Rill is a business intelligence tool for turning data sources into SQL models, metrics, dashboards, and natural-language analysis. It is used by business users and coding agents, with OLAP engines such as ClickHouse and DuckDB supporting its queries. Its catalogue add-ons support agent-driven work on Rill projects.
Borrowing it
Nothing to install: this file belongs to rilldata/rill. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rilldata/rill/main/.claude/skills/investigate/SKILL.mdgit clone --depth 1 https://github.com/rilldata/rillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rilldata/rill/investigate)<a href="https://agentmods.dev/skills/rilldata/rill/investigate"><img src="https://agentmods.dev/badge/skills/rilldata/rill/investigate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rilldata/rill/investigate"><img src="https://agentmods.dev/badge/skills/rilldata/rill/investigate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.00302 |
| Opus 5.5 | $0.00004 | $0.00121 |
| Sonnet 5.5 | $0.00002 | $0.00060 |
| Haiku 4.5 | $0.00001 | $0.00030 |
Grade A, and why
investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Investigate a bug by gathering context, then spawning parallel Task agents to test multiple hypotheses simultaneously.
Input: $ARGUMENTS
Instructions
1. Gather Context
Parse the input for links and fetch context:
- Slack link (contains
slack.com/archives): Fetch the message and thread replies via Slack MCP tools - Linear issue (ID like
ENG-1234or URL): Fetch viamcp__linear__get_issue, including comments and attachments - Free text: Use directly as the problem statement
User-provided hunches should be prioritized when forming hypotheses.
2. Investigate in Parallel
Generate 3-5 hypotheses, then use the Task tool to spawn one agent per hypothesis in a single message (parallel, not sequential). For each agent:
subagent_type: "Explore",model: "sonnet"- A focused prompt with the hypothesis, what to look for, and what would confirm or refute it
3. Synthesize
After all agents complete, report: which hypotheses were confirmed, refuted, or inconclusive, and recommend next steps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 33 lines · 11 tokens per session scan A 9f1321dfb4e5
investigate is a skill published in the GitHub repository rilldata/rill (2,970 stars, last pushed yesterday), licensed Apache-2.0. It adds 11 tokens to every session and 302 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hardwood-cli
Inspect, debug, and convert Apache Parquet files with the hardwood CLI. Use whenever a user is debugging code that reads or writes Parquet (Arrow / Spark / Flink / Java / Python) and the data file itself may be the cause — to check the schema, physical and logical types, repetition, or a row sample. Use it to diagnose…
analytical-databases-expert
Design and query columnar analytical stores: DuckDB, ClickHouse and cloud warehouses, including file formats, partitioning, sort keys and cost control. Use when the user mentions DuckDB, ClickHouse, Parquet, columnar storage, OLAP, a data warehouse or lakehouse, analytical queries over large tables, or when the task…
exasol-import-export
Exasol IMPORT and EXPORT SQL statements: syntax, file formats (CSV, FBV, Parquet), cloud storage (S3, Azure, GCS), connection objects, error handling, and ETL staging patterns.
duckdb
Use when analytical SQL must run in-process with no server: Parquet/CSV/JSON/Arrow queried in place, OLAP embedded in an app or notebook, a slow pandas groupby on multi-GB data, or S3/lakehouse data read without downloading. NOT a multi-user analytics server (that is clickhouse-analytics), NOT an app's transactional…
duckdb
Run embedded OLAP SQL on Parquet/CSV locally; configure memory and thread limits; attach remote files safely; export with COPY; avoid multi-writer locks and treating DuckDB as a production server database.
data-pipeline
ETL and data transformation: CSV, JSON, Parquet, NDJSON processing with filtering, mapping, joining, aggregating.