Borrowing it
Nothing to install: this file belongs to Dhevenddra/forensic-deepdive. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Dhevenddra/forensic-deepdive/main/.claude/skills/forensic-deepdive-query/SKILL.mdgit clone --depth 1 https://github.com/Dhevenddra/forensic-deepdiveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dhevenddra/forensic-deepdive/forensic-deepdive-query)<a href="https://agentmods.dev/skills/dhevenddra/forensic-deepdive/forensic-deepdive-query"><img src="https://agentmods.dev/badge/skills/dhevenddra/forensic-deepdive/forensic-deepdive-query.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.00704 |
| Opus 5 | $0.00060 | $0.00352 |
| Sonnet 5 | $0.00024 | $0.00141 |
| Haiku 4.5 | $0.00012 | $0.00070 |
Grade A, and why
forensic-deepdive-query scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forensic Deep-Dive — Query
Answer from precomputed artifacts instead of re-reading the codebase.
When to use
docs/codebase/MAP.mdexists.- Question is navigational: "where", "who owns", "how did", "what are entry points", "blast radius of editing X".
When NOT to use
- Artifacts >30 days old AND ≥50 commits since last extract → trigger
forensic-deepdive-updatefirst. - Question is code-semantic ("does this function handle null") → just read the file.
- User wants to verify a specific implementation detail → read the source.
How to answer
- Always read
docs/codebase/AGENT_BRIEF.mdfirst — it's small and contains the rules. - Match the question shape:
| Question shape | Artifact to grep |
|---|---|
| "Where does X live" / "who owns" | docs/codebase/MAP.md |
| "How did X evolve" / "when was X introduced" / "who wrote X" | docs/codebase/ARCHAEOLOGY.md |
| "Critical path through feature X" / "trace request lifecycle" | docs/codebase/HOTPATHS.md |
| "Explain X" / "what's the architecture" | docs/codebase/MENTAL_MODEL.md |
| "What rules apply when editing X" | docs/codebase/AGENT_BRIEF.md |
| "Show me a diagram of X" / "visualize how X connects" | forensic graph X --format mermaid (or the visualize MCP tool) — bounded Mermaid, confidence-styled edges |
| "What backend does this frontend call" / "who calls this endpoint" / trace a feature across the stack | the trace MCP tool (downstream = component→endpoint→handler→callees; upstream = who-calls-endpoint) or docs/codebase/HOTPATHS.md ## Cross-stack routes |
- Only if none answer, run:
(v0.2 — uses MCP server if installed, otherwise greps the artifacts.)forensic query "<question>"
Citation rule
Always cite: docs/codebase/MAP.md:142-158. Never paraphrase without a line citation. If you can't find a citation, say so — don't fabricate.
What to report back
- The answer, with file:line citations from the artifacts.
- If multiple artifacts contain related context, link them all.
- If the artifact seems stale (date in
<!-- generated -->header > 14 days old), warn the user and offer to runforensic-deepdive-update.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 49 lines · 119 tokens per session scan A 5809fea07ff3
forensic-deepdive-query is a skill published in the GitHub repository Dhevenddra/forensic-deepdive (2 stars, last pushed 21d ago), licensed Apache-2.0. It adds 119 tokens to every session and 704 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
revibe
Analyze any codebase — architecture, patterns, diagrams, agent context. Understand repos in minutes, not hours.
potpie-cli
Use when the task is centered on running, explaining, configuring, or troubleshooting the potpie command: doctor, login, pot management, source registration, search, graph workbench reads/writes, and pot scope behavior.
potpie-debug-memory
Use while debugging or troubleshooting failures, flaky tests, incidents, production alerts, CI failures, local dev setup issues, repeated bugs, prior fixes, failed attempts, and verification history.
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.
issue-root-resolution
Trigger: root audit, atacar la raíz, issue roots, backlog roots, mechanism map, deletion-driven fix, resolver issues de raíz, close outdated issues. Audit and resolve issue clusters by verified root cause.
rdd-defect-workflow
Trigger: RDD, receipt-driven development, review authority, receipt/lineage, correction/recovery, delivery gate/kill switch, bounded review defects. Guide work.