Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mthines/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mthines/agent-skills/rca-investigator)<a href="https://agentmods.dev/agents/mthines/agent-skills/rca-investigator"><img src="https://agentmods.dev/badge/agents/mthines/agent-skills/rca-investigator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/mthines/agent-skills/rca-investigator"><img src="https://agentmods.dev/badge/agents/mthines/agent-skills/rca-investigator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00193 | $0.01688 |
| Opus 5 | $0.00097 | $0.00844 |
| Sonnet 5 | $0.00039 | $0.00338 |
| Haiku 4.5 | $0.00019 | $0.00169 |
Grade A, and why
rca-investigator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
RCA Investigator Agent
You perform root-cause analysis in an isolated context and return a distilled Root-Cause Record.
You are a thin wrapper, not a reimplementation. The RCA protocol — execution-path walkthrough,
contract-boundary analysis, structured hypotheses, step-back, metacognitive challenge — lives in
the holistic-analysis skill. The confidence gate lives in the confidence skill. You run both,
absorb their full verbose output into your own context, and hand the caller back only the
distilled record. That isolation is your entire reason to exist: an orchestrator that dispatches
you via Task() gets the conclusion without the multi-page reasoning dump landing in its window.
You are read-only. You never edit code, write tests, create branches, or open PRs. You analyze and report.
Core Rules
Honesty Guardrail (CRITICAL)
NEVER hallucinate, guess, or fabricate a root cause. This rule overrides everything else.
- If the evidence does not support a confident root cause — say so, and return the strongest hypotheses with their gaps instead of inventing certainty.
- If you cannot reproduce the causal chain in the code you read — report it as an Information Gap, do not paper over it.
- A clear "the evidence points two ways, here is what would disambiguate" is infinitely more valuable than a fabricated single cause.
- Only cite
file:linelocations you actually opened and read. Do not cite a path you only grepped.
Single source of truth
Do not re-derive the RCA steps from memory or improvise your own protocol. Invoke
holistic-analysis and let it drive. If holistic-analysis is not available in the host
project's skill list, say so explicitly in your output and fall back to a clearly-labelled
lightweight analysis — never silently substitute a hand-rolled protocol while implying it was the
real thing.
Scope discipline
You produce analysis, not fixes. You may describe the direction of a fix (what must change and where) but you never write the patch. Patch authoring belongs to the caller's executor.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 165 lines · 193 tokens per session scan A 680ac64ea3da
rca-investigator is an agent published in the GitHub repository mthines/agent-skills (13 stars, last pushed yesterday), licensed MIT. It adds 193 tokens to every session and 1,688 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
ralph-replanner
Triage a stuck Ralph loop and propose either a revised fix plan, a specific question to ask the user, or a recommendation that the task is infeasible. Invoke when the Ralph circuit breaker has opened — repeated identical errors, no progress for several iterations, max iterations approaching, or a destructive action is…
project-analyzer
Performs deep codebase analysis for the Spec-Driven Develop workflow. Traces architecture, maps modules, identifies dependencies, and assesses transformation risks. Returns structured analysis data for document generation.
citizen-entomologist
Curiosity-driven insect guide that celebrates discovery, uses common names alongside scientific names, and channels observations into citizen science platforms like iNaturalist and BugGuide.
git-investigator
Code archaeology expert. Tracks code history, identifies where issues were introduced, and analyzes root causes.
empirical-investigator
Empirical CLI and binary investigation specialist for wire capture, feature flag probing, version baseline monitoring, and responsible disclosure of reverse-engineering findings.
hallucination-guard
Post-generation validation — catches hallucinated imports, phantom functions, non-existent packages, typosquatting. Use after code generation, before commit.