From securitypal-ai
Answer customer security questions, audit knowledge-library coverage, and find gaps in a customer's SecurityPal content. Use when Codex needs to ask SecurityPal AI questions, search source documents, list libraries, inspect tags and instruction sets, identify expired or under-described documents, verify Knowledge Library capabilities, or retrieve customer-specific autocomplete suggestions.
How this skill is triggered — by the user, by Claude, or both
Slash command
/securitypal-ai:securitypal-aiThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill to work against SecurityPal AI and Knowledge Library public endpoints with a customer's API token.
Use this skill to work against SecurityPal AI and Knowledge Library public endpoints with a customer's API token.
SECURITYPAL_API_TOKEN is already set.
export SECURITYPAL_API_TOKEN='your_customer_token_here'
https://app.securitypalhq.com/api unless SECURITYPAL_API_BASE_URL is set.
/api in the base URL. Helper command paths are normalized as /v1/..., producing full URLs like /api/v1/auth/me.python3 scripts/securitypal_copilot_api.py me
python3 scripts/securitypal_copilot_api.py kb-capabilities
knowledge-library-rag-based-enabled is enabled, use the RAG source model.rag-enabled only as a fallback/debug endpoint when auth/me does not expose usable feature flags.libraryId is already known.
python3 scripts/securitypal_copilot_api.py list-libraries
id in later commands as --library-id <id>.scripts/securitypal_copilot_api.py list-librarieslist-tags, list-documents, list-instructions, list-memories, or rag-enabledlibrary-audit when the user wants to understand what is in a customer's Knowledge Library or what needs cleanup.library-audit for read-only document/instruction inventory and hygiene reportsexpired-documents when the user asks what documents are expired or need reviewknowledge-gaps when the user asks what is missing for a topicanswer-kb for normal library-scoped Q&A when you want the helper to route by source modelanswer for legacy library-scoped Q&A when the caller has knowledge-library-rag-based-enabled disabled or missingsearch when the request should be constrained to specific document IDsanswer-from-documents for RAG document questions when knowledge-library-rag-based-enabled is enabledadd-document when the user asks to add or upload a Knowledge Library document and their token can access the signed upload and finalize endpointsget-autocomplete to fetch previously generated autocomplete resultsUse auth/me as the source of truth for source-model routing.
knowledge-library-rag-based-enabled missing or false):
answer or answer-kbknowledge-library-rag-based-enabled true):
answer-from-documents or answer-kbFor broad questions like "Based on my knowledge library, do we encrypt data at rest?", prefer:
python3 scripts/securitypal_copilot_api.py answer-kb --library-id 123 --question "Do we encrypt data at rest?" --include-sources
SECURITYPAL_API_TOKEN.When the token or library ID is missing, use this sequence:
export SECURITYPAL_API_TOKEN='your_customer_token_here'
python3 scripts/securitypal_copilot_api.py me
python3 scripts/securitypal_copilot_api.py kb-capabilities
python3 scripts/securitypal_copilot_api.py list-libraries
python3 scripts/securitypal_copilot_api.py answer-kb --library-id 123 --question "Do you encrypt data at rest?" --include-sources
If the user does not know the correct library, never guess. List libraries first and let the returned IDs drive later requests.
Use the helper script for JSON endpoints:
python3 scripts/securitypal_copilot_api.py list-libraries
python3 scripts/securitypal_copilot_api.py me
python3 scripts/securitypal_copilot_api.py kb-capabilities
python3 scripts/securitypal_copilot_api.py list-tags --library-id 123
python3 scripts/securitypal_copilot_api.py list-documents --library-id 123 --limit 20
python3 scripts/securitypal_copilot_api.py list-memories --library-id 123
python3 scripts/securitypal_copilot_api.py add-document --library-id 123 --file /absolute/path/policy.pdf --tag-id TAG_UUID
python3 scripts/securitypal_copilot_api.py library-audit --library-id 123 --format markdown
python3 scripts/securitypal_copilot_api.py library-audit --format json
python3 scripts/securitypal_copilot_api.py expired-documents --library-id 123 --format markdown
python3 scripts/securitypal_copilot_api.py knowledge-gaps --library-id 123 --topic "data retention"
python3 scripts/securitypal_copilot_api.py answer-kb --library-id 123 --question "Do you encrypt data at rest?" --include-sources
python3 scripts/securitypal_copilot_api.py answer --library-id 123 --question "Do you encrypt data at rest?" --include-sources
python3 scripts/securitypal_copilot_api.py search --library-id 123 --question "How is SSO enforced?" --document-id 11111111-1111-1111-1111-111111111111
python3 scripts/securitypal_copilot_api.py answer-from-documents --library-id 123 --question "Summarize incident response testing."
python3 scripts/securitypal_copilot_api.py get-autocomplete --request-id REQUEST_UUID --product-id 123
Use library-audit for read-only Knowledge Library cleanup reports. It fetches accessible libraries, document inventory, instruction sets, and RAG availability, then flags likely issues:
reviewed_at plus the day-based review_cycleMarkdown output is intended for a customer-facing summary. JSON output preserves the audited documents, instructions, issue counts, and endpoint errors for follow-up automation.
Use expired-documents for "which documents are expired?" requests. It reuses the audit inventory and returns a focused report with document id, name, reviewed date, day-based review cycle, computed expiration date, and issue reason.
Example:
python3 scripts/securitypal_copilot_api.py expired-documents --library-id 123 --format markdown
Issue reasons:
expired: the document has a review date and its day-based review cycle has elapsed.missing_review_date: the document has a review cycle but no review date. Treat this separately from expired documents.Use knowledge-gaps for "what are we missing for ?" requests. It calls auth/me first, then formats gaps according to the source model:
Example:
python3 scripts/securitypal_copilot_api.py knowledge-gaps --library-id 123 --topic "data retention"
Use add-document for "add this document" requests when the token can access document upload endpoints. The helper performs the three-step upload flow:
POST /v1/libraries/{library_id}/documents/request-upload-urlPUT the local file to the returned signed upload URLPOST /v1/libraries/{library_id}/documents/finalize-uploadExample:
python3 scripts/securitypal_copilot_api.py add-document --library-id 123 --file /absolute/path/policy.pdf
Optional metadata:
python3 scripts/securitypal_copilot_api.py add-document \
--library-id 123 \
--file /absolute/path/policy.pdf \
--tag-id TAG_UUID \
--owner-user-id 42 \
--review-cycle 12 \
--reviewed-at 2026-05-01T00:00:00Z \
--reviewed-by-user-id 42
After upload, route follow-up expectations by source model:
rag_corpus_sync_status with list-documents or library-audit.The helper script intentionally focuses on the JSON endpoints. For multipart endpoints, use curl or extend the script carefully:
POST /v1/copilot/request-autocompletePOST /v1/copilot/generate-selectorsThe backend route prefix still uses copilot for compatibility; the user-facing product name is SecurityPal AI.
Read references/api-reference.md for field expectations and example curl payloads.
includeSources, includeLibrary, or includeTags are requested, preserve those relationships in your summary.403, explain that the token likely lacks the relevant permission for that endpoint.404, verify the selected library, document IDs, request ID, or account scope.504, report the timeout and suggest retrying or narrowing the request.Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub securitypal/securitypalai-claude-marketplace --plugin securitypal-ai