菜单
Deep investigation of an incident or finding. Performs thorough root cause analysis with hypothesis testing and evidence gathering. Use after /incident or /finding.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/fluxforgeai/wrought-plugin --skill investigate命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Produce an adversarially-verified, source-cited, full-stack, interactive HTML decision brief for informed go/no-go sign-off at a human decision boundary. MVP mode: pivot-review. Extends /ux-design; consumes /research and /design; feeds /design on GO.
Deep multi-agent code review with algorithmic complexity analysis, data structure review, paradigm enforcement, and efficiency analysis. Complements /simplify with deeper dimensions.
End session and create all handoff documentation
| name | investigate |
| description | Deep investigation of an incident or finding. Performs thorough root cause analysis with hypothesis testing and evidence gathering. Use after /incident or /finding. |
| context | fork |
| agent | general-purpose |
| disable-model-invocation | false |
| argument-hint | [finding-ref or description] |
| effort | xhigh |
| wrought | {"version":"1.0","tools":{"capabilities":["read_file","search_content","find_files","write_file","run_command"]},"platforms":{"claude-code":{"disable-model-invocation":false}},"agent":{"role":"Investigation Analyst","expertise":["root cause analysis","hypothesis testing","evidence gathering"],"non_goals":["implementing fixes","writing code"]},"execution":{"default_mode":"hypothesis-rca","max_iterations":15,"stop_conditions":["Investigation report written to docs/investigations/","Root cause identified with evidence","User instructed to stop"]},"output":{"format":"markdown","template":"docs/investigations/{YYYY-MM-DD_HHMM}_{name}.md","required_sections":["Summary","Hypotheses","Evidence","Root Cause","Recommended Fix"]},"pipeline":{"track":"reactive","standalone":false,"prerequisites":["docs/incidents/*.md","docs/findings/*.md"],"produces":["docs/investigations/*.md"],"suggested_next":["rca-bugfix","design"]}} |
Routing note (Pass-A): This skill runs as a forked
general-purposeagent (context: fork). Forking sub-steps spawn with an explicitmodel+effortper the Pass-A default (floorhigh, defaultxhighfor coding/agentic sub-steps);maxis reserved for Pass-B-gated escalations (e.g. loop-stall, irreversible-tag) — it is not the default for every spawn. Seedocs/reference/dynamic_stage_routing_policy.md.
Trigger: Use /investigate {incident or finding report} when you need a thorough investigation of an incident, bug, unexpected behavior, or proactive finding.
Input: An incident report (from /incident) or a finding report (from /finding) describing what happened or what was found.
Examples:
/investigate Extraction hung at 12% - no error in logs, last event was url_refresh_triggered at 07:38 UTC/investigate Rate limiting errors despite batch processing - 429 responses every 2 seconds starting 14:00 UTC/investigate Health check showing red but API responding - monitor page shows Backend=red since 09:15 UTC/investigate Finding: Missing companyId filter in invoice WHERE clauses -- authorization gapBefore executing this skill, verify ALL of the following:
docs/findings/*_FINDINGS_TRACKER.md or docs/incidents/*.md
--force, proceed without validation.*_FINDINGS_TRACKER.md
Reason thoroughly about this incident or finding. Consider all evidence, form multiple hypotheses, and test each systematically before concluding.
Determine the input type and route accordingly:
IF input references a finding report (docs/findings/*.md) OR starts with "Finding:":
→ Confirmation Mode (abbreviated investigation)
ELSE:
→ Full Investigation Mode (standard investigation)
/investigatedocs/RCAs/ and docs/investigations/ to avoid repeating errors and recognize patternsdocs/investigations/{YYYY-MM-DD_HHMM}_{issue_name}.mdOptional — supervised Fable hypothesis-generator (baffling exhausted root cause only): if the root cause stays open after a thorough Full Investigation, the operator may manually spawn ONE Claude Fable 5 hypothesis-generator via the Agent tool — it generates candidate hypotheses only, never a verdict. Test each candidate on the Opus session model; watch for refused/empty output (a refusal is a non-answer, not a clean bill); the human reads the RCA before /rca-bugfix. Manual, opt-in, owner/ZDR-free only — no committed model: pin (see CST-004).
When a proactive finding is provided, the cause is often already known. The investigation confirms scope and validates the finding:
docs/findings/ to understand what was founddocs/investigations/{YYYY-MM-DD_HHMM}_{issue_name}.mdSearch online (use current date context: {current_month_year}):
Consult Relevant Documentation:
First, identify what technology/API/library the incident involves. Then search for documentation specific to that technology.
EXAMPLES (use these as a pattern, NOT as default searches):
IMPORTANT: Only search documentation relevant to the actual incident. Do NOT default to searching Stripe or Slack docs unless the incident specifically involves those APIs.
From the documentation, extract:
Construct a precise timeline of events:
Before recommending any fixes, read all files in: docs/RCAs/, docs/research/, docs/plans/, docs/investigations/, docs/findings/. Look for similar issues, prior fixes, recurring patterns, and applicable solutions.
Document patterns found: Has this exact or similar issue occurred before? Did a previous fix cause this? Is this a regression?
7ec022fdSee report_template.md for the full investigation report template.
Write to: docs/investigations/{YYYY-MM-DD_HHMM}_{issue_name}.md
STOP and tell the user:
Investigation complete.
Report saved to: docs/investigations/{YYYY-MM-DD_HHMM}_{issue_name}.md
Summary: {1-2 sentence summary}
Sources consulted:
- {List of documentation/URLs researched}
Past RCAs/Investigations/Research reviewed:
- {List of related past documents consulted}
**CRITICAL PIPELINE RULE**: Suggest ONLY the next pipeline step below. Do NOT offer `/plan` directly — that comes after `/rca-bugfix`.
Next step: Run `/rca-bugfix` with the investigation at `docs/investigations/{filename}.md` to create RCA and implementation prompt.
Do NOT add commentary suggesting any pipeline step could be skipped or is unnecessary. Awaiting your instructions.
STOP and tell the user:
Finding confirmed.
Report saved to: docs/investigations/{YYYY-MM-DD_HHMM}_{issue_name}.md
Finding: {reference to original finding report}
Scope: {isolated | systemic | broader than expected}
Confirmed: {Yes -- real issue | Partially -- narrower than reported | No -- false positive}
**CRITICAL PIPELINE RULE**: Suggest ONLY the next pipeline step below. Do NOT offer `/plan` directly — that comes after `/rca-bugfix`.
Next step: Run `/rca-bugfix` with the investigation at `docs/investigations/{filename}.md` to create RCA and fix prompt.
Do NOT add commentary suggesting any pipeline step could be skipped or is unnecessary. Awaiting your instructions.
Do NOT proceed with fixes or additional work until the user responds.