Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Borda/AI-Rignpx agentmods add skills/borda/ai-rig/rig-investigateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/borda/ai-rig/rig-investigate)<a href="https://agentmods.dev/skills/borda/ai-rig/rig-investigate"><img src="https://agentmods.dev/badge/skills/borda/ai-rig/rig-investigate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/borda/ai-rig/rig-investigate"><img src="https://agentmods.dev/badge/skills/borda/ai-rig/rig-investigate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00420 |
| Opus 5.5 | $0.00008 | $0.00168 |
| Sonnet 5.5 | $0.00004 | $0.00084 |
| Haiku 4.5 | $0.00002 | $0.00042 |
Grade A, and why
Rig Investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Rig Investigate
Read Evidence rules. A plausible explanation is not a root cause.
Input
- Symptom, failing command, stack trace, or behavior.
- Known environment and versions.
- Paths or subsystem hints.
Workflow
- Start the run.
rig_evidencewithaction: "start",skill: "rig-investigate", and candidate paths. - Reproduce with real inputs. Run the failing command. If it does not reproduce, record the exact difference and stop rather than guessing.
- Shrink the case. Remove unrelated configuration and files until the smallest failing case remains. Record each removal.
- List hypotheses. Write at least two plausible causes. For each, name the observation that would disprove it.
- Test one at a time. Change one variable per run. Record the command, output digest, and conclusion. Optional: dispatch read-only
rig-investigatorchildren for independent hypotheses; they share the tree, so they must not edit files. - Confirm the cause. Show the failing behavior disappearing when the cause is removed, or explain why that experiment is unavailable.
- Record the diagnosis with reproduction command, root cause, evidence, eliminated hypotheses, confidence, and the smallest next change.
Rules
- Correlation is not causation; if the evidence only supports a correlation, say so.
- Do not weaken a test to make it pass, and do not change production code before the cause is confirmed.
- Missing environment or credentials are an explicit limit, not a reason to simulate a pass.
- Python scopes may probe codemap when available (one probe); absence is recorded, not fatal.
Output
Report reproduction status, root cause, evidence references, confidence, limits, and the recommended next action. Do not present the fix as already verified.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 36 lines · 20 tokens per session scan A 8128accfa4e8
Rig Investigate is a skill published in the GitHub repository Borda/AI-Rig (29 stars, last pushed today), licensed Apache-2.0. It adds 20 tokens to every session and 420 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-28.
Other skills, from other repositories
anomaly-alert
Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error…
transcript-grep
Search a Claude Code session transcript for a string or regex pattern and show every matching message with surrounding context. Reads /api/sessions/:id/transcript and resolves sessions via /api/sessions?limit= from the Agent Monitor dashboard. Use when hunting for a specific message, prompt, tool call, or error inside…
hook-inventory
Inventory hooks across the user, project, and project-local settings plus the /.claude/hooks scripts directory — read through the Agent Monitor Config Explorer API — and flag hooks that POST to the network or run arbitrary commands. Reads /api/cc-config/hooks and /api/cc-config/hook-scripts. Use when auditing hook…
regression-watch
Detect quality and efficiency regressions over time using Agent Monitor data — rising error rate (APIError events), falling cache hit rate, growing compaction frequency, and climbing cost-per-session. Splits history into an earlier baseline window and a recent window and reports which metrics are getting worse, by how…
hook-failure-audit
Audit hook delivery health from Agent Monitor data — balance PreToolUse vs PostToolUse (a gap means tools that started but never reported back), detect missing Stop/SubagentStop terminators (sessions/subagents that never closed), and check for stale ingestion (no recent events). Use when hooks look unreliable or…
event-trace
Trace the full event chain for one Claude Code session into an ordered timeline of every event type with toolname and summary, highlighting gaps, out-of-order events, and failures. Reads /api/events?sessionid= and /api/sessions/:id from the Agent Monitor dashboard. Use when debugging what a session actually did, step…