Stats
Actions
Available In
Tags
Plugin
skywatch-investigations
Investigation toolkit for AT Protocol network analysis — bundles MCP tools for ClickHouse data access, domain/IP/URL reconnaissance, content similarity detection, and Ozone moderation labelling, alongside skills codifying investigation methodology and agents orchestrating the full workflow.
What's Inside
Agents2
data-analyst
/data-analyst
Use when you need to query ClickHouse for investigation data — rule hit analysis, account activity patterns, content similarity searches, or temporal analysis. Receives a research question, formulates queries, executes via MCP tools, and returns structured findings with the SQL used. Examples: "find all rule hits for this DID", "show posting patterns for these accounts", "find similar content to this text".
investigator
/investigator
Use when conducting AT Protocol network investigations — from initial discovery through final reporting. Takes an investigation brief, coordinates data gathering by delegating ClickHouse work to the data-analyst subagent, performs recon (domain/IP/URL/whois) directly, and produces formatted reports following B-I-N-D-Ts conventions. Examples: "investigate these accounts", "analyze this coordinated network", "produce a cell deep-dive report on these DIDs".
Skills10
accessing-osprey
/accessing-osprey
Understanding the Osprey moderation infrastructure — system architecture, ClickHouse data access, schema reference, and relationship to Ozone labelling. Use when investigating AT Protocol accounts or reviewing rule execution data.
assess-account
/assess-account
Structured account assessment for AT Protocol investigations. Replaces manual account profiling by defining data collection questions, classification schema, and output format. Produces account_type, confidence, signals, and recommendation. Use when profiling an account of interest during Phase 2 (Characterization) or as a standalone quick assessment.
classify-cluster
/classify-cluster
Narrative classification of co-sharing clusters on AT Protocol. Analyses cluster member content, identifies dominant narratives, coordination signals, shared sources, and likely origin. Distinguishes information operations from organic coordination. Use when a co-sharing cluster is identified during Phase 3 (Linkage) or Phase 4 (Amplification), or as a standalone cluster assessment.
conducting-investigations
/conducting-investigations
Six-phase investigation methodology for AT Protocol network analysis — from initial discovery through reporting. Covers tool selection, signal identification, evidence standards, and directory conventions. Use when conducting or planning investigations.
querying-clickhouse
/querying-clickhouse
Query patterns, safety rules, and performance tips for ClickHouse investigation queries against osprey_execution_results. Use when writing or reviewing ClickHouse queries for investigations.
Stats
Version0.23.5
LanguageJavaScript
Stars3
MaintenanceExcellent
LicenseMIT
Last Commit
Added
Available In
Safety Signals
Caution
External network access
Connects to servers outside your machine
Uses power tools
Uses Bash, Write, or Edit tools
Tags
