hunt
Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use…
@vigil-socInstall SkillSecurity
Skill
/case
Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks to look at a case.
Claude Code
$ npx -y skills add Vigil-SOC/vigil --skill case --agent claude-code
Codex
$ npx skills add Vigil-SOC/vigil --skill case -a codex -y
Cursor
$ npx skills add Vigil-SOC/vigil --skill case -a cursor -y
Gemini CLI
$ npx skills add Vigil-SOC/vigil --skill case -a gemini-cli -y
GitHub Copilot
$ npx skills add Vigil-SOC/vigil --skill case -a github-copilot -y
OpenCode
$ npx skills add Vigil-SOC/vigil --skill case -a opencode -y
Windsurf
$ npx skills add Vigil-SOC/vigil --skill case -a windsurf -y
SKILL.md
case.SKILL.mdname: case description: Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks to look at a case. argument-hint: <case id>
Case
Give the analyst one case, `$ARGUMENTS`, and its evidence as a brief.
Vigil's kernel does the work. This session starts it, steers it and reads it: it does not reason through a workflow itself, and it never acts on Vigil except through the `vigil` MCP tools.
Read it with `get_case`, `get_case_iocs` and `get_case_comments`; `get_case_tasks` and `list_runs` with the case id when tasks or past runs bear on it. Lead with what the case is about, its status and severity, then the findings, IOCs and the latest comments. Cite ids as Vigil returns them; do not invent evidence the tools did not return. If no case id was given, ask for one or offer `/vigil:queue`.
Changing the case (comments, IOCs, status, closing) goes through the case write tools only when the analyst asks for that change; each is recorded on the trail under the credential's person.
Ships withvigil
Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.
43119 skills
Stars on GitHub
Momentum
- stars in total
- 431
Other skills on vigil.
@vigil-socInstall Skillinvestigate
Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when…
@vigil-socInstall Skillqueue
Show the open work in Vigil - findings waiting for triage and open cases. Use when asked what is in the queue, what needs looking…
@vigil-socInstall Skillstatus
Check whether this session's Vigil answers for its credential. Use when the Vigil tools fail, before first use, or when asked…
@vigil-socInstall Skilltrail
Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or…
@vigil-socInstall Skillwaiting
Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when…
@vigil-socInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about case.
- Which coding agents can use case?
- case installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.