From the author
Engineering detection rules (Sigma/YARA), detection coverage mapping, threat hunting hypotheses, Purple Team Blue side, Detection-as-Code CI/CD. Use when defensive verification is needed.
Install
npx skills add simota/agent-skills --skill vigil -a claude-code
Installs to .claude/skills/vigil/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Contains hidden text (invisible characters, long comments or encoded blobs)Medium
Why 75
Security80
Provenance64
Maintenance100
Licence100
Adoption34
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- detection-engineeringgensecaihq/Wazuh-AutopilotDesign, backtest and tune detections as code — ADS-documented Sigma or Wazuh rules with ATT&CK coverage — and submit them via propose_detection for human review; use for detection gaps, recurring false positives or new TTPs from hunts and incidents.Design★ 60
- threat-huntingcoco-research/cocoUse for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.Design★ 787
- detecting-and-respondingtelagod/code-abyss蓝队与紫队工程：检测规则编写、SIEM/EDR 调优、事件响应、数字取证、威胁狩猎、ATT&CK 映射、紫队演练闭环。Use when writing Sigma/YARA detection rules, tuning SIEM noise, responding to security incidents, conducting forensic analysis, hunting threats, or running purple team exercises.Security★ 243
- detection-resilience-test-planzero-lab-ai/skillsPlans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-approved opaque technique variations. Use when a blue or purple team needs authorization-, safety-, evidence-, cleanup-, and remediation-gated resilience measurement without generating bypass procedures, commands, payloads, or stealth rankings.Testing★ 282
- detection-engineering-coverage-evaluationgoogle/skillsAutomates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportunities (TDOs), simulating attacker behavior with synthetic UDM events, evaluating rule coverage, and deploying gap-closing rules. Don't use for standalone YARA-L 2.0 rule authoring/tuning (use secops-detection-engineering), threat hunting, or SOC investigation.OfficialDevOps★ 21.6K
- vigil-checktonone-ai/tononeVerify observability posture — audit monitoring coverage, find blind spots, prioritize gaps. Use when asked "is monitoring sufficient", "observability review", "are we covered", or "pre-launch monitoring check".DevOps★ 76
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in