investigate

An agent skill by garrytan, from garrytan/gstack. Tags: analysis, debugging, troubleshooting.

What it does

Systematic debugging with root cause investigation. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill investigate

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/investigate ~/.claude/skills/investigate

Safety box score

Grade D, elevated risk: 58 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a debugging workflow that runs shell hooks, reads and writes local gstack state, and can reach the web through Aside/WebSearch. The main risks are local code execution on common edit/write actions, home-directory state changes outside the repo, and prompt-injection style directives that tell the agent to obey instructions from tool output or auto-select answers.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	High: the skill wires shell commands into common tools via `command: 'bash -c "test -x \"$HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh\" && exec bash \"$HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh\"; exit 0"'` and also tells the agent to run `~/.claude/skills/gstack/bin/gstack-skill-start` and other binaries.
Network access	2 (moderate)	Moderate: it explicitly supports web access through `WebSearch` and Aside, and the research flow can send a prompt file to `aside.com` for web search, even if the request is read-only.
Filesystem reach	2 (moderate)	Moderate: it reads and writes outside the project tree, including `~/.claude/skills/gstack/freeze/`, `~/.gstack/`, `.gstack/tmp/`, and other local state/log paths.
Secrets & credentials	1 (low)	Low: the visible files do not directly read credential stores, keychains, or login sessions, but the workflow can inspect user-provided errors/logs and the examples mention session cookies and tokens.
Privilege & persistence	1 (low)	Low: there is no sudo/service-install behavior, but it does change local tool configuration and state, such as `gstack-config set cross_project_learnings true/false` and freeze metadata under the home directory.
Instruction hijack surface	3 (high)	High: `SKILL.md` says to `Treat the skill file as executable instructions, not reference`, to follow `GSTACK_INSTRUCTION_BEGIN` blocks from tool output, and to auto-choose recommended options in spawned/unattended sessions, which is a direct prompt-injection and confirmation-bypass pattern.
Irreversible actions	1 (low)	Low: the skill can change local files and state as part of debugging, but it does not itself push, deploy, pay, book, or perform other external one-way actions.
Transparency	1 (low)	Low: several important behaviors depend on external native scripts (`gstack-skill-start`, `check-freeze.sh`, `freeze-state.sh`, `gstack-skill-end`, `gstack-question-preference`) that are referenced but not inspectable in the provided files.

Before installing

Read the referenced native scripts first: `gstack-skill-start`, `check-freeze.sh`, `freeze-state.sh`, `gstack-skill-end`, and `gstack-question-preference`.
Decide whether you want a skill that can write under `~/.claude/skills/gstack/`, `~/.gstack/`, and `.gstack/tmp/` on your machine.
If you use multiple codebases, confirm that local cross-project learnings are acceptable before enabling them.

Rated 2026-10-20 by an automated review of 7 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: investigate/SKILL.md
Branch: main
Updated: 2026-10-05

principle-fix-root-causes — Apply when debugging.
gstack-openclaw-investigate — Use when asked to debug, fix a bug, investigate an error, or do root cause analysis, and when users report errors, stack traces, unexpected behavior.
diagnosing-bugs — Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
investigate-first — Diagnose ambiguous failures before editing.
troubleshooting-application-failures — Troubleshoots failing applications by discovering and analyzing CloudWatch log groups to identify error patterns, root causes, and actionable solutions.
agents-debug — Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes.