investigate
The investigate skill analyzes investigation queries and automatically routes them to specialized detective skills based on keyword detection. Use this when the type of code investigation is unclear or for general exploration, as it intelligently delegates to debugger-detective for bug fixes, tester-detective for test analysis, architect-detective for design questions, or developer-detective for implementation queries.
git clone --depth 1 https://github.com/MadAppGang/claude-code /tmp/investigate && cp -r /tmp/investigate/plugins/code-analysis/skills/investigate ~/.claude/skills/investigateSKILL.md
# Investigate Skill
**Version:** 1.0.0
**Purpose:** Keyword-based routing to specialized detective skills
**Pattern:** Smart delegation via Task tool
## Overview
This skill analyzes your investigation query and routes to the appropriate detective specialist:
- **debugger-detective** (errors, bugs, crashes)
- **tester-detective** (tests, coverage, edge cases)
- **architect-detective** (architecture, design, patterns)
- **developer-detective** (implementation, data flow - default)
## Routing Logic
### Priority System (Highest First)
1. **Error/Debug** (Priority 1) - Time-critical bug fixes
- Keywords: "debug", "error", "broken", "failing", "crash"
- Route to: `debugger-detective`
2. **Testing** (Priority 2) - Specialized test analysis
- Keywords: "test", "coverage", "edge case", "mock"
- Route to: `tester-detective`
3. **Architecture** (Priority 3) - High-level understanding
- Keywords: "architecture", "design", "structure", "layer"
- Route to: `architect-detective`
4. **Implementation** (Default, Priority 4) - Most common
- Keywords: "implementation", "how does", "code flow"
- Route to: `developer-detective`
### Conflict Resolution
When multiple keywords from different categories are detected:
- **Highest priority wins** (Priority 1 beats Priority 2, etc.)
- **No matches**: Default to developer-detective
## Workflow
### Phase 1: Extract Query
The investigation query should be available from the task description or user input.
```bash
# Query comes from the Task description or user request
INVESTIGATION_QUERY="${TASK_DESCRIPTION:-$USER_QUERY}"
# Normalize to lowercase for case-insensitive matching
QUERY_LOWER=$(echo "$INVESTIGATION_QUERY" | tr '[:upper:]' '[:lower:]')
```
### Phase 2: Keyword Detection
```bash
# Priority 1: Error/Debug keywords
if echo "$QUERY_LOWER" | grep -qE "debug|error|broken|failing|crash"; then
DETECTIVE="debugger-detective"
KEYWORDS="debug/error keywords"
PRIORITY=1
RATIONALE="Bug fixes are time-critical and require call chain tracing"
# Priority 2: Testing keywords
elif echo "$QUERY_LOWER" | grep -qE "test|coverage|edge case|mock"; then
DETECTIVE="tester-detective"
KEYWORDS="test/coverage keywords"
PRIORITY=2
RATIONALE="Test analysis is specialized and requires callers analysis"
# Priority 3: Architecture keywords
elif echo "$QUERY_LOWER" | grep -qE "architecture|design|structure|layer"; then
DETECTIVE="architect-detective"
KEYWORDS="architecture/design keywords"
PRIORITY=3
RATIONALE="High-level understanding requires PageRank analysis"
# Priority 4: Implementation (default)
else
DETECTIVE="developer-detective"
KEYWORDS="implementation (default)"
PRIORITY=4
RATIONALE="Most common investigation type - data flow via callers/callees"
fi
```
### Phase 3: User Feedback
Before delegating, inform the user of the routing decision:
```bash
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🔍 Investigation Routing"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "Query: $INVESTIGATION_QUERY"
echo ""
echo "Detected: $KEYWORDS (Priority $PRIORITY)"
echo "Routing to: $DETECTIVE"
echo "Reason: $RATIONALE"
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
```
### Phase 4: Delegation via Task Tool
Use the Task tool to delegate to the selected detective:
```typescript
Task({
description: INVESTIGATION_QUERY,
agent: DETECTIVE,
context: {
routing_reason: `Auto-routed based on ${KEYWORDS}`,
original_query: INVESTIGATION_QUERY,
priority: PRIORITY
}
})
```
## Examples
### Example 1: Debug Keywords
**Input:** "Why is login broken?"
**Detection:**
- Keyword matched: "broken"
- Priority: 1 (Error/Debug)
- Route to: debugger-detective
**Feedback:**
```
🔍 Investigation Routing
Query: Why is login broken?
Detected: debug/error keywords (Priority 1)
Routing to: debugger-detective
Reason: Bug fixes are time-critical and require call chain tracing
```
### Example 2: Test Keywords
**Input:** "What's the test coverage for payment?"
**Detection:**
- Keywords matched: "test", "coverage"
- Priority: 2 (Testing)
- Route to: tester-detective
**Feedback:**
```
🔍 Investigation Routing
Query: What's the test coverage for payment?
Detected: test/coverage keywords (Priority 2)
Routing to: tester-detective
Reason: Test analysis is specialized and requires callers analysis
```
### Example 3: Architecture Keywords
**Input:** "What's the architecture of the auth layer?"
**Detection:**
- Keywords matched: "architecture", "layer"
- Priority: 3 (Architecture)
- Route to: architect-detective
**Feedback:**
```
🔍 Investigation Routing
Query: What's the architecture of the auth layer?
Detected: architecture/design keywords (Priority 3)
Routing to: architect-detective
Reason: High-level understanding requires PageRank analysis
```
### Example 4: No Keywords (Default)
**Input:** "How does payment work?"
**Detection:**
- No keywords matched
- Priority: 4 (Default)
- Route to: developer-detective
**Feedback:**
```
🔍 Investigation Routing
Query: How does payment work?
Detected: implementation (default) (Priority 4)
Routing to: developer-detective
Reason: Most common investigation type - data flow via callers/callees
```
### Example 5: Multi-Keyword Conflict
**Input:** "Debug the test coverage"
**Detection:**
- Keywords matched: "debug" (Priority 1) AND "test" (Priority 2)
- Priority 1 wins
- Route to: debugger-detective
**Feedback:**
```
🔍 Investigation Routing
Query: Debug the test coverage
Detected: debug/error keywords (Priority 1)
Routing to: debugger-detective
Reason: Bug fixes are time-critical and require call chain tracing
(Note: Also detected test keywords, but debug takes priority)
```
## Complete Implementation
Here's the full workflow:
```bash
#!/bin/bash
# Get investigation query from task description
INVESTIGATION_QUERY="${TASK_DESCRIPTION}"
# Normalize to lowercase
QUERY_LOWER=$(echo "$INVESTIGATIOArchitecture Decision Records (ADR) documentation practice. Use when documenting architectural decisions, recording technical trade-offs, creating decision logs, or establishing architectural patterns. Trigger keywords - "ADR", "architecture decision", "decision record", "trade-offs", "architectural decision", "decision log".
Use when deciding whether to launch an agent, selecting which agent to use, or coordinating multiple agents. Covers delegation criteria, external-model patterns, task isolation, and agent selection strategies.
Use when designing REST or GraphQL APIs, defining endpoints, implementing pagination/filtering, handling API versioning, or establishing API documentation with OpenAPI/Swagger.
Use when integrating Apidog + OpenAPI specifications with your React app. Covers MCP server setup, type generation, and query layer integration. Use when setting up API clients, generating types from OpenAPI, or integrating with Apidog MCP.
Analyzes API documentation from OpenAPI specs to provide TypeScript interfaces, request/response formats, and implementation guidance. Use when implementing API integrations, debugging API errors (400, 401, 404), replacing mock APIs, verifying data types, or when user mentions endpoints, API calls, or backend integration.
Use when analyzing architecture and system design. Find design patterns, map layers, identify core abstractions via PageRank. Uses claudemem AST structural analysis for efficient architecture investigation.
On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality", "compliance", "security audit".
Use when implementing authentication (JWT, sessions, OAuth), authorization (RBAC, ABAC), password hashing, MFA, or security best practices for backend services.