case
Open one Vigil case and its evidence - details, findings, IOCs, comments and runs. Use when the analyst names a case id or asks…
@vigil-socInstall SkillSecurity
Skill
/waiting
Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when asked what needs approval or what a run waits on.
Claude Code
$ npx -y skills add Vigil-SOC/vigil --skill waiting --agent claude-code
Codex
$ npx skills add Vigil-SOC/vigil --skill waiting -a codex -y
Cursor
$ npx skills add Vigil-SOC/vigil --skill waiting -a cursor -y
Gemini CLI
$ npx skills add Vigil-SOC/vigil --skill waiting -a gemini-cli -y
GitHub Copilot
$ npx skills add Vigil-SOC/vigil --skill waiting -a github-copilot -y
OpenCode
$ npx skills add Vigil-SOC/vigil --skill waiting -a opencode -y
Windsurf
$ npx skills add Vigil-SOC/vigil --skill waiting -a windsurf -y
SKILL.md
waiting.SKILL.mdname: waiting description: Show what in Vigil is waiting on a person - pending approvals and the runs paused on them - and reject one if asked. Use when asked what needs approval or what a run waits on. argument-hint: [run id]
Waiting
Show the analyst what waits on a person: pending approval actions and the runs paused on them.
Vigil's kernel does the work. This session starts it, steers it and reads it: it does not reason through a workflow itself, and it never acts on Vigil except through the `vigil` MCP tools.
`get_run` on a paused run lists the approval ids it waits on; `list_approval_actions` lists pending actions across Vigil, and `get_approval_action` reads one in full. Say for each what it would do, to what, who or what proposed it, and why.
This client cannot approve. `approve_action` over MCP leaves the action pending, by design: approving happens in Vigil's Approvals screen, by a signed-in person. Say so plainly rather than retrying. Rejecting is allowed: use `reject_action` with the analyst's reason, only when they ask.
Ships withvigil
Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.
43119 skills
Stars on GitHub
Momentum
- stars in total
- 431
Other skills on vigil.
@vigil-socInstall Skillhunt
Start a Vigil threat hunt on a case from a hypothesis, steer it, and read what it found once it ends. Also reads past hunts. Use…
@vigil-socInstall Skillinvestigate
Start a Vigil investigation run on a case, steer it, and read its conclusion, citations and declared gaps once it ends. Use when…
@vigil-socInstall Skillqueue
Show the open work in Vigil - findings waiting for triage and open cases. Use when asked what is in the queue, what needs looking…
@vigil-socInstall Skillstatus
Check whether this session's Vigil answers for its credential. Use when the Vigil tools fail, before first use, or when asked…
@vigil-socInstall Skilltrail
Read Vigil's audit trail - who did what, when, under which principal. Use when asked what happened, who changed something, or…
@vigil-socInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about waiting.
- Which coding agents can use waiting?
- waiting installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.