Palantir Foundry CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:29 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate Palantir Foundry CLI reference skill, but it needs review because it normalizes powerful live data, admin, credential, and deletion workflows with weak safety guidance.

Install only if you intentionally want an agent to help with Palantir Foundry CLI operations and you are prepared to supervise live data and admin actions. Use least-privilege Foundry credentials, avoid production profiles unless necessary, do not paste secrets into command arguments, pin and verify the pltr-cli package, review all exports before writing them locally, and require explicit human approval before deletes, permission changes, imports with --execute, stream publishes, ontology actions, schedule changes, or commands using --force/--yes/--confirm.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: reference/quick-start.md:3

Finding

Unpinned Installation of an Executable Third-Party Dependency

Content

View full analysis

Remediation

View remediation

``` Then install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Document the canonical package publisher, official source repository, and expected package index so users can detect similarly named or substituted packages. 5. Prefer isolated installation through `pipx` or a dedicated virtual environment, while noting that isolation is not a substitute for version pinning and integrity verification. 6. In CI/CD, use a vetted internal package mirror or artifact repository and prevent unrestricted dependency resolution from public indexes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: reference/quick-start.md:42

Finding

OAuth Client Secret Passed Through a Command-Line Argument

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

# Interactive shell mode
pltr shell

# Send message to Claude model
pltr language-models anthropic messages ri.language-models.main.model.xxx \
    --message "Explain this concept"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference/connectivity-commands.md (reported line 59)May include surrounding context.

Secrets must be provided via file for security (avoids shell history exposure)

Example (secrets.json: {"password": "secret123", "api_key": "abc..."})

pltr connectivity connection update-secrets ri.conn.main.connection.12345
--secrets-file secrets.json

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference/connectivity-commands.md (reported line 61)May include surrounding context.

Secrets must be provided via file for security (avoids shell history exposure)

Example (secrets.json: {"password": "secret123", "api_key": "abc..."})

pltr connectivity connection update-secrets ri.conn.main.connection.12345
--secrets-file secrets.json

text

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · reference/mediasets-commands.md (reported line 87)May include surrounding context.

md

# Options:
#   --original      Download original version
#   --overwrite     Overwrite existing file
#   --preview       Enable preview mode

# Examples

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · reference/mediasets-commands.md (reported line 129)May include surrounding context.

md

# Options:
#   --original      Download original version
#   --overwrite     Overwrite existing file
#   --preview       Enable preview mode

# Examples

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad, common terms like "dataset," "SQL query," and "build," which can cause the skill to activate in situations beyond its intended scope. Because this skill enables powerful administrative and data-access CLI workflows, accidental invocation increases the chance that an agent will suggest or perform sensitive operations in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises administrative, orchestration, filesystem, connectivity, streaming, and dataset-management capabilities without clear guardrails about destructive, irreversible, or privilege-sensitive actions. In practice, this can normalize high-risk commands and lead users or agents to execute writes, copies, publishes, role changes, or other impactful operations without confirmation, scope checks, or least-privilege review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly instructs exporting user and group inventories, including searches for admins, to local CSV/JSON files without any warning about sensitive identity data handling, storage location, retention, or access controls. In an admin-focused skill, this increases the likelihood of creating unprotected local datasets that can leak user identities, group structures, or privileged account information if stored on shared machines or synced directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples encourage exporting full session history and session details to local JSON files without warning that conversation transcripts may contain sensitive user prompts, model outputs, credentials, proprietary data, or other regulated content. In a documentation skill, this omission can normalize unsafe handling of sensitive data and lead users to persist confidential session content to insecure local storage or shared workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown describes the --execute option for file imports and gives an example that immediately runs the import, which can transfer user data from a source path into a target dataset. The section does not include any warning that execution will initiate data movement or modify platform state, so users may not appreciate the side effects before copying the command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The table import section documents --execute and provides an example that runs the import immediately, which can ingest data from an external system into the target dataset. There is no nearby warning about the operational impact, data movement, or need to verify configuration before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This example performs a bulk file import from S3 with --execute, which can transfer many files into a dataset and have cost, privacy, or integrity implications. The markdown presents it as a ready-to-run command without any warning to confirm scope, data sensitivity, or destination before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file documents resource deletion commands, including a force flag, with minimal safety framing. In a skill or reference that may be used by an agent, documenting destructive operations without prominent warnings or preconditions increases the chance of accidental data loss or unsafe automated use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The project deletion command is presented alongside other routine project operations without a clear warning that it can remove important project state. In an agent-consumable command reference, this can normalize destructive actions and lead to unintended deletion if invoked from ambiguous user requests.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The example explicitly advertises using --force to skip confirmation for resource deletion. In an agent context, bypassing confirmation reduces a key human safety check and makes accidental or overly autonomous destructive action more likely.

Content

Scanner excerpt · reference/filesystem-commands.md (reported line 227)May include surrounding context.

Example

pltr resource delete ri.foundry.main.dataset.abc123

Skip confirmation prompt

pltr resource delete ri.foundry.main.dataset.abc123 --force

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This documentation instructs users to send arbitrary prompts and conversation history to external LLM services and to save model outputs to local files, but it does not warn that prompts may contain sensitive data or that responses written to disk may persist confidential or regulated information. In a command reference for networked AI services, omission of privacy and data-handling cautions can lead to accidental disclosure of secrets, internal documents, or personal data by otherwise well-intentioned users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation shows commit ... --yes as the default example for a state-changing operation without warning that it suppresses confirmation prompts. This can normalize unsafe copy-paste usage and make accidental irreversible publication of uploaded changes more likely, especially in automation or when operators do not fully review transaction contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The abort example uses --yes without warning that it discards all pending transaction uploads. Users copying the command may unintentionally destroy uncommitted work with no interactive safeguard, which is especially risky in transaction-based workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a state-changing command (pltr ontology action-apply) that can execute actions against an ontology, but it does not warn users that the command may modify data or trigger side effects. In a reference skill, omission of an execution warning increases the chance of accidental changes, especially when users copy-paste example commands directly into a live environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents a delete operation and even shows the non-interactive --yes form, but it does not include any warning that deleting a schedule can affect automation state or stop future runs. For markdown files, destructive behaviours that could affect system integrity or operations should be accompanied by a clear warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick-start instructs users to place sensitive credentials directly into environment variables and command-line arguments, including an OAuth client secret. In practice, these methods can leak through shell history, process listings, CI logs, or insecure local storage if users are not warned about safer handling, making credential compromise more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation encourages exporting SQL query results directly to local files but does not warn that query outputs may contain sensitive or regulated data. In a data-platform context, this can normalize insecure data handling and lead users to persist confidential records to unprotected local storage, increasing the chance of data leakage or mishandling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples repeatedly use broad SELECT * queries and full-result retrieval without caution about over-collecting sensitive or unnecessary data. In a Foundry dataset environment, this pattern can encourage excessive data access and export, which increases exposure of confidential information and may bypass least-privilege and data-minimization practices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown documents commands that publish records to a stream, including inline JSON examples and file-based batch uploads, but it does not warn users that data supplied via --record or --records will be transmitted to Foundry. Because these operations can send potentially sensitive user data off-host, the skill description should include a clear disclosure about data handling and sensitivity considerations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · reference/admin-commands.md (reported line 192)May include surrounding context.

md

# Options:
#   --branch, -b TEXT       Stream branch name to reset (required)
#   --confirm               Skip confirmation prompt
#   --preview               Enable preview mode
#   --format TEXT           Output format (table, json, csv)
#   --profile, -p TEXT      Profile name

Static analysis

No suspicious patterns detected.