Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/derricktang/pm-workflow-plugin/investigategit clone --depth 1 https://github.com/derricktang/pm-workflow-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/derricktang/pm-workflow-plugin/investigate)<a href="https://agentmods.dev/commands/derricktang/pm-workflow-plugin/investigate"><img src="https://agentmods.dev/badge/commands/derricktang/pm-workflow-plugin/investigate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01405 |
| Opus 5 | $0.00000 | $0.00702 |
| Sonnet 5 | $0.00000 | $0.00281 |
| Haiku 4.5 | $0.00000 | $0.00140 |
Grade A, and why
investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/investigate 调查分析指令
用途：对任何非平凡的调查 / 排查 / 评估 / 审计 / 方案分析 / 逻辑缺陷检查，走标准化三步动作，杜绝「单遍自评漏判」（实证根因见 memory
feedback_single_pass_evaluation_unreliable）。本文件定位：调查分析执行纪律 + 对抗 pass checklist 的 SSOT 真源。其他地方（memory / 派发 prompt）只引用、不复制（SSOT #59 单源约束）。派发选型另有真源（Step 1），本文件不复述。
何时走本指令
- 用户显式触发：「用调查分析指令 / 调查 / 排查 / 评估 / 分析 / 查逻辑缺陷 X」
- 编排器自检：凡要给出非平凡结论 / 建议 / 判断前，自走本指令（尤其 Step 3 呈现前对抗 pass）——不等用户说「再次检查」
Step 1 选执行者（先定谁来做，别默认自己上）
- 判定 + 选型
[Must]按pm-workflow/rules/agent_dispatch_protocol.md §调研 + 计划制定 subagent 派发规范（真源，含判定决策树 + 选型表 + prompt 7 要素 + 反 pattern，勿在此复述） - 速记红线：① L1 范围评估 / 开放式 audit / 跨文件一致性扫描 → 必派 Explore/PM，主上下文禁自审（违反信号见 CLAUDE.md §调整意见第二步越界信号）② Explore 仅「找文件 / grep symbol」轻量定位，不适合 audit ③ 用 Explore 的结论逐项核证（Explore 会把假阴性判假阳性，11 误报实证）
- 委派传导（L1 调查
[Must]）：派 PM/Explore 做 L1 调查时，必须在 dispatch prompt 内注入 Step 2 取证纪律 + Step 3 checklist 的 A/C/D/E 段（B 按需）——否则取证严谨性停在编排器、传不到真正干活的 subagent（同插件 B-1「纪律到编排器、没到 subagent」缺口）。呈现 subagent 结论前，编排器仍自走 Step 3 复核
Step 2 取证（事实配命令，禁推断）
- 大结构化文档：先
python3 "${CLAUDE_PLUGIN_ROOT}/pm-workflow/scripts/doc_query.py" outline|fetch|locate <file>（SSOT #81 分节读取）—— 禁行数粗估（awk/wc 行数）、禁全文 grep 当结构（实证：行数把「工作流架构 203 行」误当四阶段循环，真大块是调整意见 SOP ~5.5k tok） - 计数：
grep -o/len(re.findall())，禁grep -c（数行 ≠ 数字面） - HTML 嵌套 / 平衡：
html.parser/ BeautifulSoup，禁 grep 缩进当 DOM 嵌套 - 每个数字 / 存在性断言都附可复现命令；产出里分清「事实」与「由事实推出的结论」，推理链不跳步
Step 3 呈现前对抗 pass（5 段 checklist，逐项过 —— 本指令 SSOT）
A. 工具与事实层
- 大文档已走 doc_query（非行数粗估）；计数用 grep -o/findall（非 -c）；HTML 用解析器（非 grep 缩进）
- 每个数字/存在性断言有可复现命令
- 已分清「事实」与「推出的结论」，无跳步
B. 运行时态破点（本框架特有；过程 / L2 / 方案分析必过，纯 L1 内容审计按需——仅「subagent 隔离」一条恒适用）
-
/clear或会话重启后还成立？（CLAUDE.md 自动重注入 vs command/rule 不重读；恢复只读 state.md+ledger） - subagent 隔离上下文里成立？（主会话 / SessionStart 注入的不进 subagent）
-
/compact有损摘要后？只读 cache / 文件不可写时？
C. 范围与一致性
- L1 范围评估已派 Explore/PM（非主上下文自评）
- 跨文件一致性 / SSOT 派生漂移已查
- 引用的 file:line / 数字非过时（memory 点时观测 → 现核）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 62 lines · 0 tokens per session scan A d75c1d634974
investigate is a command published in the GitHub repository derricktang/pm-workflow-plugin (2 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,405 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
review
Review the selected change and report evidence.
iteration-loop
Autonomous full iteration loop for cloud agents — Phase 1 (code-first auto direction lock + compass/plans + Review & Edit chain) through Phase 2–5 (execute → close → PR → merge-ready). Optional args: direction, scale (S|M|L|XL, default M). Not Done until Phase 5 exit checklist passes. Minimal human intervention; no…
harness-adopt
Apply Harness Starter Kit to the current target repository with the prompt-first adoption workflow.
validate
Validate the operating-model seed — manual binding, adapter drift, adoption state, checkpoint/evidence.
init
Initialise the planning seed and record the human team, roles, and escalation channels.
observe-slo
Manage Service Level Objectives (SLO) — define, activate, retire, track violations. Provided by the Observability First methodology.