Borrowing it
Nothing to install: this file belongs to apokamo/kaji. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/apokamo/kaji/main/.claude/skills/incident-investigate/SKILL.mdgit clone --depth 1 https://github.com/apokamo/kajiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apokamo/kaji/incident-investigate)<a href="https://agentmods.dev/skills/apokamo/kaji/incident-investigate"><img src="https://agentmods.dev/badge/skills/apokamo/kaji/incident-investigate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/apokamo/kaji/incident-investigate"><img src="https://agentmods.dev/badge/skills/apokamo/kaji/incident-investigate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.02782 |
| Opus 5 | $0.00039 | $0.01391 |
| Sonnet 5 | $0.00016 | $0.00556 |
| Haiku 4.5 | $0.00008 | $0.00278 |
Grade A, and why
incident-investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Incident Investigate（調査・提案役）
第1層（#304）が起票したインシデントイシューを入力に、原因を調査し、調査 artifact
（<artifact_root>/<incident_issue_id>/investigation/report.md）を作成して全文をコメント投稿する。
結論を断定できないことは失敗ではない。 証拠が不足するときは無理に断定せず、
INCONCLUSIVEを選び、棄却済み仮説・不足証拠・再現の記録を充足させること。調査結論（conclusion）と レビュー verdict（PASS/RETRY/ABORT）は別軸であり、記述が十分なら結論がINCONCLUSIVEでも verdict は PASS になり得る（EPIC #303 決定 D）。
ワークフロー内の位置: investigate → review →（fix → verify）→ report
入力
ハーネス経由（コンテキスト変数）
| 変数 | 型 | 説明 |
|---|---|---|
issue_id |
str | 調査対象のインシデントイシュー ID |
issue_ref |
str | 人間可読の Issue 参照（GitHub では #<issue_id>） |
step_id |
str | 現在のステップ ID |
手動実行（スラッシュコマンド）
$ARGUMENTS = <incident_issue_id>
解決ルール
コンテキスト変数 issue_id が存在すればそちらを使用。なければ $ARGUMENTS の第 1 トークンを
issue_id として使用する。
全 incident-* skill 共通ルール
worktree_dirを参照しない: インシデントイシューにはtype:*ラベルも worktree も無く、 注入されるworktree_dirは実在しないパスを指す。作業場所は main repo（読み取り）＋調査 artifact ディレクトリ（書き込み）＋使い捨て検証環境に限定する。- artifact root は main worktree 基準で一意に解決する（Issue #305）:
kaji runはresolve_artifacts_dir()により run/state artifact を main worktree の.kaji-artifactsへ 集約する。skill が feature worktree（例kaji-feat-305）の cwd から起動されると、そこには.kaji-artifactsが存在しない。したがって cwd 相対の.kaji-artifactsを参照してはならない。 各 skill は最初に絶対 root を解決し、source run・台帳・investigation report の全読み書きに同じ root を用いる:
以降、本ドキュメントのART="$(kaji config artifacts-dir)" # main worktree 基準の絶対パス（副作用なし）<artifact_root>は$ARTを指す。 - verdict 3 経路: 作業報告コメント末尾 → stdout → artifact
verdict.yaml。コメントにはkaji issue comment <id> --verdict-step <step> --verdict-status <STATUS>を無条件付与する。 - 長時間コマンドは foreground ＋明示 timeout で待ち切る。background 実行・wake 系 tool に依存しない （#301 の上流不具合 anthropics/claude-code#59864 を踏まないため）。
- 副作用の禁止（全終端は「提案」。#303 決定 D）: ラベル付与・除去、イシューのクローズ / reopen、 バグイシューの起票、統合の実行、コード変更・commit・push・PR 作成を行わない。
- ログの sanitize:
<artifact_root>/<issue>/runs/<run_id>/run.logは生ログである。コメント / artifact に引用する際はトークン・資格情報・秘匿 URL を既存sanitize_evidenceと同方針でマスクする。 - auto-close hazard 回避:
docs/dev/shared_skill_rules.md§ auto close keyword 回避規約に従う。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 158 lines · 79 tokens per session scan A 58ae5b0bab42
incident-investigate is a skill published in the GitHub repository apokamo/kaji (12 stars, last pushed 4d ago), licensed Apache-2.0. It adds 79 tokens to every session and 2,782 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
superpowers-systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
rust-check
Run cargo check on the current Rust project to find compile errors.
debug
Reproduce, minimize, localize, identify root cause, and distinguish diagnosis from an authorized fix. Prefer root-cause over symptom patches.
langsmith-tracing
LangSmith tracing and debugging setup for LLM applications. Configure observability, capture traces, and enable debugging for LangChain/LangGraph agents.
behavior-contract
Bug condition/postcondition formalization as testable Behavior Contracts. Defines invariants that must be preserved across fixes.
quality-hooks
Language-specific auto-lint/format/typecheck pipeline. Supports Python (ruff+pyright), TypeScript (prettier+eslint+tsc), Go (gofmt+golangci-lint). Auto-fix and convergence loops.