Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add everywan-dev/claude-code-engineering --skill investigate-an-unfamiliar-systemgit clone --depth 1 https://github.com/everywan-dev/claude-code-engineeringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/everywan-dev/claude-code-engineering/investigate-an-unfamiliar-system)<a href="https://agentmods.dev/skills/everywan-dev/claude-code-engineering/investigate-an-unfamiliar-system"><img src="https://agentmods.dev/badge/skills/everywan-dev/claude-code-engineering/investigate-an-unfamiliar-system.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.02210 |
| Opus 5 | $0.00020 | $0.01105 |
| Sonnet 5 | $0.00008 | $0.00442 |
| Haiku 4.5 | $0.00004 | $0.00221 |
Grade A, and why
investigate-an-unfamiliar-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigate an unfamiliar system
You have access to something you have never seen and someone is waiting for an answer. Two ways this goes wrong:
- You change something to find out what it does. Now you are the incident.
- You conclude something is absent when your instrument simply could not see it.
The second is far more common, far quieter, and produces confident wrong statements that get written down. Most of this document is about that.
The one rule for the first hour
Read-only. No restarts "to see what happens", no test writes, no removing something "unused", no restarting a service to check that it comes back. You do not yet know what depends on it — that is the thing you are here to find out.
Capture as you go. Everything you print in this hour is the starting-state photograph that any later change is going to need anyway.
The reading order
Four questions, in this order. Each one is uninteresting until the previous one is answered.
1. What runs, and where
Processes, services, containers, scheduled jobs, listening ports. Not what is installed — what is running right now, and on which machine.
Then, for anything that looks important: how does it get started? Something that starts on boot, something restarted by a supervisor, and something a person started by hand in a session six months ago are three very different objects that look identical in a process list.
2. What depends on what
Follow the traffic, not the directory layout:
- What listens, and what connects to it
- What resolves to what — from inside the system, which is often not what resolves from outside
- Where the data lives: local disk, shared storage, a database somewhere else
- What is in front: anything terminating connections, balancing, caching or rewriting before the application sees a request
The useful question at this stage is not "what is this?" but "what breaks if this stops?"
3. Who else writes here
🔴 The assumption that you and the people you can see are the only writers is the one that hurts. Automation, deployment pipelines, configuration management, scheduled jobs, another team, and the system's own supervisor all make changes that look, in the logs, exactly like a person made them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 233 lines · 41 tokens per session scan A 430a042a4365
investigate-an-unfamiliar-system is a skill published in the GitHub repository everywan-dev/claude-code-engineering (2 stars, last pushed 5d ago), licensed Apache-2.0. It adds 41 tokens to every session and 2,210 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
claude-project-manifest
Creates annotated bibliography-style manifests for Claude projects, tracking files, conversation threads, and relationships with unique IDs and annotations. Use when documenting project contents, creating file inventories, tracking conversation history, or building navigable knowledge maps.
proofpress
Preserve or inspect decision history for Markdown and static HTML knowledge artifacts with Proofpress. Use when creating or accepting a meaningful revision to an ADR, design doc, PRD, README, strategy note, portable .md artifact, or static .html/.htm artifact in a configured repository, or when receiving a file…
book-to-skill
Use when convert technical books and documents (PDF, EPUB, DOCX, HTML, Markdown, RTF, MOBI) into structured agent skills with frameworks, mental models, chapter references, and decision rules. Includes full extraction pipeline. Use when the user wants to turn a book or document collection into a reusable agent skill…
llm-wiki
Maintain a personal team knowledge base using the LLM Wiki pattern — incremental ingest, query, and lint operations on a layered wiki architecture.
Principle Synthesizer
Synthesize invariant principles from 3+ sources — find the core that survives across all expressions.
PBE Extractor
Extract invariant principles from any text — find the ideas that survive rephrasing.