Investigate

What it does

When your agent uses it

• Tasks that involve Debugging
• Tasks that involve Root cause analysis
• Tasks that involve Digital forensics

Example prompts

• “investigate”
• “root cause”
• “/investigate”

Requirements

• Pre-approved tools (allowed-tools): Bash, Read, Write, Edit, Glob, Grep

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1Reproduce the bug with concrete evidence
2. 2Analyze patterns to assess scope
3. 3Form and test hypotheses (max 3 strikes)
4. 4Implement minimal fix ONLY after root cause is confirmed
5. 5Verify fix and generate structured report

What it can do on your machine

Read from SKILL.md and the folder at commit 07491b0. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash
  • Read
  • Write
  • Edit
  • Glob
  • Grep

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Investigate loads about 1.1k tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 340 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~43

When it runs · the whole SKILL.md, loaded when a task matches

~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Bash, Read, Write, Edit, Glob, Grep

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from catlog22/Claude-Code-Workflow at commit 07491b0, republished under its MIT licence (© catlog22). 340 words, ~1,095 tokens.

name

investigate

description

Systematic debugging with Iron Law methodology. 5-phase investigation from evidence collection to verified fix. Triggers on "investigate", "debug", "root cause".

allowed-tools

Bash, Read, Write, Edit, Glob, Grep

Phase 1: Root Cause Investigation
  Reproduce bug, collect evidence (errors, logs, traces)
  Use ccw cli --tool gemini --mode analysis for initial diagnosis
  Output: investigation-report.json
      |
      v
Phase 2: Pattern Analysis
  Search codebase for similar patterns (same error, module, antipattern)
  Assess scope: isolated vs systemic
  Output: pattern-analysis section in report
      |
      v
Phase 3: Hypothesis Testing
  Form max 3 hypotheses from evidence
  Test each with minimal read-only probes
  3-strike rule: STOP and escalate on 3 consecutive failures
  Output: confirmed root cause with evidence chain
      |
      v
Phase 4: Implementation  [GATE: requires Phase 3 confirmed root cause]
  Implement minimal fix
  Add regression test
  Verify fix resolves reproduction case
      |
      v
Phase 5: Verification & Report
  Run full test suite
  Check for regressions
  Generate structured debug report to .workflow/.debug/

mkdir -p .workflow/.debug

.workflow/.debug/
  debug-report-{YYYY-MM-DD}-{slug}.json    # Structured debug report

© catlog22, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files in .claude/skills/investigate of catlog22/Claude-Code-Workflow.

• SKILL.md
• phases/01-root-cause-investigation.md
• phases/02-pattern-analysis.md
• phases/03-hypothesis-testing.md
• phases/04-implementation.md
• phases/05-verification-report.md
• specs/debug-report-format.md
• specs/iron-law.md

Open the folder on GitHubat commit 07491b0