case
Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks…
@vigil-socInstall SkillSecurity
Skill
/trail
Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or what this session did.
Claude Code
$ npx -y skills add Vigil-SOC/vigil --skill trail --agent claude-code
Codex
$ npx skills add Vigil-SOC/vigil --skill trail -a codex -y
Cursor
$ npx skills add Vigil-SOC/vigil --skill trail -a cursor -y
Gemini CLI
$ npx skills add Vigil-SOC/vigil --skill trail -a gemini-cli -y
GitHub Copilot
$ npx skills add Vigil-SOC/vigil --skill trail -a github-copilot -y
OpenCode
$ npx skills add Vigil-SOC/vigil --skill trail -a opencode -y
Windsurf
$ npx skills add Vigil-SOC/vigil --skill trail -a windsurf -y
SKILL.md
trail.SKILL.mdname: trail description: Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or what this session did. argument-hint: [person, area or object]
Trail
Show the analyst the part of Vigil's audit trail they ask about.
Vigil's kernel does the work. This session starts it, steers it and reads it: it does not reason through a workflow itself, and it never acts on Vigil except through the `vigil` MCP tools.
Use `list_audit_entries`, filtering by person, actor, area, object, kind or time as asked. It returns entries oldest first with a `tip`; page on `after` with the last `seq` read to get newer ones. Summarise as a short timeline: time, who (person and actor), what, on which object, outcome.
Reading the trail needs `audit.read`, which Admin, Manager and auditor roles hold. An analyst's credential is refused; report that refusal as the answer and say a person with one of those roles can read it.
Ships withvigil
Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.
43119 skills
Stars on GitHub
Momentum
- stars in total
- 431
Other skills on vigil.
@vigil-socInstall Skillhunt
Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use…
@vigil-socInstall Skillinvestigate
Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when…
@vigil-socInstall Skillqueue
Show the open work in Vigil - findings waiting for triage and open cases. Use when asked what is in the queue, what needs looking…
@vigil-socInstall Skillstatus
Check whether this session's Vigil answers for its credential. Use when the Vigil tools fail, before first use, or when asked…
@vigil-socInstall Skillwaiting
Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when…
@vigil-socInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about trail.
- Which coding agents can use trail?
- trail installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.