Bifrost is an AI gateway that gives applications one OpenAI-compatible API for accessing models from more than 23 providers. It is used to route model requests, handle provider failover and load balancing, and apply features such as caching, guardrails, and MCP gateway support.
Borrowing it
Nothing to install: this file belongs to maximhq/bifrost. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/maximhq/bifrost/dev/.claude/skills/investigate-issue/SKILL.mdgit clone --depth 1 https://github.com/maximhq/bifrostWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/maximhq/bifrost/investigate-issue)<a href="https://agentmods.dev/skills/maximhq/bifrost/investigate-issue"><img src="https://agentmods.dev/badge/skills/maximhq/bifrost/investigate-issue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/maximhq/bifrost/investigate-issue"><img src="https://agentmods.dev/badge/skills/maximhq/bifrost/investigate-issue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 391 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium MCP Rug Pull · line 497 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.08645 |
| Opus 5 | $0.00039 | $0.04322 |
| Sonnet 5 | $0.00016 | $0.01729 |
| Haiku 4.5 | $0.00008 | $0.00864 |
Grade A, and why
investigate-issue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 849 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigate GitHub Issue
Fetch a GitHub issue, analyze the report, search the codebase for relevant code, research external documentation, and present a comprehensive implementation plan with side-effect analysis and test guidance.
Your final report MUST contain all of these sections:
- Issue Details (from Step 1)
- Classification (from Step 2)
- Codebase Analysis + Documentation Research (from Step 3, including sub-step 3e)
- Impact Analysis (from Step 4)
- Test Plan (from Step 5)
- Regression Rerun Scope (from Step 5e) -- which existing tests must rerun, and why
- TDD: Failing Tests (from Step 5f) -- Bug issues only: the test source AND the actual red output from the applicable Makefile recipe, pasted verbatim, BEFORE asking to implement
- Full Presentation (Step 6 template)
If any section is missing, go back and complete it before presenting the report.
For Bug issues the approval gate is NOT "may I write a test?" -- the failing test is already written and shown to be red. The gate is "may I write the fix?"
Usage
/investigate-issue <ISSUE_ID> # Investigate issue by number
/investigate-issue # Prompts for issue ID
Workflow Overview
- Get the issue -- Fetch full issue details from GitHub
- Classify the issue -- Determine type (bug, feature, docs) and affected areas
- Search the codebase and research docs -- Find relevant code, then research the libraries it depends on via Context7 and WebSearch
- Analyze impact -- Cross-reference codebase findings with documentation to identify side effects, dependencies, and breaking changes
- Suggest tests -- If changes touch
core/, recommend specific LLM and MCP test additions 5b. Scope the reruns -- Use coverage to determine which existing tests exercise the lines you plan to change, and tier them by necessity 5c. Go red (Bug issues) -- Write the regression test(s) and run them to confirm failure for the right reason, BEFORE presenting the plan - Present the plan -- Show findings, the red test output, the rerun scope, and the recommended fix
- Implement with approval -- After approval, apply the fix and show red-to-green
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 849 lines · 78 tokens per session scan A 5be4efa3fe0c
investigate-issue is a skill published in the GitHub repository maximhq/bifrost (7,913 stars, last pushed today), licensed Apache-2.0. It adds 78 tokens to every session and 8,645 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
new-project
Bootstrap a new product repository for agentic development. Use when starting a new app, empty repo, greenfield project, or when the user asks to stand up the factory, the start loop, or what to install before the first feature.
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
agentcore-investigation
Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session/trace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.
code-task
PREFERRED way to change code in a REAL repository: fix a GitHub issue, fix a bug, add/implement a function or feature, or make any edit to a project the user names by a filesystem path (e.g. /tmp/foo, /code/bar) or a git URL. Clones the repo, runs an OpenSquilla agent on the host to make the change on a task branch…
mantis-critic
Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with assertions disabled). Don't use for writing reproduction scripts or patches.
explain-issue
Explain a GitHub issue: the background problem and the proposed solution.