菜单
Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources.
Route Terraform lab requests to deploy, destroy, inspect status, and manage workspace automation in hal.
Route user intent to the right Vault lab skill in hal, including CE versus Enterprise constraints, observability wiring, and full-stack scenario guidance.
Deploy, verify, and troubleshoot the Vault JWT auth lab in hal. Use this skill when the user asks to enable JWT auth, configure CI/CD authentication with Vault, debug bound claims, test GitLab or pipeline logins, or reset the JWT demo. Triggers include "enable jwt", "configure jwt", "gitlab vault auth", "pipeline auth", "bound claims", and "hal vault jwt".
Deploy, verify, and troubleshoot the Vault OIDC lab in hal. Use this skill when the user asks to enable OIDC, set up human SSO, debug browser login redirects, inspect Authentik-backed roles, reset the OIDC demo, or configure SCIM provisioning. Triggers include "enable oidc", "Vault SSO", "Authentik", "OIDC callback", "configure oidc", "hal vault oidc", "enable scim", and "vault scim".
Deploy, verify, and troubleshoot the TFE SAML lab in hal. Use this skill when the user asks to enable SAML SSO for TFE, set up TFE single sign-on, debug SAML redirects or attribute mapping, configure SCIM provisioning for TFE teams, or reset the TFE SSO demo. Triggers include "enable saml", "TFE SSO", "TFE SAML", "Authentik TFE", "SAML callback", "configure saml", "hal tf saml", "tfe scim", "tfe teams scim", and "saml sso tfe".
| name | deploy |
| description | Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline. |
Handle hal vault create requests with a stable lifecycle pattern.
root.hal vault create --edition ent and VAULT_LICENSE exported (this is still dev mode, just the Enterprise image).--mode prod)hal vault create --mode prod stands up a single-node production Vault Enterprise: real vault server -config with integrated Raft storage on a persistent volume, TLS at https://vault.localhost:8200 (self-signed cert), and automatic init + unseal.--edition ent; requires VAULT_LICENSE / VAULT_LICENSE_PATH. --edition ce --mode prod is rejected.~/.hal/vault-prod/init.json (mode 0600). Tell the user to retrieve it with hal vault status or hal creds status, set VAULT_CACERT=~/.hal/vault-prod/certs/cert.pem for the CLI, and that this file is the only copy of the unseal key.--key-shares (default 1), --key-threshold (default 1), --node-id.http://vault.localhost:8200) and next steps.hal vault obs createhal vault obs updatehal vault obs deletehal vault obs statushal vault obs create expects the obs stack to already be running; otherwise it should ask the user to run hal obs create first.hal vault update) or delete (hal vault delete) path.VAULT_LICENSE, explain the failure and provide the exact export + redeploy command.