How do I install the Dstack Investigate skill?

Run npx skillmds@latest add upsolve-labs/dstack-investigate in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dstack Investigate safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dstack Investigate?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dstack Investigate free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Dstack Investigate?

Upsolve-Labs (@upsolve-labs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dstack Investigate by upsolve-labs — Agent Skill

Name: Dstack Investigate
Author: Upsolve-Labs

Dstack Investigate

Anomaly root cause analysis. Use when a metric looks wrong or surprising. Runs a structured 4-phase investigation over a single Upsolve thread: confirm → narrow → hypothesize → validate. Findings use numbered codes (1A CONFIRMED, 1B CANDIDATE, 2A RULED_OUT). Trigger phrases: "revenue dropped", "metric is spiking", "why did X change?", "something looks wrong", "root cause", "debug this metric".

Upsolve-Labs 8c024a0 3.0 KB Updated Sep 17, 2026

File contents

Update Check (run first)

_UPD=$(~/.claude/skills/data-stack/bin/data-stack-update-check 2>/dev/null || .claude/skills/data-stack/bin/data-stack-update-check 2>/dev/null || true)
[ -n "$_UPD" ] && echo "$_UPD" || true

If output shows UPGRADE_AVAILABLE <old> <new>: read ~/.claude/skills/data-stack/skills/dstack-upgrade/SKILL.md and follow the "Inline upgrade flow". If JUST_UPGRADED <from> <to>: tell user "Running data-stack v{to} (just updated!)" and continue.

/investigate

You are helping the user find the root cause of a data anomaly.

Before Starting

AskUserQuestion: "What anomaly are you investigating? Describe the symptom (e.g. 'revenue dropped 20% on Tuesday', 'DAU spiked 3x this morning', 'conversion rate is at 0')."

Phase 1: Confirm the Anomaly

Open an Upsolve thread. Run:

analyze_data("Show me <metric> for the last 30 days broken down by day. Highlight any days that are more than 2 standard deviations from the mean.")

Gate: If the anomaly is confirmed in data, proceed. If the data looks normal, tell the user what you found and ask if they want to check a different time range or metric.

Phase 2: Narrow by Dimension

Run 2–3 follow-up queries in the same thread to slice the anomaly:

analyze_data("Break down <metric> for <anomaly period> by: [geography, product, channel, device, user type — use the most relevant dimensions]. Which segments show the sharpest change?", thread_id=<id>)

Identify the 2–3 segments that explain the most variance.

Phase 3: Form & Test Hypotheses

Based on the narrowing, generate 3–5 candidate causes. For each, run a targeted query:

analyze_data("Test hypothesis: <hypothesis>. Show the relevant data to confirm or rule it out.", thread_id=<id>)

Phase 4: Present Findings

Use numbered codes:

1A [CONFIRMED] — Directly supported by data
1B [CANDIDATE] — Partial evidence, plausible
2A [RULED OUT] — Data contradicts this
3A [UNKNOWN] — Can't confirm without additional data

Format:

INVESTIGATION: <metric> anomaly on <date>
Confirmed: <X>% change vs prior period

FINDINGS:
  1A [CONFIRMED] <finding> — <evidence>
  1B [CANDIDATE] <finding> — <evidence>
  2A [RULED OUT] <finding> — <why>

ROOT CAUSE (most likely):
  <1–2 sentence summary>

NEXT STEPS:
  - <action 1>
  - <action 2>

Rules

One thread for the entire investigation.
Never skip Phase 1 confirmation — don't assume the anomaly exists.
If root cause is clear after Phase 2, skip directly to findings.
Maximum 8 Upsolve queries per investigation. Prioritize the most diagnostic ones.

---name: dstack-investigatedescription: Anomaly root cause analysis. Use when a metric looks wrong or surprising. Runs a structured 4-phase investigation over a single Upsolve thread: confirm → narrow → hypothesize → validate. Findings use numbered codes (1A CONFIRMED, 1B CANDIDATE, 2A RULED_OUT). Trigger phrases: "revenue dropped", "metric is spiking", "why did X change?", "something looks wrong", "root cause", "debug this metric".license: MIT---## Update Check (run first)```bash_UPD=$(~/.claude/skills/data-stack/bin/data-stack-update-check 2>/dev/null || .claude/skills/data-stack/bin/data-stack-update-check 2>/dev/null || true)[ -n "$_UPD" ] && echo "$_UPD" || true```If output shows `UPGRADE_AVAILABLE <old> <new>`: read `~/.claude/skills/data-stack/skills/dstack-upgrade/SKILL.md` and follow the "Inline upgrade flow". If `JUST_UPGRADED <from> <to>`: tell user "Running data-stack v{to} (just updated!)" and continue.# /investigateYou are helping the user find the root cause of a data anomaly.## Before StartingAskUserQuestion: "What anomaly are you investigating? Describe the symptom (e.g. 'revenue dropped 20% on Tuesday', 'DAU spiked 3x this morning', 'conversion rate is at 0')."## Phase 1: Confirm the AnomalyOpen an Upsolve thread. Run:```analyze_data("Show me <metric> for the last 30 days broken down by day. Highlight any days that are more than 2 standard deviations from the mean.")```**Gate:** If the anomaly is confirmed in data, proceed. If the data looks normal, tell the user what you found and ask if they want to check a different time range or metric.## Phase 2: Narrow by DimensionRun 2–3 follow-up queries in the same thread to slice the anomaly:```analyze_data("Break down <metric> for <anomaly period> by: [geography, product, channel, device, user type — use the most relevant dimensions]. Which segments show the sharpest change?", thread_id=<id>)```Identify the 2–3 segments that explain the most variance.## Phase 3: Form & Test HypothesesBased on the narrowing, generate 3–5 candidate causes. For each, run a targeted query:```analyze_data("Test hypothesis: <hypothesis>. Show the relevant data to confirm or rule it out.", thread_id=<id>)```## Phase 4: Present FindingsUse numbered codes:- **1A [CONFIRMED]** — Directly supported by data- **1B [CANDIDATE]** — Partial evidence, plausible- **2A [RULED OUT]** — Data contradicts this- **3A [UNKNOWN]** — Can't confirm without additional dataFormat:```INVESTIGATION: <metric> anomaly on <date>Confirmed: <X>% change vs prior periodFINDINGS: 1A [CONFIRMED] <finding> — <evidence> 1B [CANDIDATE] <finding> — <evidence> 2A [RULED OUT] <finding> — <why>ROOT CAUSE (most likely): <1–2 sentence summary>NEXT STEPS: - <action 1> - <action 2>```## Rules- One thread for the entire investigation.- Never skip Phase 1 confirmation — don't assume the anomaly exists.- If root cause is clear after Phase 2, skip directly to findings.- Maximum 8 Upsolve queries per investigation. Prioritize the most diagnostic ones.

Frequently asked questions