Bifrost is an AI gateway that gives applications one OpenAI-compatible API for accessing models from more than 23 providers. It is used to route model requests, handle provider failover and load balancing, and apply features such as caching, guardrails, and MCP gateway support.
Borrowing it
Nothing to install: this file belongs to maximhq/bifrost. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/maximhq/bifrost/dev/.claude/skills/investigate-issue/SKILL.mdgit clone --depth 1 https://github.com/maximhq/bifrostWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/maximhq/bifrost/investigate-issue)<a href="https://agentmods.dev/skills/maximhq/bifrost/investigate-issue"><img src="https://agentmods.dev/badge/skills/maximhq/bifrost/investigate-issue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/maximhq/bifrost/investigate-issue"><img src="https://agentmods.dev/badge/skills/maximhq/bifrost/investigate-issue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 391 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium MCP Rug Pull · line 497 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.11189 |
| Opus 5.5 | $0.00031 | $0.04476 |
| Sonnet 5.5 | $0.00016 | $0.02238 |
| Haiku 4.5 | $0.00008 | $0.01119 |
Grade A, and why
investigate-issue scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
docker compose -f tests/docker-compose.yml up -d weaviate # then retry until `curl -sf http://localhost:9000/v1/.well-known/ready` passes AND `nc -z localhost 50051` succeeds (gRPC) How it starts
The opening of the file, as written. The whole thing — 987 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigate GitHub Issue
Fetch a GitHub issue, analyze the report, search the codebase for relevant code, research external documentation, and present a comprehensive implementation plan with side-effect analysis and test guidance.
Your final report MUST contain all of these sections:
- Issue Details (from Step 1)
- Classification (from Step 2)
- Codebase Analysis + Documentation Research (from Step 3, including sub-step 3e)
- Impact Analysis (from Step 4)
- Test Plan (from Step 5)
- Regression Rerun Scope (from Step 5e) -- which existing tests must rerun, and why
- TDD: Failing Tests (from Step 5f) -- Bug issues only: the test source AND the actual red output from the applicable Makefile recipe, pasted verbatim, BEFORE asking to implement
- Full Presentation (Step 6 template)
- Regression Tests to Add (from Steps 5a and 5g) -- the harness case(s) and unit tests that will pin the change; required for every issue type, not just bugs
If any section is missing, go back and complete it before presenting the report.
For Bug issues the approval gate is NOT "may I write a test?" -- the failing test is already written and shown to be red. The gate is "may I write the fix?"
Usage
/investigate-issue <ISSUE_ID> # Investigate issue by number
/investigate-issue # Prompts for issue ID
Workflow Overview
- Get the issue -- Fetch full issue details from GitHub
- Classify the issue -- Determine type (bug, feature, docs) and affected areas
- Search the codebase and research docs -- Find relevant code, then research the libraries it depends on via Context7 and WebSearch
- Analyze impact -- Cross-reference codebase findings with documentation to identify side effects, dependencies, and breaking changes
- Plan the required regression tests -- unit tests wherever possible, plus a provider-harness
case for any wire-visible change; specific LLM and MCP test additions where
core/is touched 5b. Scope the reruns -- Use coverage to determine which existing tests exercise the lines you plan to change, and tier them by necessity 5c. Go red (Bug issues) -- Write the regression test(s) and run them to confirm failure for the right reason, BEFORE presenting the plan - Present the plan -- Show findings, the red test output, the rerun scope, and the recommended fix
- Implement with approval -- After approval, apply the fix and show red-to-green
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +12 lines be4f608873a7
- 29d ago Changed · +5 lines 7cd3da703fe4
- 1mo ago Changed · +7 lines b6f6f69a763b
- 1mo ago Changed · +56 lines cae0a9f7ea1f
- 1mo ago Changed · +4 lines 990be4e96b3b
- 1mo ago Changed · +54 lines a27898d0a764
- 2mo ago First seen · 849 lines · 78 tokens per session scan A 5be4efa3fe0c
investigate-issue is a skill published in the GitHub repository maximhq/bifrost (9,185 stars, last pushed today), licensed Apache-2.0. It adds 78 tokens to every session and 11,189 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
git-advanced-workflows
Master advanced Git workflows including rebasing, cherry-picking, bisect, worktrees, and reflog to maintain clean history and recover from any situation. Use when managing complex Git histories, collaborating on feature branches, or troubleshooting repository issues.
reproduce-and-fix-issues
Reproduce triaged Slack bugs through a configured app-control adapter, verify existing fixes, and open a bounded draft pull request only after before-and-after proof. Use only from the configured Benny repro automation.
debug
Debug issues in the MCP Gateway Registry using first-principles thinking. Invoke when something is broken, timing out, returning errors, or behaving unexpectedly. Forces structured root-cause analysis before any code change is proposed.
comet-github-issue-fix
A workflow for fixing a confirmed Comet-related GitHub issue or review blocker within an isolated scope. It covers matching the work to the relevant workflow, testing the change, checking runtime results, and preparing a careful handoff.
triaging-merge-queue-failures
Decision procedure for a PR that failed or was removed from the Trunk merge queue: classify the kick (superseded by a newer commit, not mergeable, a gate that failed on a cancelled run, real failure, one-off flake, or repo-wide flaky/infra issue) and take the matching action (wait, hold and fix, requeue once, or…