Skip to content
Security
Skill

/investigate

Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when asked to investigate a case.

From plugin
vigil
43119 skills

Claude Code

$ npx -y skills add Vigil-SOC/vigil --skill investigate --agent claude-code

SKILL.md

investigate.SKILL.md
name: investigate
description: Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when asked to investigate a case.
argument-hint: <case id> [what to look at]

Investigate

Have Vigil investigate the case in `$ARGUMENTS` and bring back what it concluded.

Vigil's kernel does the work. This session starts it, steers it and reads it: it does not reason through a workflow itself, and it never acts on Vigil except through the `vigil` MCP tools.

Choose what to start from `list_workflows` (an investigation workflow) or `list_operator_agents` (an operator agent starts as `agent-run-<id>`); ask when more than one fits. Start it with `start_run` and the case id, passing the analyst's question as `context` or `hypothesis`. Give the analyst the run id.

While it runs, `get_run` shows its status. Steer it only when the analyst asks, with `send_directive` (a note, a lead, extend, conclude or abort). If it pauses on an approval, say what it waits on and point to `/vigil:waiting`.

Read the conclusion only after the run has ended: `get_run` then returns the conclusion, disposition, citations and declared gaps. Report them as Vigil gave them, gaps included; do not fill a gap with your own reasoning. A run that ends failed or cancelled is reported with its reason.

@vigil-soc
Ships withvigil

Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.

Stars on GitHub

Momentum

stars in total
431
Star history of Vigil-SOC/vigil on GitHub, a chart by star-history.com

Other skills on vigil.

case

case

Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks…

@vigil-soc@vigil-socInstall Skill
hunt

hunt

Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use…

@vigil-soc@vigil-socInstall Skill
queue

queue

Show the open work in Vigil - findings waiting for triage and open cases. Use when asked what is in the queue, what needs looking…

@vigil-soc@vigil-socInstall Skill
status

status

Check whether this session's Vigil answers for its credential. Use when the Vigil tools fail, before first use, or when asked…

@vigil-soc@vigil-socInstall Skill
trail

trail

Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or…

@vigil-soc@vigil-socInstall Skill
waiting

waiting

Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when…

@vigil-soc@vigil-socInstall Skill

More skills from other plugins.

api-security

api-security

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…

@zhaoxuya520@zhaoxuya520Install Skill
nemoclaw-user-guide

nemoclaw-user-guide

Find official NemoClaw documentation for installation, configuration, operation, or troubleshooting. Also handles requested docs…

nemoclaw12d23k
@nvidia@nvidiaInstall Skill

Questions about investigate.

Which coding agents can use investigate?
investigate installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.