investigate

name	investigate
description	Deep investigation of an incident or finding. Performs thorough root cause analysis with hypothesis testing and evidence gathering. Use after /incident or /finding.
context	fork
agent	general-purpose
disable-model-invocation	false
argument-hint	[finding-ref or description]
wrought	{"version":"1.0","tools":{"capabilities":["read_file","search_content","find_files","write_file","run_command"]},"platforms":{"claude-code":{"disable-model-invocation":false}},"agent":{"role":"Investigation Analyst","expertise":["root cause analysis","hypothesis testing","evidence gathering"],"non_goals":["implementing fixes","writing code"]},"execution":{"default_mode":"hypothesis-rca","max_iterations":15,"stop_conditions":["Investigation report written to docs/investigations/","Root cause identified with evidence","User instructed to stop"]},"output":{"format":"markdown","template":"docs/investigations/{YYYY-MM-DD_HHMM}_{name}.md","required_sections":["Summary","Hypotheses","Evidence","Root Cause","Recommended Fix"]},"pipeline":{"track":"reactive","standalone":false,"prerequisites":["docs/incidents/*.md","docs/findings/*.md"],"produces":["docs/investigations/*.md"],"suggested_next":["rca-bugfix","design"]}}

Deep Investigation Skill

Trigger: Use /investigate {incident or finding report} when you need a thorough investigation of an incident, bug, unexpected behavior, or proactive finding.

Input: An incident report (from /incident) or a finding report (from /finding) describing what happened or what was found.

Examples:

• /investigate Extraction hung at 12% - no error in logs, last event was url_refresh_triggered at 07:38 UTC
• /investigate Rate limiting errors despite batch processing - 429 responses every 2 seconds starting 14:00 UTC
• /investigate Health check showing red but API responding - monitor page shows Backend=red since 09:15 UTC
• /investigate Finding: Missing companyId filter in invoice WHERE clauses -- authorization gap

---

Prerequisites

Before executing this skill, verify ALL of the following:

1. Use Glob to check for: docs/findings/*_FINDINGS_TRACKER.md or docs/incidents/*.md
   • If NO match -> STOP: "Run /finding or /incident first to create an upstream artifact."
   • If user says --force, proceed without validation.
2. Read the most recent Findings Tracker matching *_FINDINGS_TRACKER.md
   • Identify the relevant finding (ask user if ambiguous)

Pre-flight Check

1. Verify artifact prerequisites (above)
2. Identify which finding/workflow this is for
3. Load finding report and related artifacts for context
4. Proceed to main skill instructions

---

Instructions

Reason thoroughly about this incident or finding. Consider all evidence, form multiple hypotheses, and test each systematically before concluding.

Input Type Detection

Determine the input type and route accordingly:

IF input references a finding report (docs/findings/*.md) OR starts with "Finding:":
    → Confirmation Mode (abbreviated investigation)
ELSE:
    → Full Investigation Mode (standard investigation)

Full Investigation Mode (incidents)

1. Research online for relevant documentation and known issues (search as of {current_month_year})
2. based on what the incident involves (search as of {current_month_year})