New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Investigate

by MadAppGang in MadAppGang/claude-code

Unified entry point for code investigation. An agent skill from MadAppGang/claude-code.

MITAuto-check: notes

Install Investigate

skills CLI
$ npx skills add MadAppGang/claude-code --skill investigate -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install MadAppGang/claude-code investigate --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/MadAppGang/claude-code.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/code-analysis/skills/investigate .claude/skills/investigate && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
investigate
GitHub stars
285
Token cost
~2.4k tokens
SKILL.md length
467 words
Files
1
Skills in repo
69
Repo updated
First seen
Licence
MIT

At a glance

Unified entry point for code investigation. An agent skill from MadAppGang/claude-code.

  • Works in 4 steps: Extract Query → Keyword Detection → User Feedback → …
  • Investigation type is unclear
  • SKILL.md covers Overview, Routing Logic, Workflow and Examples, plus 5 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Investigate is an agent skill from MadAppGang/claude-code. Unified entry point for code investigation. Auto-routes to specialized detective based on query keywords. Use when investigation type is unclear or for general exploration.

Its SKILL.md is about 2.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

The repository describes itself as: claude code plugins marketplace. The licence is MIT.

When your agent uses it

  • Investigation type is unclear
  • For general exploration

Example prompts

  • “/investigate”

Requirements

  • Pre-approved tools (allowed-tools): Bash, Task, AskUserQuestion

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Extract Query
  2. Keyword Detection
  3. User Feedback
  4. Delegation via Task Tool

What it can do on your machine

Read from SKILL.md and the folder at commit 6097ad4. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash
    • Task
    • AskUserQuestion

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash and typescript).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Investigate loads about 2.4k tokens when it runs. Until then it costs about 46 tokens; SKILL.md has 467 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~46
When it runs · the whole SKILL.md, loaded when a task matches
~2.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash, Task, AskUserQuestion

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from MadAppGang/claude-code at commit 6097ad4, republished under its MIT licence (© MadAppGang). 467 words, ~2,433 tokens.

Download SKILL.mdSave it as .claude/skills/investigate/SKILL.md (or your agent's skills folder).
name
investigate
description
Unified entry point for code investigation. Auto-routes to specialized detective based on query keywords. Use when investigation type is unclear or for general exploration.
allowed-tools
Bash, Task, AskUserQuestion

Investigate Skill

Version: 1.0.0 Purpose: Keyword-based routing to specialized detective skills Pattern: Smart delegation via Task tool

Overview

This skill analyzes your investigation query and routes to the appropriate detective specialist:

  • debugger-detective (errors, bugs, crashes)
  • tester-detective (tests, coverage, edge cases)
  • architect-detective (architecture, design, patterns)
  • developer-detective (implementation, data flow - default)

Routing Logic

Priority System (Highest First)

  1. Error/Debug (Priority 1) - Time-critical bug fixes

    • Keywords: "debug", "error", "broken", "failing", "crash"
    • Route to: debugger-detective

  2. Testing (Priority 2) - Specialized test analysis

    • Keywords: "test", "coverage", "edge case", "mock"
    • Route to: tester-detective

  3. Architecture (Priority 3) - High-level understanding

    • Keywords: "architecture", "design", "structure", "layer"
    • Route to: architect-detective

  4. Implementation (Default, Priority 4) - Most common

    • Keywords: "implementation", "how does", "code flow"
    • Route to: developer-detective
Conflict Resolution

When multiple keywords from different categories are detected:

  • Highest priority wins (Priority 1 beats Priority 2, etc.)
  • No matches: Default to developer-detective

Workflow

Phase 1: Extract Query

The investigation query should be available from the task description or user input.

bash
# Query comes from the Task description or user request
INVESTIGATION_QUERY="${TASK_DESCRIPTION:-$USER_QUERY}"

# Normalize to lowercase for case-insensitive matching
QUERY_LOWER=$(echo "$INVESTIGATION_QUERY" | tr '[:upper:]' '[:lower:]')
Phase 2: Keyword Detection
bash
# Priority 1: Error/Debug keywords
if echo "$QUERY_LOWER" | grep -qE "debug|error|broken|failing|crash"; then
  DETECTIVE="debugger-detective"
  KEYWORDS="debug/error keywords"
  PRIORITY=1
  RATIONALE="Bug fixes are time-critical and require call chain tracing"

# Priority 2: Testing keywords
elif echo "$QUERY_LOWER" | grep -qE "test|coverage|edge case|mock"; then
  DETECTIVE="tester-detective"
  KEYWORDS="test/coverage keywords"
  PRIORITY=2
  RATIONALE="Test analysis is specialized and requires callers analysis"

# Priority 3: Architecture keywords
elif echo "$QUERY_LOWER" | grep -qE "architecture|design|structure|layer"; then
  DETECTIVE="architect-detective"
  KEYWORDS="architecture/design keywords"
  PRIORITY=3
  RATIONALE="High-level understanding requires PageRank analysis"

# Priority 4: Implementation (default)
else
  DETECTIVE="developer-detective"
  KEYWORDS="implementation (default)"
  PRIORITY=4
  RATIONALE="Most common investigation type - data flow via callers/callees"
fi
Phase 3: User Feedback

Before delegating, inform the user of the routing decision:

bash
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🔍 Investigation Routing"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "Query: $INVESTIGATION_QUERY"
echo ""
echo "Detected: $KEYWORDS (Priority $PRIORITY)"
echo "Routing to: $DETECTIVE"
echo "Reason: $RATIONALE"
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
Phase 4: Delegation via Task Tool

Use the Task tool to delegate to the selected detective:

typescript
Task({
  description: INVESTIGATION_QUERY,
  agent: DETECTIVE,
  context: {
    routing_reason: `Auto-routed based on ${KEYWORDS}`,
    original_query: INVESTIGATION_QUERY,
    priority: PRIORITY
  }
})

Examples

Example 1: Debug Keywords

Input: "Why is login broken?"

Detection:

  • Keyword matched: "broken"
  • Priority: 1 (Error/Debug)
  • Route to: debugger-detective

Feedback:

🔍 Investigation Routing
Query: Why is login broken?
Detected: debug/error keywords (Priority 1)
Routing to: debugger-detective
Reason: Bug fixes are time-critical and require call chain tracing
Example 2: Test Keywords

Input: "What's the test coverage for payment?"

Detection:

  • Keywords matched: "test", "coverage"
  • Priority: 2 (Testing)
  • Route to: tester-detective

Feedback:

🔍 Investigation Routing
Query: What's the test coverage for payment?
Detected: test/coverage keywords (Priority 2)
Routing to: tester-detective
Reason: Test analysis is specialized and requires callers analysis
Example 3: Architecture Keywords

Input: "What's the architecture of the auth layer?"

Detection:

  • Keywords matched: "architecture", "layer"
  • Priority: 3 (Architecture)
  • Route to: architect-detective

Feedback:

🔍 Investigation Routing
Query: What's the architecture of the auth layer?
Detected: architecture/design keywords (Priority 3)
Routing to: architect-detective
Reason: High-level understanding requires PageRank analysis
Example 4: No Keywords (Default)

Input: "How does payment work?"

Detection:

  • No keywords matched
  • Priority: 4 (Default)
  • Route to: developer-detective

Feedback:

🔍 Investigation Routing
Query: How does payment work?
Detected: implementation (default) (Priority 4)
Routing to: developer-detective
Reason: Most common investigation type - data flow via callers/callees
Show full SKILL.md (186 more words)Show less
Example 5: Multi-Keyword Conflict

Input: "Debug the test coverage"

Detection:

  • Keywords matched: "debug" (Priority 1) AND "test" (Priority 2)
  • Priority 1 wins
  • Route to: debugger-detective

Feedback:

🔍 Investigation Routing
Query: Debug the test coverage
Detected: debug/error keywords (Priority 1)
Routing to: debugger-detective
Reason: Bug fixes are time-critical and require call chain tracing
(Note: Also detected test keywords, but debug takes priority)

Complete Implementation

Here's the full workflow:

bash
#!/bin/bash

# Get investigation query from task description
INVESTIGATION_QUERY="${TASK_DESCRIPTION}"

# Normalize to lowercase
QUERY_LOWER=$(echo "$INVESTIGATION_QUERY" | tr '[:upper:]' '[:lower:]')

# Keyword detection with priority routing
if echo "$QUERY_LOWER" | grep -qE "debug|error|broken|failing|crash"; then
  DETECTIVE="debugger-detective"
  KEYWORDS="debug/error keywords"
  PRIORITY=1
  RATIONALE="Bug fixes are time-critical and require call chain tracing"

elif echo "$QUERY_LOWER" | grep -qE "test|coverage|edge case|mock"; then
  DETECTIVE="tester-detective"
  KEYWORDS="test/coverage keywords"
  PRIORITY=2
  RATIONALE="Test analysis is specialized and requires callers analysis"

elif echo "$QUERY_LOWER" | grep -qE "architecture|design|structure|layer"; then
  DETECTIVE="architect-detective"
  KEYWORDS="architecture/design keywords"
  PRIORITY=3
  RATIONALE="High-level understanding requires PageRank analysis"

else
  DETECTIVE="developer-detective"
  KEYWORDS="implementation (default)"
  PRIORITY=4
  RATIONALE="Most common investigation type - data flow via callers/callees"
fi

# Show routing decision
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🔍 Investigation Routing"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "Query: $INVESTIGATION_QUERY"
echo ""
echo "Detected: $KEYWORDS (Priority $PRIORITY)"
echo "Routing to: $DETECTIVE"
echo "Reason: $RATIONALE"
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

Then use the Task tool to delegate:

typescript
Task({
  description: INVESTIGATION_QUERY,
  agent: DETECTIVE
})

Fallback Protocol

If routing produces unexpected results:

  1. Show routing decision to user
  2. Ask for override if needed via AskUserQuestion
  3. Default to developer-detective if ambiguous
Override Pattern
typescript
// If user wants to override the routing
AskUserQuestion({
  questions: [{
    question: `Auto-routing selected ${DETECTIVE}. Override?`,
    header: "Investigation Routing",
    multiSelect: false,
    options: [
      { label: "Continue with auto-routing", description: `Use ${DETECTIVE}` },
      { label: "debugger-detective", description: "Root cause analysis" },
      { label: "tester-detective", description: "Test coverage analysis" },
      { label: "architect-detective", description: "Architecture patterns" },
      { label: "developer-detective", description: "Implementation details" }
    ]
  }]
})

Integration with Existing Workflow

This skill is additive only and does not change existing behavior:

  • Direct detective usage still works (Task → specific detective)
  • /analyze command unchanged (launches codebase-detective)
  • Parallel orchestration patterns unchanged
  • All claudemem hooks preserved

Use Cases

When to Use Investigate SkillWhen to Use Direct Detective
Investigation type unclearYou know which specialist you need
General explorationParallel orchestration (multimodel plugin)
Quick routing decisionSpecific workflow requirements
Learning/experimentingProduction automation

Notes

  • Case-insensitive keyword matching
  • Priority system resolves conflicts
  • User sees routing decision before delegation
  • Original query preserved in Task context
  • Default to developer-detective when no keywords match
  • Works with all claudemem versions (v0.3.0+)

Maintained by: MadAppGang Plugin: code-analysis v3.1.0 Last Updated: January 2026 (v1.0.0 - Initial release)

© MadAppGang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in plugins/code-analysis/skills/investigate of MadAppGang/claude-code.

Open the folder on GitHubat commit 6097ad4

Compare with similar skills

Investigate next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Investigate compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Investigate this skillMadAppGang/claude-code285—~2.4kAutomated safety check: NotesMIT
Smart Contract Entry Point Analyzertrailofbits/skills7.5k1 repos~2.4kAutomated safety check: NotesCC-BY-SA-4.0
HyperFrames Video Entry Pointheygen-com/hyperframes60k3 repos~5.2kAutomated safety check: PassApache-2.0
OmniRoute Routing CLIdiegosouzapw/OmniRoute75k—~342Automated safety check: PassMIT
Root Cause Investigationgarrytan/gstack136k—~13kAutomated safety check: NotesMIT
Osint Investigationaffaan-m/ECC276k—~5.7kAutomated safety check: PassCC-BY-SA-4.0

Similar skills

  • Smart Contract Entry Point Analyzer

    trailofbits/skills

    Official

    Maps the state-changing entry points of a smart contract codebase and sorts them by access level, producing a structured audit report that leaves out read-only functions.

    7.5k GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • HyperFrames Video Entry Point

    heygen-com/hyperframes

    Entry point for making, editing and rendering videos from HTML compositions with HyperFrames, routing each request to the right workflow.

    60k GitHub starsUsed in 3 repos~5.2k tokens
    Media & CreativeAuto-check passed

  • OmniRoute Routing CLI

    diegosouzapw/OmniRoute

    Creates, switches, and inspects OmniRoute model-routing combos, plus a suggestion command with cost and latency constraints.

    75k GitHub stars~342 tokensUpdated today
    AI & LLM EngineeringAuto-check passed

  • Root Cause Investigation

    garrytan/gstack

    Debugs in four phases (investigate, analyze, hypothesize, implement) under one rule: no fix is made until the root cause is found.

    136k GitHub stars~13k tokensUpdated today
    DevelopmentAuto-check: notes

  • Osint Investigation

    affaan-m/ECC

    Sparse-clue OSINT investigation methodology for extracting overlooked leads, connecting fragmented evidence, and testing explanations across sources.

    276k GitHub stars~5.7k tokensUpdated yesterday
    SecurityAuto-check passed

  • OmniRoute Combo Routing

    diegosouzapw/OmniRoute

    Manages OmniRoute routing combos through its REST API: create and update combos, choose from 19 strategies, set fallback chains, test outcomes and read metrics.

    75k GitHub stars~2.1k tokensUpdated today
    Backend & APIsAuto-check passed

More from MadAppGang/claude-code

All 69 skills in this repo

  • Content Brief

    MadAppGang/claude-code

    Content brief template and creation methodology for SEO-optimized content.

    285 GitHub starsUsed in 1 repo~959 tokens
    Auto-check passed

  • Context Detection

    MadAppGang/claude-code

    A skill your agent uses when detecting project technology stack from files/configs/directory structure, auto-loading framework-specific skills, or analyzing multi-stack fullstack projects (e.g…

    285 GitHub stars~5.4k tokensUpdated 7 mo ago
    Auto-check passed

  • Content Optimizer

    MadAppGang/claude-code

    On-page SEO optimization techniques including keyword density, meta tags, heading structure, and readability.

    285 GitHub starsUsed in 1 repo~694 tokens
    Auto-check passed

  • Keyword Cluster Builder

    MadAppGang/claude-code

    Techniques for expanding seed keywords and clustering by topic and intent.

    285 GitHub starsUsed in 1 repo~674 tokens
    Auto-check passed

  • Serp Analysis

    MadAppGang/claude-code

    SERP analysis techniques for intent classification, feature identification, and competitive intelligence.

    285 GitHub starsUsed in 1 repo~1k tokens
    Auto-check passed

  • Agent Coordination Discipline

    MadAppGang/claude-code

    A skill your agent uses when deciding whether to launch an agent, selecting which agent to use, or coordinating multiple agents.

    285 GitHub stars~3.8k tokensUpdated 7 mo ago
    Auto-check passed

Questions about Investigate

What does Investigate do?

Unified entry point for code investigation. An agent skill from MadAppGang/claude-code. Investigate is an agent skill from MadAppGang/claude-code. Unified entry point for code investigation.

When should I use Investigate?

Investigate fits situations like: investigation type is unclear; for general exploration.

How do I install Investigate in Claude Code?

Run `npx skills add MadAppGang/claude-code --skill investigate -a claude-code`. Or copy the skill folder (plugins/code-analysis/skills/investigate in MadAppGang/claude-code) into .claude/skills/investigate in your project. Claude Code loads it when a task matches its description.

How do I install Investigate in Codex?

Run `npx skills add MadAppGang/claude-code --skill investigate -a codex`. Or copy the skill folder (plugins/code-analysis/skills/investigate in MadAppGang/claude-code) into .agents/skills/investigate in your project. Codex loads it when a task matches its description.

Can I use Investigate in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add MadAppGang/claude-code --skill investigate -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/investigate, .gemini/skills/investigate, .github/skills/investigate and .opencode/skills/investigate in your project.

What does Investigate need to run?

SKILL.md names no scripts, command-line tools or credentials: Investigate is instructions for the agent only. Its frontmatter pre-approves these tools: Bash, Task, AskUserQuestion.

Does Investigate access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Investigate safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Investigate use?

Investigate is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Investigate use?

About 2.4k tokens (SKILL.md is roughly 9.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Investigate?

Skills that share tags, products or a category with Investigate: Smart Contract Entry Point Analyzer (trailofbits/skills, 7.5k stars), HyperFrames Video Entry Point (heygen-com/hyperframes, 60k stars), OmniRoute Routing CLI (diegosouzapw/OmniRoute, 75k stars) and Root Cause Investigation (garrytan/gstack, 136k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Investigate?

MadAppGang (a GitHub organization) maintains it in MadAppGang/claude-code, which has 285 GitHub stars. The repository holds 69 skills in this directory. The repository was last updated on March 15, 2026.

Source: MadAppGang/claude-code on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.