What is forensic-deepdive-extract?

A command-line workflow for examining an unfamiliar software codebase and producing five reference documents about it. The documents cover its structure, important code paths, history, overall design, and guidance for AI agents.

Use it when joining a project, onboarding to a repository, or creating a first detailed map of an unfamiliar codebase.

It turns a large repository into durable notes that help developers and agents understand the project. It can also use local models or optional history tools according to its settings.

How Dhevenddra/forensic-deepdive configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to Dhevenddra/forensic-deepdive. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Dhevenddra/forensic-deepdive/main/.claude/skills/forensic-deepdive-extract/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/Dhevenddra/forensic-deepdive

Made for: Claude Code.

Or install forensic-deepdive, the plugin that ships this one along with the rest of its 3 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/dhevenddra/forensic-deepdive/forensic-deepdive-extract.svg)](https://agentmods.dev/skills/dhevenddra/forensic-deepdive/forensic-deepdive-extract)

Your own site

<a href="https://agentmods.dev/skills/dhevenddra/forensic-deepdive/forensic-deepdive-extract"><img src="https://agentmods.dev/badge/skills/dhevenddra/forensic-deepdive/forensic-deepdive-extract.svg" alt="Measured on agentmods" height="20"></a>

Per session 131 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 978 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00131	$0.00978
Opus 5	$0.00066	$0.00489
Sonnet 5	$0.00026	$0.00196
Haiku 4.5	$0.00013	$0.00098

Measured 7d ago against content hash 726174bc934b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

forensic-deepdive-extract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/forensic-deepdive-extract/SKILL.md · 78 lines

How it starts

The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Forensic Deep-Dive — Extract

Runs the full extraction pipeline once per new codebase. Produces five markdown artifacts in docs/codebase/.

When to use

First time analyzing this codebase.
Repo has no docs/codebase/ directory.
Existing artifacts are >7 days old AND >100 commits behind HEAD.

When NOT to use

Artifacts exist and are <7 days old → use forensic-deepdive-query.
Only some files changed since last run → use forensic-deepdive-update.
User is asking about a single file or function → just read it.

How to run

Verify CLI is installed:
```
forensic --version
```
If missing: uv tool install forensic-deepdive or pipx install forensic-deepdive.

From the repo root:

forensic extract . --output ./docs/codebase/

Defaults:
- Cloud mode (uses ANTHROPIC_API_KEY or OPENAI_API_KEY).
- Plain git log archaeology (no Graphiti).
- Repomix --compress for flattening.
Flags:
- --local — use Ollama / LM Studio on localhost (v0.2).
- --with-graphiti — enable temporal KG (v0.2; only if repo meets 2-of-5 threshold).
- --fast — use yek instead of Repomix (v0.2).
- --force — ignore cache, regenerate everything.

Pipeline stages

Stage	Flag	Typical time
Inventory	`--stage=inventory`	<10s
Layer 1 (Tree-sitter + PageRank)	`--stage=static`	30s–5min
Layer 2 (Repomix --compress)	`--stage=flatten`	10s–2min
Layer 3 (plain-git / Graphiti)	`--stage=history`	30s plain / 5-15min Graphiti
Layer 4 (emit 5 artifacts)	`--stage=emit`	10–60s

Earlier stages cache to .forensic-deepdive/cache/.

What to report back to the user

After the run completes:

Five-bullet summary: "Top entry points are X, Y, Z. Hot paths are A, B. The repo's hidden weight-bearing abstraction is C."
Cost report: read .forensic-deepdive/last_run.json and report actual token cost.
Three suggested first-tasks based on ARCHAEOLOGY.md (e.g., "PR #1234 was reverted; underlying bug may still exist in module M").
Exact paths of the five artifacts.
Shim status: confirm CLAUDE.md, AGENTS.md, .cursor/rules/codebase.mdc, .continue/rules/codebase.md were written.

Read the full file on GitHub · 78 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 78 lines · 131 tokens per session scan A 726174bc934b

Subscribe to this mod's changes

forensic-deepdive-extract is a skill published in the GitHub repository Dhevenddra/forensic-deepdive (2 stars, last pushed 22d ago), licensed Apache-2.0. It adds 131 tokens to every session and 978 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Research ai-agents code-analysis cursor developer-tools knowledge-graph

mistakes

List past mistakes engram has learned in this project — failures, regressions, broken assumptions. Use before starting a non-trivial change to surface relevant prior failures, or when debugging to check if this issue has been seen before.

NickCirv/engram · 46 tokens

query

Query engram's local knowledge graph for structural context — function calls, imports, type relationships, mistake history, ADRs. Use when the user asks "how does X work in this project", "what calls Y", "where is Z used", or any structural question that doesn't need file content.

NickCirv/engram · 60 tokens

forensic-deepdive: Skill for Claude Code