Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/florianbruniaux/claude-code-plugins/investigategit clone --depth 1 https://github.com/FlorianBruniaux/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00017 | $0.01856 |
| Opus 5 | $0.00009 | $0.00928 |
| Sonnet 5 | $0.00003 | $0.00371 |
| Haiku 4.5 | $0.00002 | $0.00186 |
Grade A, and why
investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 229 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigate — Root-Cause Debugging
Systematic debugging with mandatory root cause investigation before any code changes.
Iron Law: NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST.
Fixing symptoms creates whack-a-mole debugging. Every fix that doesn't address root cause makes the next bug harder to find.
Instructions
Phase 1: Collect Symptoms
Gather all available context before forming any hypothesis.
- Read the error messages, stack traces, and reproduction steps in full
- Ask ONE targeted question if the user hasn't provided enough context:
- "What exact error message do you see?"
- "Can you reproduce this consistently?"
- "When did this start happening?"
- Identify the affected component and its boundaries
Output: A precise symptom statement — what fails, when, with what error.
Phase 2: Read the Code
Trace the code path from symptom back to potential causes. Do not guess.
# Find all references to the failing component
grep -rn "ComponentName\|function_name\|error_string" src/ --include="*.{ts,js,py,rb,go}" | head -30
# Check recent changes to affected files
git log --oneline -15 -- <affected-file>
# Read the actual diff for each recent commit
git show <commit-hash> -- <affected-file>
Use Grep to find all references, Read to understand the logic. Never skip reading the code.
Phase 3: Check Recent Changes
# What changed recently across the whole repo
git log --oneline -20
# Changes to files related to the symptom
git log --oneline -20 -- <affected-files>
# Full diff of the last N commits
git diff HEAD~3..HEAD -- <affected-directory>
Key question: Was this working before? If yes, the root cause is in the recent diff.
- Regression = root cause is in the changes, not the original code
- Always-broken = architectural issue or incorrect assumption
Phase 4: Reproduce
Before fixing anything, confirm you can trigger the bug deterministically.
# Run the test suite targeting the affected area
npm test -- --testPathPattern="affected-module" 2>/dev/null || \
pnpm test -- --testPathPattern="affected-module" 2>/dev/null || \
pytest tests/test_affected.py -v 2>/dev/null
# Check logs if available
tail -50 logs/error.log 2>/dev/null || \
journalctl -u app-service --lines=50 2>/dev/null
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 229 lines · 17 tokens per session scan A 5ec5785bde1f
investigate is a command published in the GitHub repository FlorianBruniaux/claude-code-plugins (40 stars, last pushed 3mo ago), licensed MIT. It adds 17 tokens to every session and 1,856 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
aso
App Store Optimization command. iOS app listing analysis via the iTunes API, keyword optimization, and competitor comparison.
content-generate
Social media content generation command. Produces ready-to-use posts, captions, visual briefs, and hashtags for the given platform and type.
api-doc
API documentation generation. Scans route definitions and produces structured API docs.
audit
Quality audit command. Runs a systematic audit over code, structure, or process.
brief
Project briefing command. Turns raw project ideas into structured, actionable briefs.
changelog
Automatic changelog generation. Produces a structured changelog from commit history.