have just one thing — capture the whole environment so the assessment scopes to their real asset mix. This maps directly to the zones and to the catalog's "Assets Affected" column. Offer (multi-select):

Custom-built AI agents (LangGraph/CrewAI/etc.) — Zone 2
Cloud/managed agent platforms (Copilot Studio, Agentforce, Bedrock…) — Zone 2
Endpoint/coding agents (Claude Code, Cursor) — Zone 3
LLM apps / SaaS with AI features — Zone 2
MCP servers, tools, plugins & integrations — Zone 1/2
AI models, datasets & RAG stores — Zone 1
Prompts, agent configs & AI code in repos/CI-CD — Zone 1
Not sure yet / help me discover what I have — (routes to the AI Discovery workflow, Phase 2)

Question 3 — Which deliverable do you want? Map the program + assets to a workflow and confirm which output they need: roadmap, maturity assessment, compliance checklist, control prioritization, vendor RFP, system gap analysis, team-alignment artifact, or just Q&A. Often Q1 already implies it — offer the best-fit as the default and let them redirect.

Then ask only the remaining scoping the chosen workflow needs (skip anything Q1/Q2 already answered):

Roadmap / maturity: What's already in place (policy, discovery, red teaming, runtime controls)?
Compliance checklist: Which framework — ISO/IEC 42001, EU AI Act, OWASP, DASF, AIUC-1?
Prioritize controls: Where do they feel weakest? Any fully autonomous agents?
Vendor assessment / RFP: Is this a security vendor (a product that protects your AI — the common case, → coverage questionnaire) or a platform/product vendor you'll build on (→ how-do-you-secure-it questionnaire)? Which specific vendor(s)? For platform vendors: what will agents built on it access?
System review: Architecture — components, tools/MCP servers, data access, autonomy level, where prompts/configs live. If a codebase or design doc is available, offer to extract this yourself instead of asking.
Align teams: Which artifact — design review template, risk register, exception request, glossary?

Confirm scope in one sentence, then run the matching workflow. Don't re-ask what they already told you.

If the user arrived with a fully-specified task, skip the intake entirely and go straight to the workflow.

Workflows

Pick the workflow matching the user's intent. All of them share the same skeleton: scope by zone → select risks from the index → pull detail from phase files → deliver with SAIL IDs cited.

Assess a system / gap analysis

This is the flagship deliverable — make it comprehensive. Two things make an assessment comprehensive: a component inventory in SAIL's own taxonomy, and a disposition for every risk in the catalog (not just highlights).

Build the component inventory first. Map every element of the user's system onto the SAIL component taxonomy — the 29 components in six layers defined in Appendix A (references/definitions.md; layer grouping in references/framework.md §2.2). If the user gave you a codebase or design doc, extract this yourself before asking questions. This inventory is not decoration: the catalog's "Assets Affected" column uses exactly these component names, so the inventory mechanically determines which risks apply.
Chart the components. Present the inventory as (a) a Mermaid diagram of the agent architecture, grouping components by zone with trust boundaries between them (user → agent harness → tools/MCP servers → data stores → external services), and (b) a table: user's element → SAIL component (Appendix A name) → layer → zone. Every SAIL component not present is a scoping fact worth one line — it excludes risk rows and shows the assessment considered them.
Sweep the full catalog. Walk all 91 rows of risk-index.md and give every risk a disposition — don't stop at the obvious hits:
- Gap — applies, nothing addresses it
- Partial — applies, some mitigation exists but incomplete
- Addressed — applies and mitigated (say what mitigates it)
- Verify — applies, but the user's description doesn't say either way; list the question to ask
- N/A — affected assets absent from the inventory (one-line reason; group these compactly) A risk applies if its Assets Affected intersect the component inventory. Read the full phase-file row for every risk dispositioned Gap/Partial/Verify so mitigations are quoted from the catalog, not invented.
Deliver as a markdown doc: executive summary with per-phase disposition counts → component chart (diagram + table) → findings by phase (each with SAIL ID, disposition, evidence, catalog mitigation adapted to the user's stack) → prioritized recommendations (autonomy tier per SAIL 1.11 drives control intensity) → the compact N/A table last. State the coverage explicitly ("all 91 catalog risks dispositioned") so the reader knows nothing was skipped silently.

Build an AI security roadmap

Walk the seven phases in order and assess coverage at each. The gaps, sequenced by phase, are the roadmap: Phase 1 gaps come first because later controls need policy backing (e.g., runtime action authorization in SAIL 5.x presumes the policy of SAIL 1.12 exists). Present as a phased plan with SAIL IDs, quick wins flagged separately from structural work.

Assess AI security maturity

Score each relevant risk — unaddressed / partially mitigated / mitigated with evidence — to produce a per-phase maturity profile the user can trend over time. Use the three zones to determine which risks apply to their environment before scoring; scoring risks that can't apply inflates noise. Output a per-phase summary table plus the detailed scored rows.

Generate a compliance checklist

Filter the catalog by the framework the user is accountable to (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF, AIUC-1). Grep the phase files for that framework's tag in the Standards Mapping column, then present the matching risks as a control checklist in that framework's language (article/control numbers first, SAIL IDs as cross-reference). State plainly: mappings indicate alignment, not automatic compliance.

Prioritize controls

Focus on risks at the intersection of: the user's zones, the assets they actually have, and their weakest phase. Autonomy tiers (SAIL 1.11) set control intensity per agent — a fully autonomous agent warrants stricter controls than a supervised assistant for the same risk row. Deliver a ranked list with a one-line justification per item.

Vendor assessment / RFP questions

The deliverable is a markdown RFP questionnaire the user can send directly to vendors — self-contained, professionally framed, with instructions and space for vendor responses.

Do not emit one question per SAIL risk. A 60-line questionnaire that mirrors the catalog row-for-row is unusable in a real procurement. Instead, write a tight set of general, well-crafted RFP items shaped by the user's stated focus, and map each item to the SAIL cluster it covers. The SAIL mapping is a citation on the question, not the question itself. A mapping can be:

Broad — a whole phase, e.g. "SAIL Phase 1 (policy)" or "SAIL 5.x (runtime)"
A range/cluster — e.g. "SAIL 5.17–5.20" for a group of related runtime-identity risks
A themed list — e.g. "SAIL 1.13, 5.17, 5.20" pulled from across phases for one identity question

How to build it:

Select the SAIL risks in scope from the user's answers (their zones, assets, and program focus — e.g. an identity-focused engagement pulls the identity risks across phases). Don't include the whole catalog by default; include what their focus implies.
Cluster those risks into procurement themes — identity & authorization, tool/action permissions, data access & leakage, supply-chain & vetting, runtime enforcement & oversight, audit & governance, etc. Each theme becomes one to a few general questions, not one per underlying risk.
Write the question at the buyer's altitude, then annotate it with the SAIL cluster it maps to so answers still trace back to the risk register.

The framing flips by which kind of vendor is being assessed:

Security vendor (a product whose job is to protect the user's AI — detection, guardrails, posture management, red-teaming, runtime defense). Most common case. Frame items as coverage questions: does the product address this cluster of risks, and how? Ask for mechanism (build-time scan / runtime enforcement / monitoring-only), depth (detect vs. prevent vs. remediate), and evidence (how coverage is demonstrated, not just claimed). Give each item a response template: Covered fully / Partial / Not covered, plus "how" and "evidence." Example item — "How does your product govern agent identity and prevent privilege inheritance across agents and their makers?" → maps to SAIL 1.13, 5.17, 5.20.
Platform / product vendor (an agent platform or AI product the user will build on or adopt — Copilot Studio, Agentforce, a SaaS-with-AI). The vendor may introduce the risk, so ask how they control it in their own platform: "How does your platform decouple a maker's identity from an agent's runtime identity, and scope agent permissions?" → maps to SAIL 5.17, 5.20. Scope to the risks that platform's assets create (often Zone 2 + Phase 5).

Structure the output as: short intro (scope + how to respond) → themed sections, each with a few general questions carrying their SAIL-cluster mapping and (for security vendors) the coverage response template → a closing section naming the highest-severity risk clusters so the buyer knows which answers matter most. If it's unclear which kind of vendor, ask — it changes every question's framing.

Align security, legal, compliance, and engineering

When the user needs cross-team artifacts — design review templates, risk register entries, exception requests, or a shared glossary — anchor every item to a SAIL ID so all four teams reference the same catalog row. A risk register entry should carry: SAIL ID, risk name, the team owning the mitigation, current status, and the standards mappings legal/compliance care about. For terminology disagreements, references/definitions.md is the arbiter. The point is one vocabulary: engineering argues about the mitigation, not about what the risk is called.

Guide secure AI development

When the user is building agent/LLM features (with or without mentioning SAIL): identify which risks the code in front of you triggers (tool definitions → MCP vetting risks, agent memory → memory poisoning, new credentials → agent identity risks), name them by SAIL ID, and apply the catalog's mitigations in the implementation itself — not as a lecture afterward.

Answer questions about SAIL

For "what is SAIL X.Y" or conceptual questions, read the relevant reference file and answer from it, quoting the catalog's own example when it helps. If asked about something the framework genuinely doesn't cover, say so rather than stretching a mapping.

Output conventions

Cite SAIL IDs inline everywhere a risk is referenced.
For deliverables (assessments, checklists, roadmaps), default to a markdown document with: scope (zones + components), findings/controls table with SAIL IDs, and recommendations. Match the compliance framework's own vocabulary when one was specified.
Keep the framework's stance: SAIL is practitioner-oriented and vendor-neutral in its guidance. Recommendations should be actionable controls, not marketing.

When it activates

Automatically, when a task matches. Use this skill whenever the user asks about AI or agent security — assessing an AI system or agent architecture for risks, building an AI security roadmap or maturity assessment, writing or reviewing an AI security policy, creating compliance checklists (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF, AIUC-1), prioritizing AI security controls, evaluating AI vendors or tools (RFPs, secur

About this skill

Automatic

Security & AppSec pack

SkillSafety

✓ 3 of 3 passed

Code scan14 of 15 checks clean

0 critical · 0 warning · 1 info — scanner v4 — 8/1/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

No issues (informational notes only).

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

pillar-labs / sail-skill

sail/skills/sail/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/1/2026Version v1Bundled 11 files

Illustrative Want to see what pillar-labs/sail would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Related skills

Skills that do similar work, with their headline benchmark lift.

From the same source and nearby in the catalogue.

Ready to supercharge your AI agents?

SkillScore

Safety

What it changes

Track record

Use this skill

SAIL V2 — Secure AI Lifecycle Framework

Core structure (memorize this, cite it constantly)

Ground every answer in the catalog

Reference files

Interactive intake — when invoked as /sail or the intent is unclear

Workflows

Assess a system / gap analysis

Build an AI security roadmap

Assess AI security maturity

Generate a compliance checklist

Prioritize controls

Vendor assessment / RFP questions

Align security, legal, compliance, and engineering

Guide secure AI development

Answer questions about SAIL

Output conventions

When it activates

SkillSafety

Source

Related skills

More in the registry

Interactive intake — when invoked as `/sail` or the intent is unclear