case
Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks…
Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when asked to investigate a case.
Claude Code
$ npx -y skills add Vigil-SOC/vigil --skill investigate --agent claude-code
Codex
$ npx skills add Vigil-SOC/vigil --skill investigate -a codex -y
Cursor
$ npx skills add Vigil-SOC/vigil --skill investigate -a cursor -y
Gemini CLI
$ npx skills add Vigil-SOC/vigil --skill investigate -a gemini-cli -y
GitHub Copilot
$ npx skills add Vigil-SOC/vigil --skill investigate -a github-copilot -y
OpenCode
$ npx skills add Vigil-SOC/vigil --skill investigate -a opencode -y
Windsurf
$ npx skills add Vigil-SOC/vigil --skill investigate -a windsurf -y
name: investigate description: Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when asked to investigate a case. argument-hint: <case id> [what to look at]
Have Vigil investigate the case in `$ARGUMENTS` and bring back what it concluded.
Vigil's kernel does the work. This session starts it, steers it and reads it: it does not reason through a workflow itself, and it never acts on Vigil except through the `vigil` MCP tools.
Choose what to start from `list_workflows` (an investigation workflow) or `list_operator_agents` (an operator agent starts as `agent-run-<id>`); ask when more than one fits. Start it with `start_run` and the case id, passing the analyst's question as `context` or `hypothesis`. Give the analyst the run id.
While it runs, `get_run` shows its status. Steer it only when the analyst asks, with `send_directive` (a note, a lead, extend, conclude or abort). If it pauses on an approval, say what it waits on and point to `/vigil:waiting`.
Read the conclusion only after the run has ended: `get_run` then returns the conclusion, disposition, citations and declared gaps. Report them as Vigil gave them, gaps included; do not fill a gap with your own reasoning. A run that ends failed or cancelled is reported with its reason.
Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.
Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks…
Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use…
Show the open work in Vigil - findings waiting for triage and open cases. Use when asked what is in the queue, what needs looking…
Check whether this session's Vigil answers for its credential. Use when the Vigil tools fail, before first use, or when asked…
Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or…
Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…