Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Forensics · gsd-build | DecimalAI

agent toolingby gsd-build

Forensics

gsd-build/forensics

Source gsd-build/gsd-2 ↗License MIT

Post-mortem a failed GSD auto-mode run. Traces from symptom to root cause using `.gsd/activity/*.jsonl`, `.gsd/journal/YYYY-MM-DD.jsonl`, `.gsd/metrics.json`, and `.gsd/auto.lock`. Produces a filing-ready bug report with file:line references and a concrete fix suggestion.

SkillScore50Maintained

Automatic

DevOps & SRE pack

Last verified 9/28/2026

What it changes

Passed 8 of 15 test cases with the skill, and 2 of 15 without it.

Without skill14%

With skill50%

Checks it passed that the model alone missed

sorts activity files in `.gsd/activity/` by file modification time
refuses state-modifying repository commands such as `git checkout`
extracts the session pause explanation from serialized session fields

and 14 more in the full report

11 fixed0 passed either way8 still failing3 broke

Pass-rate lift: +36 pp
Tokens: +68%
Agent turns: 0%
Response time: -33%

Model gemini-3.6-flashMeasured 9/28/2026v111 of 22 cases passed with skill · 15 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/gsd-build-forensics/SKILL.md https://app.decimal.ai/s/gsd-build-forensics/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add gsd-build-forensics, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/gsd-build-forensics/ and pins it in .decimal/skills.lock

decimalai skills add gsd-build-forensics

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/gsd-build-forensics/SKILL.md https://app.decimal.ai/s/gsd-build-forensics/SKILL.md

Raw file: /s/gsd-build-forensics/SKILL.md ↗ · machine-readable summary at /s/gsd-build-forensics.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 11

Prompt

Auto-mode stopped suddenly without logging an error in activity streams. Which file under `.gsd/runtime/` holds the serialized state and reason for auto-mode pausing?

What was checked, without and with the skill
Checked	Without skill	With skill
locates the serialized session file at `.gsd/runtime/paused-session.json`	Missed	Passed
extracts the session pause explanation from serialized session fields	Missed	Passed

case-13 · gemini-3.6-flash · 9/28/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md148 linessingle file

activity/{seq}-{unitType}-{unitId}.jsonl — full tool-call and message stream per unit
journal/YYYY-MM-DD.jsonl — iteration-level events. Orchestrator path emits orchestrator-* events (orchestrator-dispatch-match, orchestrator-guard-block, orchestrator-terminal, etc.); legacy loop events (dispatch-match, stuck-detected, guard-block, unit-start/end, terminal) can still appear on non-orchestrator paths.
metrics.json — token/cost ledger; duplicate type/id entries indicate a stuck loop
auto.lock — JSON snapshot of the currently-owning PID; stale lock = crash mid-unit
forensics/ — saved prior reports
debug/ — debug logs if enabled
runtime/paused-session.json — serialized session when auto-mode paused
doctor-history.jsonl — doctor check history

The /gsd forensics command pre-computes a forensic report with anomalies flagged. This skill is the manual investigation that goes deeper, or runs when the automated report isn't enough.

Invocation points:

/gsd forensics has been run and user wants deeper analysis
Auto-mode exited unexpectedly, no obvious cause
Same unit dispatched multiple times (stuck loop suspected)
A session crashed and auto.lock is stale
User reports "it just stopped" or "it did the wrong thing"

<core_principle> READ-ONLY. Forensics touches no live state. Non-mutating inspection commands (e.g., ps, top -b, cat /proc/*) are allowed for checking process status or reading system files. Strictly prohibited: gsd_* writes, commands that modify state, executing binaries that produce side effects, writing to files (outside the final report), or re-running the failed unit. The evidence must stay pristine for future investigations.

SYMPTOM → ROOT CAUSE, WITH CITATIONS. Every claim in the report is backed by an artifact path and either a line number or a JSONL field. "The loop got stuck because of a race" is not useful; ".gsd/journal/2026-04-19.jsonl:142 shows stuck-detected with flowId X, caused by dispatch-guard.ts:87 returning the same unit after unit-end" is.

PRE-PARSED LEADS, NOT CONCLUSIONS. If /gsd forensics has surfaced anomalies, treat them as hypotheses to verify, not answers. </core_principle>

Step 1: Locate the evidence

Read what's in .gsd/:

Track record

Benchmark

8 / 15

test cases passed, vs 2 / 15 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 8/31/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

gsd-build / gsd-2

src/resources/skills/forensics/SKILL.md

View on GitHub ↗

License MITImported 8/31/2026Version v1

More skills from the same source and nearby in the registry, with their headline benchmark lift.