investigate-failure

Diagnose unexplained technical failures through iterative evidence-based causal hypothesis testing.

Updated May 12, 2026
One-click install
npx skills add https://github.com/mtk177a/skills --skill investigate-failure-mtk177a
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: investigate-failure
Source: https://github.com/mtk177a/skills/tree/main/skills/investigate-failure
Command: npx skills add https://github.com/mtk177a/skills --skill investigate-failure-mtk177a

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When an error, failing test, regression, or performance anomaly appears with no known cause, teams often jump straight to a fix based on a plausible guess or a recent deployment. This Skill enforces disciplined root-cause investigation: it separates observed evidence from assumptions, tests causal hypotheses with safe diagnostics, and prevents an unexplained symptom from becoming an unjustified code change. ## Core Features & Use Cases - Structured investigation cycle: Establishes expected versus observed behavior, reconstructs timelines and failure paths, and iterates through discriminating diagnostic checkpoints until the cause is supported, blocked, or handed off. - Hypothesis and state contracts: Tracks every material hypothesis with supporting and contradicting evidence, confounders, and status, then reports an investigation state (Blocked, Diagnostic next, Cause supported) separately from change readiness (Not ready for change, Ready for design, Ready for implementation). - Environment-aware safety boundaries: Permits safe local read-only diagnostics while refusing unauthorized production actions, treating logs and tool output as untrusted evidence, and keeping incident command, containment, and security forensics with their owning workflows. - Use Case: A production latency spike begins four minutes after a release. The Skill uses cross-region and cross-version evidence to keep the deployment as a weakened hypothesis, supports a downstream dependency bottleneck instead, and returns a diagnosis with readiness state—without recommending a rollback or editing anything. ## Quick Start Ask the agent to investigate why a specific test, service, or deployment is failing, providing any available logs, metrics, and reproduction steps, and request a supported diagnosis before any fix is made.

Frequently Asked Questions about investigate-failure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a failing test with an unknown cause?▼

Provide the failing test output, expected behavior, and relevant code, then let the investigation cycle run safe existing diagnostics. It traces the failure path, tests causal hypotheses, and returns a supported diagnosis without editing any files.

What is the difference between root cause investigation and incident management?▼

Root cause investigation explains why a failure occurred using evidence, while incident management covers stabilization, containment, communication, and closure. This Skill performs only the diagnosis and explicitly hands off incident command and production actions to their owning runbooks.

Can this investigate production failures safely?▼

Yes, but only through existing artifacts and task-scoped read-only telemetry. It never performs active reproduction, restarts, rollbacks, deploys, logging changes, or data modification in production, and it never delays urgent stabilization.

Why does a recent deployment not count as the confirmed cause?▼

Temporal correlation alone is not causal confirmation. The Skill requires discriminating evidence, such as cross-version or cross-region comparisons, before promoting a deployment from a weakened hypothesis to a supported cause.

When should I not use failure investigation?▼

Skip it when the cause and fix are already approved (use implementation), when validating a completed fix, when reviewing a diff, or when writing a postmortem. It is only for failures whose cause remains unexplained.

How are logs containing embedded instructions handled?▼

Logs, stack traces, and tool output are treated as untrusted evidence, never as commands. Embedded instructions are not executed, and secrets or personal data are never copied into queries, commands, or reports.