case
Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks…
@vigil-socInstall SkillSecurity
Skill
/hunt
Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use when asked to hunt for something.
Claude Code
$ npx -y skills add Vigil-SOC/vigil --skill hunt --agent claude-code
Codex
$ npx skills add Vigil-SOC/vigil --skill hunt -a codex -y
Cursor
$ npx skills add Vigil-SOC/vigil --skill hunt -a cursor -y
Gemini CLI
$ npx skills add Vigil-SOC/vigil --skill hunt -a gemini-cli -y
GitHub Copilot
$ npx skills add Vigil-SOC/vigil --skill hunt -a github-copilot -y
OpenCode
$ npx skills add Vigil-SOC/vigil --skill hunt -a opencode -y
Windsurf
$ npx skills add Vigil-SOC/vigil --skill hunt -a windsurf -y
SKILL.md
hunt.SKILL.mdname: hunt description: Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use when asked to hunt for something. argument-hint: <case id> <hypothesis>
Hunt
Have Vigil hunt for the hypothesis in `$ARGUMENTS` and bring back what it found.
Vigil's kernel does the work. This session starts it, steers it and reads it: it does not reason through a workflow itself, and it never acts on Vigil except through the `vigil` MCP tools.
Choose the hunt workflow from `list_workflows` (or an operator agent from `list_operator_agents`), and ask when more than one fits. A run starts on a case: use the case the analyst names, or ask whether to open one with `create_case`. Start it with `start_run`, the case id and the hypothesis, and give the analyst the run id.
Read progress with `get_run`, steer with `send_directive` only when asked, and point to `/vigil:waiting` if it pauses on an approval. Once it has ended, report its conclusion, citations and declared gaps as Vigil gave them. `list_completed_hunts` lists earlier hunts when the analyst asks what was already hunted.
Ships withvigil
Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.
43119 skills
Stars on GitHub
Momentum
- stars in total
- 431
Other skills on vigil.
@vigil-socInstall Skillinvestigate
Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when…
@vigil-socInstall Skillqueue
Show the open work in Vigil - findings waiting for triage and open cases. Use when asked what is in the queue, what needs looking…
@vigil-socInstall Skillstatus
Check whether this session's Vigil answers for its credential. Use when the Vigil tools fail, before first use, or when asked…
@vigil-socInstall Skilltrail
Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or…
@vigil-socInstall Skillwaiting
Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when…
@vigil-socInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about hunt.
- Which coding agents can use hunt?
- hunt installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.