Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add build-with-dhiraj/ai-workflow-framework-portability-kit --skill investigation-modegit clone --depth 1 https://github.com/build-with-dhiraj/ai-workflow-framework-portability-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/investigation-mode)<a href="https://agentmods.dev/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/investigation-mode"><img src="https://agentmods.dev/badge/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/investigation-mode/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/investigation-mode"><img src="https://agentmods.dev/badge/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/investigation-mode.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.02633 |
| Opus 5.5 | $0.00019 | $0.01053 |
| Sonnet 5.5 | $0.00010 | $0.00527 |
| Haiku 4.5 | $0.00005 | $0.00263 |
Grade A, and why
investigation-mode scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 309 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigation Mode — Orchestrated Debugging
When a user reports something stuck, hung, broken, or not responding, you are the diagnostic coordinator. Do not guess. Follow the triage order, report what you find at every step, and stop when you have a high-confidence root cause.
Reporting Contract
Every investigation step MUST follow this pattern:
- Tell the user what you are checking — "I'm checking the runtime logs for errors…"
- Share the evidence you found — paste the relevant log line, status, error, or screenshot
- Explain the next step — "The logs show a timeout on the DB call. I'll check the connection pool next."
Never silently move between steps. The user is already frustrated — silence makes it worse.
Triage Order
Work through these in order. Stop as soon as you find the root cause.
1. Runtime Logs (check first — most issues leave traces here)
- Dev server: Check terminal output for errors, warnings, unhandled rejections
- Vercel logs:
vercel logs --follow(production) orvercel logs <deployment-url> - Browser console: Open DevTools → Console tab for client-side errors
- If no logs exist: This is the problem. Add logging before continuing (see "Add Logging" below)
Tell the user: "Checking runtime logs…" → share what you found → explain next step.
2. Workflow / Background Job Status
If the app uses workflows, queues, or cron jobs:
- Run
vercel workflow runs listto check recent run statuses - Look for runs stuck in
runningstate — likely a missingawaitor unresolved promise - Check individual run details:
vercel workflow runs get <run-id> - Look for failed steps, retry exhaustion, or timeout errors
Tell the user: "Checking workflow run status…" → share the run state → explain next step.
3. Browser Verification
Use agent-browser to visually verify what the user sees:
- Take a screenshot of the current page state
- Check the browser console for JavaScript errors
- Check the Network tab for failed requests (4xx/5xx, CORS errors, hanging requests)
- Look for hydration mismatches or React error boundaries
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 309 lines · 48 tokens per session scan A 22c201dbc51e
investigation-mode is a skill published in the GitHub repository build-with-dhiraj/ai-workflow-framework-portability-kit (5 stars, last pushed 20d ago), licensed MIT. It adds 48 tokens to every session and 2,633 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.
Other skills, from other repositories
semgrep-rule-creator
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
variant-analysis
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
ln-71-operations-investigator
Diagnoses incidents from operational evidence and proposes recovery; does not change live systems.
fp-check
Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.
vuln-report
Turn one confirmed security finding into a disclosure-ready GitHub advisory with root cause, proof of concept, impact, and source evidence. Use for reporting an established vulnerability, not discovering or validating one.
huggingface-spaces
Build, deploy, debug, or maintain a Hugging Face Space using Gradio, Docker, or Static SDKs. Use for general Space hosting and configuration; use huggingface-zerogpu for ZeroGPU runtime constraints and lora-space-builder for LoRA demos.