Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add FlorianBruniaux/claude-code-plugins --skill investigategit clone --depth 1 https://github.com/FlorianBruniaux/claude-code-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/florianbruniaux/claude-code-plugins/investigate)<a href="https://agentmods.dev/skills/florianbruniaux/claude-code-plugins/investigate"><img src="https://agentmods.dev/badge/skills/florianbruniaux/claude-code-plugins/investigate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/florianbruniaux/claude-code-plugins/investigate"><img src="https://agentmods.dev/badge/skills/florianbruniaux/claude-code-plugins/investigate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.01865 |
| Opus 5.5 | $0.00007 | $0.00746 |
| Sonnet 5.5 | $0.00003 | $0.00373 |
| Haiku 4.5 | $0.00002 | $0.00186 |
Grade A, and why
investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 231 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigate: Root-Cause debugging
Systematic debugging with mandatory root cause investigation before any code changes.
Iron Law: NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST.
Fixing symptoms creates whack-a-mole debugging. Every fix that doesn't address root cause makes the next bug harder to find.
Instructions
Phase 1: Collect symptoms
Gather all available context before forming any hypothesis.
- Read the error messages, stack traces, and reproduction steps in full
- Ask ONE targeted question if the user hasn't provided enough context:
- "What exact error message do you see?"
- "Can you reproduce this consistently?"
- "When did this start happening?"
- Identify the affected component and its boundaries
Output: A precise symptom statement: what fails, when, with what error.
Phase 2: Read the code
Trace the code path from symptom back to potential causes. Do not guess.
# Find all references to the failing component
grep -rn "ComponentName\|function_name\|error_string" src/ --include="*.{ts,js,py,rb,go}" | head -30
# Check recent changes to affected files
git log --oneline -15 -- <affected-file>
# Read the actual diff for each recent commit
git show <commit-hash> -- <affected-file>
Use Grep to find all references, Read to understand the logic. Never skip reading the code.
Phase 3: Check recent changes
# What changed recently across the whole repo
git log --oneline -20
# Changes to files related to the symptom
git log --oneline -20 -- <affected-files>
# Full diff of the last N commits
git diff HEAD~3..HEAD -- <affected-directory>
Key question: Was this working before? If yes, the root cause is in the recent diff.
- Regression = root cause is in the changes, not the original code
- Always-broken = architectural issue or incorrect assumption
Phase 4: Reproduce
Before fixing anything, confirm you can trigger the bug deterministically.
# Run the test suite targeting the affected area
npm test -- --testPathPattern="affected-module" 2>/dev/null || \
pnpm test -- --testPathPattern="affected-module" 2>/dev/null || \
pytest tests/test_affected.py -v 2>/dev/null
# Check logs if available
tail -50 logs/error.log 2>/dev/null || \
journalctl -u app-service --lines=50 2>/dev/null
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 231 lines · 17 tokens per session scan A b89ac1295254
investigate is a skill published in the GitHub repository FlorianBruniaux/claude-code-plugins (44 stars, last pushed yesterday), licensed MIT. It adds 17 tokens to every session and 1,865 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.
Other skills, from other repositories
pentest-forensics
Digital forensics — evidence acquisition, memory/disk imaging analysis, timeline reconstruction, IOC extraction advisory. Triggers on forensics, DFIR, Volatility, memory analysis, disk image, Autopsy, FTK, timeline, IOC extraction, evidence chain, log analysis.
pentest-malware
Malware analysis — triage, static analysis, dynamic sandbox, IOC extract, YARA signature writing advisory. Triggers on malware analiz, malware triage, sandbox, Cuckoo, IDA, Ghidra, dynamic analysis, IOC, YARA imza, packer, unpacker, reverse malware.
security-check
Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities…
expo-troubleshooting
Common Expo errors: Metro cache, version mismatch, expo-doctor, Pod install, Gradle daemon, native module conflicts, EAS Build logs, dependency hoisting. Triggers on expo error, metro cache, version mismatch, expo-doctor, expo install check, pod install error, gradle error, native module not found, build failed, eas…
skill-repair
Diagnose and fix failing or degraded skills automatically - systemic-first triage, per-category playbooks, and a verification plan.
self-improve
Improve the agent itself, or audit its recent performance - better skills, prompts, workflows, and config, plus a quality/reliability/memory-hygiene review of what it did and what failed.