MCPInstall

investigation-workflow

6-phase investigation workflow for understanding existing systems. Normally executed as a sub-recipe by dev-orchestrator/smart-orchestrator. Supports direct invocation via recipe runner for standalone use.

Installs
248
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/rysweet/amplihack --skill investigation-workflow
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads investigation-workflow automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Investigation Workflow Skill

Relationship to Dev Orchestrator

Normal execution path: This workflow is invoked as a sub-recipe by the dev-orchestrator skill via smart-orchestrator. You do NOT normally need to activate this skill directly.

User request → dev-orchestrator → smart-orchestrator recipe
    → investigation-workflow recipe (this skill's recipe)

Direct invocation is supported as a compatibility path when the dev-orchestrator is unavailable or when explicitly requested. In that case, use the recipe runner (see Execution Instructions below).

Workflow Graph

flowchart TD
    INIT[Initialize Tracking] --> P1

    subgraph P1["Phase 1: Scope Definition"]
        SCOPE[scope-definition<br/>prompt-writer agent] --> AMB{Has ambiguities?}
        AMB -->|yes| CLARIFY[clarify-ambiguities<br/>ambiguity agent]
        AMB -->|no| P1_OUT[Scope defined]
        CLARIFY --> P1_OUT
    end

    subgraph P2["Phase 2: Exploration Strategy"]
        STRAT[exploration-strategy<br/>architect agent] --> PAST[check-past-investigations<br/>patterns agent]
        PAST --> HIST{Historical context needed?}
        HIST -->|yes| ARCH[historical-research<br/>knowledge-archaeologist]
        HIST -->|no| P2_OUT[Strategy ready]
        ARCH --> P2_OUT
    end

    subgraph P3["Phase 3: Parallel Deep Dives"]
        DD1[deep-dive-primary<br/>architect agent]
        DD2[deep-dive-secondary<br/>patterns agent]
        DD3[deep-dive-tertiary<br/>architect agent]
        DD4{Specialist needed?}
        DD4 -->|yes| DDS[deep-dive-specialist<br/>security agent]
        DD1 & DD2 & DD3 --> CONSOL[consolidate-findings<br/>patterns agent]
        DDS --> CONSOL
    end

    subgraph P4["Phase 4: Verification"]
        HYP[formulate-hypotheses<br/>architect agent] --> EXEC[execute-verification<br/>architect agent]
        EXEC --> VAL[validate-verification<br/>reviewer agent]
    end

    subgraph P5["Phase 5: Synthesis"]
        PAT[identify-patterns<br/>patterns agent] --> SYN[synthesis<br/>architect agent]
        SYN --> VSYN[validate-synthesis<br/>reviewer agent]
    end

    subgraph P6["Phase 6: Knowledge Capture"]
        DISC[update-discoveries] --> PATN{New patterns?}
        PATN -->|yes| UPAT[update-patterns]
        PATN -->|no| RPT[create-investigation-report]
        UPAT --> RPT
    end

    P1 --> P2 --> P3 --> P4 --> P5 --> P6

    RPT --> TRANS[transition-guidance<br/>patterns agent]
    TRANS --> EFF[efficiency-report]
    EFF --> FINAL[final-output]

    TRANS --> TDEV{Transition to dev?}
    TDEV -->|yes| DW[Launch default-workflow<br/>recipe via recipe runner]
    TDEV -->|no| DONE[Investigation Complete]

Purpose

This skill provides a systematic 6-phase workflow for investigating and understanding existing systems, codebases, and architectures. Unlike development workflows optimized for implementation, this workflow is optimized for exploration, understanding, and knowledge capture.

It is normally executed as a sub-recipe by the dev-orchestrator via smart-orchestrator, but can also be invoked directly via the recipe runner.

Canonical Sources

  • Executable source (recipe): amplifier-bundle/recipes/investigation-workflow.yaml
  • Reference documentation: .claude/workflow/INVESTIGATION_WORKFLOW.md

The recipe YAML is the authoritative execution definition. The .md file serves as human-readable reference documentation for the workflow phases.

Execution Instructions

Normal path (via dev-orchestrator)

If you reached this skill via dev-orchestrator / smart-orchestrator, the recipe runner is already managing execution. Do not re-invoke the recipe runner. The orchestrator handles the full lifecycle including goal-seeking reflection loops.

Direct invocation (standalone)

If this skill is activated directly (not via dev-orchestrator), you MUST use the recipe runner — do NOT read the .md file and follow phases manually:

amplihack recipe run amplifier-bundle/recipes/investigation-workflow.yaml \
  -c task_description="TASK_DESCRIPTION_HERE" \
  -c repo_path="." \
  --verbose

Do NOT read INVESTIGATION_WORKFLOW.md and follow phases manually. The recipe runner enforces phase ordering, agent deployment, and quality gates that manual execution cannot replicate.

Preferred: Use dev-orchestrator instead

For most tasks, invoke Skill(skill="dev-orchestrator") or use /dev <task> rather than activating this skill directly. The dev-orchestrator adds goal-seeking reflection, workstream decomposition, and adaptive error recovery on top of this workflow.

When to Use This Skill

Investigation Tasks (use this workflow):

  • "Investigate how the authentication system works"
  • "Explain the neo4j memory integration"
  • "Understand why CI is failing consistently"
  • "Analyze the reflection system architecture"
  • "Research what hooks are triggered during session start"

Development Tasks (use default-workflow recipe instead):

  • "Implement OAuth support"
  • "Build a new API endpoint"
  • "Add feature X"
  • "Fix bug Y"

Core Philosophy

Exploration First: Define scope and strategy before diving into code Parallel Deep Dives: Deploy multiple agents simultaneously for efficient information gathering Verification Required: Test understanding through practical application Knowledge Capture: Document findings to prevent repeat investigations

The 6-Phase Investigation Workflow

Phase 1: Scope Definition

Purpose: Define investigation boundaries and success criteria before any exploration.

Tasks:

  • FIRST: Identify explicit user requirements - What specific questions must be answered?
  • Use prompt-writer agent to clarify investigation scope
  • Use ambiguity agent if questions are unclear
  • Define what counts as "understanding achieved"
  • List specific questions that must be answered
  • Set boundaries: What's in scope vs. out of scope
  • Estimate investigation depth needed (surface-level vs. deep dive)

Phase 2: Exploration Strategy

Purpose: Plan which agents to deploy and what to investigate, preventing inefficient random exploration.

Tasks:

  • Use architect agent to design exploration strategy
  • Use patterns agent to check for similar past investigations
  • Identify key areas to explore (code paths, configurations, documentation)
  • Select specialized agents for parallel deployment in Phase 3

Phase 3: Parallel Deep Dives

Purpose: Deploy multiple exploration agents simultaneously to gather information efficiently.

CRITICAL: This phase uses PARALLEL EXECUTION by default.

Phase 4: Verification & Testing

Purpose: Test and validate understanding through practical application.

Phase 5: Synthesis

Purpose: Compile findings into coherent explanation that answers original questions.

Phase 6: Knowledge Capture

Purpose: Create durable documentation so this investigation never needs to be repeated.

  • Store discoveries in memory using store_discovery() from amplihack.memory.discoveries
  • Update .claude/context/PATTERNS.md if reusable patterns found

Transitioning to Development Workflow

After investigation completes, if the task requires implementation, the dev-orchestrator handles the transition automatically via its goal-seeking reflection loop. If running standalone, transition by launching the default-workflow recipe:

amplihack recipe run amplifier-bundle/recipes/default-workflow.yaml \
  -c task_description="Implement findings from investigation..." \
  -c repo_path="."

Integration with Dev Orchestrator

The dev-orchestrator automatically detects investigation tasks using keywords and routes them to this workflow's recipe:

User: "/dev investigate how authentication works"

dev-orchestrator: Classified as Investigation → launching investigation-workflow recipe
→ Recipe runner executes 6-phase investigation workflow
→ Results feed into goal-seeking reflection loop

For hybrid tasks (investigate + implement), the dev-orchestrator decomposes into parallel workstreams: one running investigation-workflow, another running default-workflow.

Key Principles

  • Scope first, explore second - Define boundaries before diving in
  • Parallel exploration is key - Deploy multiple agents simultaneously in Phase 3
  • Verify understanding - Test your hypotheses in Phase 4
  • Capture knowledge - Always store discoveries in memory in Phase 6
  • This workflow optimizes for understanding, not implementation

Related Resources

  • Recipe (executable): amplifier-bundle/recipes/investigation-workflow.yaml
  • Reference docs: .claude/workflow/INVESTIGATION_WORKFLOW.md
  • Dev Orchestrator: .claude/skills/dev-orchestrator/
  • Default Workflow: .claude/skills/default-workflow/
  • Agent Catalog: .claude/agents/amplihack/ directory
  • Pattern Library: .claude/context/PATTERNS.md

FAQ

What does the investigation-workflow skill do?

6-phase investigation workflow for understanding existing systems. Normally executed as a sub-recipe by dev-orchestrator/smart-orchestrator. Supports direct invocation via recipe runner for standalone use.

How do I install investigation-workflow?

Run npx skills add https://github.com/rysweet/amplihack --skill investigation-workflow in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/investigation-workflow/ (personal) or .claude/skills/investigation-workflow/ (project).

Which AI agents can use investigation-workflow?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is investigation-workflow safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains investigation-workflow?

It is published by rysweet in rysweet/amplihack. It has 248 recorded installs.

More from rysweet/amplihack

View all →

cybersecurity-analyst

rysweet/amplihack

Analyzes events through cybersecurity lens using threat modeling, attack surface analysis, defense-in-depth, zero-trust architecture, and risk-based frameworks (CIA triad, STRIDE, MITRE ATT&CK). Provides insights on vulnerabilities, attack vectors, defense strategies, incident response, and security posture. Use when: Security incidents, vulnerability assessments, threat analysis, security architecture, compliance. Evaluates: Confidentiality, integrity, availability, threat actors, attack patterns, controls, residual risk.

Security1.5K installs

lawyer-analyst

rysweet/amplihack

Analyzes events through legal lens using statutory interpretation, case law analysis, legal reasoning, constitutional principles, and multiple legal frameworks (common law, civil law, international law). Provides insights on legal rights, obligations, liabilities, remedies, and compliance requirements. Use when: Legal disputes, contracts, regulations, compliance, rights analysis, liability assessment. Evaluates: Legal obligations, rights, liabilities, remedies, precedent, statutory authority, constitutionality.

Business & Finance688 installs

psychologist-analyst

rysweet/amplihack

Open the skill to read its SKILL.md instructions.

450 installs

mermaid-diagram-generator

rysweet/amplihack

Open the skill to read its SKILL.md instructions.

Docs & Writing428 installs

pptx

rysweet/amplihack

Open the skill to read its SKILL.md instructions.

Docs & Writing419 installs

economist-analyst

rysweet/amplihack

Open the skill to read its SKILL.md instructions.

378 installs

Popular productivity & automation skills

View category →

agent-browser

vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.

OfficialProductivity & Automation1.3M installs

lark-doc

open.feishu.cn

飞书云文档(Docx / Wiki)内容操作:读取、创建、编辑文档,插入或下载图片附件,以及操作思维笔记。用户提供文档 URL/token(包括 doubao.com 的 /docx/、/wiki/)时使用;按 URL 路径/token 而非域名路由;/page/ 是妙搭应用,非飞书云文档。文档内嵌资源按读取参考中的统一规则分流。独立评论操作走 lark-drive;随正文读取评论使用 docs +fetch。表格或 Base 内部数据操作不在本 skill。

lark-base

open.feishu.cn

飞书多维表格(Base)操作:建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、应用模式(BaseApp/AppMode 页面与组件)、Workspace 目录、workflow、角色权限、模板中心(多维表格模板分类/列表/搜索);遇到 Base/多维表格/bitable、BaseApp/AppMode、/base/ 或 /app/ 链接时使用。BaseApp 不走 lark-apps;文件导入/导出转 lark-drive,认证/授权转 lark-shared。

lark-drive

open.feishu.cn

飞书云空间(云盘/云存储):管理 Drive 文件和文件夹,包含上传/下载、创建文件夹、复制/移动/删除、查看元数据、查询权限设置、评论/权限/订阅、标题、版本、飞书文档密级标签(secure labels)和本地文件导入。用户需要整理云盘目录、处理云空间资源 URL/token、判断链接类型/真实 token/标题,或导入 Word/Markdown/Excel/CSV/PPTX/.base 为 docx/sheet/bitable/slides 时使用;doubao.com 云空间 URL/token 也按资源路径和 token 路由,不回退 WebFetch。不负责:文档内容编辑(走 lark-doc)、表格/Base 表内数据操作(走 lark-sheets/lark-base)、知识空间节点/成员管理(走 lark-wiki)、原生 Markdown 文件读写/patch/diff(走 lark-markdown)。

lark-shared

open.feishu.cn

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling notice JSON.

lark-im

open.feishu.cn

飞书即时通讯:收发消息和管理群聊。发送和回复消息、搜索聊天记录、管理群聊成员、上传下载图片和文件、管理表情回复、发送应用内/短信/电话加急、发送和处理交互卡片(Interactive Card)、监听卡片按钮回调(card.action.trigger)。当用户需要发消息、查看或搜索聊天记录、下载聊天中的文件、查看群成员、搜索群、创建群聊或话题群、管理标记数据、管理 Feed 置顶(添加/移除/查询置顶会话)、管理标签数据、处理卡片回调时使用。