Palantir Foundry CLI

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:28 AM UTC
• Version: 1.0.1

Overview

This is a documentation-only helper for Palantir Foundry CLI workflows; it covers powerful admin and data commands, but the behavior is disclosed and user-directed.

Install this only if you want agent help operating Palantir Foundry through pltr-cli. Use least-privilege and non-production profiles when possible, protect tokens and OAuth secrets, review every RID/profile before running commands, and require explicit approval for delete, --force, --yes, --confirm, --execute, permission changes, user/group administration, stream resets, external model calls, and production schedule operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes very broad terms such as 'dataset', 'SQL query', 'build', and 'RID', which are common in many unrelated contexts and can cause the skill to be invoked when the user did not explicitly intend to use this powerful Foundry CLI skill. Because the skill exposes admin, data access, and external-model operations, accidental invocation increases the risk of inappropriate guidance for sensitive actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill advertises sensitive capabilities including admin operations, dataset downloads, permissions management, external connectivity, and interactions with third-party language models, but it provides no user-facing warnings, consent guidance, or safety constraints. In this context, omission of guardrails is dangerous because it normalizes potentially destructive, privacy-impacting, or data-exporting actions without prompting additional verification.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The audit examples normalize exporting user, group, and potential admin data to local files without any warning about sensitivity, retention, or access controls. In an agent or automation context, this can encourage broad collection of identity and authorization data that may later be exposed through insecure storage, sharing, or logs.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples encourage exporting session history and session details to local files without warning that these files may contain sensitive conversation content, prompts, credentials, or personal data. In operational documentation, omission of a data-sensitivity warning can lead users to persist sensitive records insecurely or share them unintentionally.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example uses `--execute` to immediately run a file import, which can trigger real data ingestion against production connections or datasets if copied verbatim. In a CLI reference, this is dangerous because documentation is often executed directly by users, and there is no caution about side effects, validation, or use of a non-production target.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The table import example immediately executes ingestion without warning that data may be pulled from an external system and written into a target dataset. This can cause unintended sync jobs, duplicate ingestion, or modification of downstream data workflows when users follow the example in a live environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The common workflow explicitly instructs users to execute an import as part of a daily setup pattern, but it provides no caution about production side effects, scheduling implications, or potential duplicate/incorrect ingestion. Because this appears as a recommended pattern rather than a low-level command reference, users are even more likely to adopt it directly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The bulk S3 import example combines wildcard file ingestion, immediate execution, and output file creation without warning, increasing the risk of large unintended data loads and local artifact creation. In the connectivity/import context, this is especially sensitive because a copied example may ingest many files from external storage into a real dataset at once.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes destructive resource deletion commands, including a confirmation-bypass flag (`--force`), without consistently emphasizing data-loss risk at the point of use. In an agent skill context, terse operational examples can be copied or automated directly, increasing the chance of accidental or over-broad deletion by users or downstream agents.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The project deletion command is documented as a routine operation without an adjacent warning about destructive consequences or scope. In a skill intended for agent consumption, that omission can normalize unsafe execution and lead to accidental deletion of important projects or environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The permission-management examples grant powerful roles such as `owner` and `editor` and support bulk role changes, but they do not warn about privilege escalation, overexposure, or least-privilege concerns. In an agent skill, these commands can directly alter access control on sensitive resources, making accidental misuse or unsafe automation materially more dangerous than ordinary reference text.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The abort example uses `--yes` to immediately discard a transaction without warning that the action is irreversible for in-flight uploads. In a command reference, users often copy-paste examples, so omitting the consequence increases the risk of accidental data loss or disrupted workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes an action execution command that can modify ontology state, but it does not clearly warn users that running the example may perform real writes or side effects. In a command-reference skill, users may copy and paste examples directly, so omission of a mutation warning increases the chance of unintended data changes in production or sensitive environments.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The examples demonstrate writing command output to local files without warning that files will be created or potentially overwritten. This is lower severity than remote code execution or injection, but it can still lead to accidental data exposure, clobbering of existing files, or unintended persistence of sensitive exported ontology data on disk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation includes a destructive schedule deletion command using `--yes` without any warning that the action can remove active automation and may be difficult or impossible to recover quickly in production. In an orchestration/admin command reference, users are likely to copy-paste examples directly, so omission of an explicit caution materially increases the risk of accidental disruptive actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example documents immediate schedule execution without warning that it can trigger real jobs, data processing, notifications, or other downstream side effects. Because this is an orchestration command reference for operational systems, encouraging direct execution without caution can lead to unintended production runs and service impact.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The schedule creation and replacement examples show how to automate recurring build actions but do not warn that these commands can establish or modify persistent production automation. In this context, silent creation or replacement of schedules can cause repeated unintended executions, resource consumption, and operational disruption if copied blindly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to pass and export sensitive credentials such as API tokens and OAuth client secrets, but it does not warn about secure storage, shell history exposure, process listing risks, or secret leakage in CI/CD logs. In a quick-start context, users commonly copy and paste commands directly, which can lead to credential compromise even if the underlying software is not malicious.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example includes an immediate `pltr orchestration schedules delete ... --yes` command with no surrounding caution, confirmation guidance, or safer preview workflow. In an agent skill or copy-paste documentation context, this can directly normalize destructive actions against production schedules and lead to accidental service disruption or loss of automated data processing.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The external import examples use `--execute`, causing the import to run immediately against a real connection and target dataset without any warning about writes, overwrites, duplicate ingestion, or unintended sync effects. In this workflow-oriented skill, users may copy commands directly into production environments, making the side effects more dangerous than a purely conceptual example.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow includes executable examples that grant owner/editor/viewer roles, revoke access, create and delete groups, and export user/group inventories without any explicit warning that these commands change access control and system state. In a permission-management skill, users are likely to copy-paste commands directly; this increases the risk of accidental over-privileging, unintended access removal, or administrative changes in production environments.

Exfiltration Commands

High

• Category: Prompt Injection

Content

# Interactive shell mode
pltr shell

# Send message to Claude model
pltr language-models anthropic messages ri.language-models.main.model.xxx \
    --message "Explain this concept"

• Confidence: 89% confidence
• Finding: Send message to

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.