Palantir Foundry CLI

Use the pltr CLI to query datasets, run SQL, manage builds, ontologies, projects, users, streams, AI agents, and ML models in Palantir Foundry.

Security Scan

The SKILL.md contains many actionable Foundry CLI commands and explicit authentication/env var instructions, but the skill metadata does not declare the required binaries, environment variables, or credentials—this mismatch and the references to third‑party LLM endpoints warrant caution.

Purpose & Capability

The skill claims to be a pltr (Palantir Foundry) CLI helper and includes many admin, dataset, orchestration, and streaming commands — that purpose justifies needing the pltr CLI and Foundry credentials. However, the registry metadata declares no required binaries, no required env vars, and no primary credential while the SKILL.md clearly expects the pltr CLI to be available and authentication via FOUNDRY_TOKEN/FOUNDRY_HOST. This mismatch between declared requirements and actual needs is incoherent.

Instruction Scope

The runtime instructions instruct the agent to run many high-privilege operations (copy datasets, download files, manage users/roles, publish stream records) and to supply/verify authentication. They also reference sending messages to Anthropic Claude and generating OpenAI embeddings. The instructions allow reading and exporting dataset files to local paths and interacting with external LLM endpoints, which could be used to move sensitive data off-platform. The SKILL.md gives the agent broad operational capabilities beyond simple read-only queries.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so there is nothing being downloaded or written by an installer. That lowers supply-chain risk, but it also means the skill assumes existing local tools (pltr, Python SDK) are present without declaring them.

Credentials

The SKILL.md explicitly documents environment variables (FOUNDRY_TOKEN, FOUNDRY_HOST) and references external LLM usage (Anthropic/OpenAI) but the skill metadata lists zero required env vars and no primary credential. Sensitive credentials are implied but not declared. That mismatch hides the fact that using the skill requires access to potentially sensitive tokens and third-party API keys (not documented in metadata), which is disproportionate to the explicit registry declaration.

Persistence & Privilege

The skill is not marked always:true and there is no OS restriction, but disableModelInvocation is not set (defaulting to allowing model invocation). That means the agent could call this skill autonomously if platform policy permits. Combined with the skill's ability to run high-privilege pltr commands and the undeclared requirement for Foundry credentials, this raises a risk that the model could perform sensitive operations without explicit user prompts—consider requiring manual invocation or disabling autonomous invocation for high-privilege skills.

What to consider before installing

This skill's documentation expects the pltr CLI and Foundry credentials (FOUNDRY_TOKEN/FOUNDRY_HOST) and even references Anthropic/OpenAI usage, but the registry metadata does not declare those requirements. Before installing or enabling it: 1) Confirm where and how pltr is installed on your agent environment and whether the agent will actually have the pltr binary available. 2) Verify how Foundry credentials would be provided—do not place tokens in an unrestricted environment variable if you don't want the model to access them. 3) Ask the publisher to update metadata to declare required env vars and binaries (ANTHROPIC/OPENAI keys if used). 4) Limit invocation scope (disable autonomous model invocation for this skill or require explicit user consent) and restrict credentials to least privilege. 5) Audit any workflows that download or export dataset files and avoid sending sensitive data to external LLM endpoints unless you understand and accept the data residency/privacy implications.

pltr-cli: Palantir Foundry CLI

This skill helps you use the pltr-cli to interact with Palantir Foundry effectively.

Compatibility

• Skill version: 1.1.0
• pltr-cli version: 0.12.0+
• Python: 3.9, 3.10, 3.11, 3.12
• Dependencies: foundry-platform-sdk >= 1.69.0

Overview

pltr-cli is a comprehensive CLI with 100+ commands for:

• Dataset operations: Get info, list files, download files, manage branches and transactions
• SQL queries: Execute queries, export results, manage async queries
• Ontology: List ontologies, object types, objects, execute actions and queries
• Orchestration: Manage builds, jobs, and schedules
• Filesystem: Folders, spaces, projects, resources
• Admin: User, group, role management
• Connectivity: External connections and data imports
• MediaSets: Media file management
• Language Models: Interact with Anthropic Claude models and OpenAI embeddings
• Streams: Create and manage streaming datasets, publish real-time data
• Functions: Execute queries and inspect value types
• AIP Agents: Manage AI agents, sessions, and versions
• Models: ML model registry for model and version management

Critical Concepts

RID-Based API

The Foundry API is RID-based (Resource Identifier). Most commands require RIDs:

• Datasets: ri.foundry.main.dataset.{uuid}
• Folders: ri.compass.main.folder.{uuid} (root: ri.compass.main.folder.0)
• Builds: ri.orchestration.main.build.{uuid}
• Schedules: ri.orchestration.main.schedule.{uuid}
• Ontologies: ri.ontology.main.ontology.{uuid}

Users must know RIDs in advance (from Foundry web UI or previous API calls).

Authentication

Before using any command, ensure authentication is configured:

# Configure interactively
pltr configure configure

# Or use environment variables
export FOUNDRY_TOKEN="your-token"
export FOUNDRY_HOST="foundry.company.com"

# Verify connection
pltr verify

Output Formats

All commands support multiple output formats:

pltr <command> --format table    # Default: Rich table
pltr <command> --format json     # JSON output
pltr <command> --format csv      # CSV format
pltr <command> --output file.csv # Save to file

Profile Selection

Use --profile to switch between Foundry instances:

pltr <command> --profile production
pltr <command> --profile development

Reference Files

Load these files based on the user's task:

Task Type	Reference File
Setup, authentication, getting started	reference/quick-start.md
Dataset operations (get, files, branches, transactions)	reference/dataset-commands.md
SQL queries	reference/sql-commands.md
Builds, jobs, schedules	reference/orchestration-commands.md
Ontologies, objects, actions	reference/ontology-commands.md
Users, groups, roles, orgs	reference/admin-commands.md
Folders, spaces, projects, resources, permissions	reference/filesystem-commands.md
Connections, imports	reference/connectivity-commands.md
Media sets, media items	reference/mediasets-commands.md
Anthropic Claude models, OpenAI embeddings	reference/language-models-commands.md
Streaming datasets, real-time data publishing	reference/streams-commands.md
Functions queries, value types	reference/functions-commands.md
AIP Agents, sessions, versions	reference/aip-agents-commands.md
ML model registry, model versions	reference/models-commands.md

Workflow Files

For common multi-step tasks:

Workflow	File
Data exploration, SQL analysis, ontology queries	workflows/data-analysis.md
ETL pipelines, scheduled jobs, data quality	workflows/data-pipeline.md
Setting up permissions, resource roles, access control	workflows/permission-management.md

Common Commands Quick Reference

# Verify setup
pltr verify

# Current user info
pltr admin user current

# Execute SQL query
pltr sql execute "SELECT * FROM my_table LIMIT 10"

# Get dataset info
pltr dataset get ri.foundry.main.dataset.abc123

# List files in dataset
pltr dataset files list ri.foundry.main.dataset.abc123

# Download file from dataset
pltr dataset files get ri.foundry.main.dataset.abc123 "/path/file.csv" "./local.csv"

# Copy dataset to another folder
pltr cp ri.foundry.main.dataset.abc123 ri.compass.main.folder.target456

# List folder contents
pltr folder list ri.compass.main.folder.0  # root folder

# Search builds
pltr orchestration builds search

# Interactive shell mode
pltr shell

# Send message to Claude model
pltr language-models anthropic messages ri.language-models.main.model.xxx \
    --message "Explain this concept"

# Generate embeddings
pltr language-models openai embeddings ri.language-models.main.model.xxx \
    --input "Sample text"

# Create streaming dataset
pltr streams dataset create my-stream \
    --folder ri.compass.main.folder.xxx \
    --schema '{"fieldSchemaList": [{"name": "value", "type": "STRING"}]}'

# Publish record to stream
pltr streams stream publish ri.foundry.main.dataset.xxx \
    --branch master \
    --record '{"value": "hello"}'

# Execute a function query
pltr functions query execute myQuery --parameters '{"limit": 10}'

# Get AIP Agent info
pltr aip-agents get ri.foundry.main.agent.abc123

# List agent sessions
pltr aip-agents sessions list ri.foundry.main.agent.abc123

# Get ML model info
pltr models model get ri.foundry.main.model.abc123

# List model versions
pltr models version list ri.foundry.main.model.abc123

Best Practices

1. Always verify authentication first: Run pltr verify before starting work
2. Use appropriate output format: JSON for programmatic use, CSV for spreadsheets, table for readability
3. Use async for large queries: pltr sql submit + pltr sql wait for long-running queries
4. Export results: Use --output to save results for further analysis
5. Use shell mode for exploration: pltr shell provides tab completion and history

Getting Help

pltr --help                    # All commands
pltr <command> --help          # Command help
pltr <command> <sub> --help    # Subcommand help