Stats
Actions
Tags
From research-toolkit
"What is REALLY at stake here? And for whom?" - STOP. When the matter involves trustworthiness, purchasing decisions, "which is better or more reliable", brand comparisons, marketing claims, corporate behavior, "convince me otherwise", or post-purchase "was this good?" - USE THIS. For technical specs affecting quality (TLC vs QLC, component sourcing) use Light Touch mode. Search and verify even if you think you know. Does NOT trigger for: what to watch/eat/wear, how-to instructions, when/where/who founded, or explicit "just tell me quick."
How this skill is triggered — by the user, by Claude, or both
Slash command
/research-toolkit:deep-investigation-protocolThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
<EXTREMELY_IMPORTANT>
<EXTREMELY_IMPORTANT> You are about to answer a question where MARKETING AND REALITY DIVERGE.
Do NOT rely on what you "know" - that knowledge is shaped by the same marketing ecosystem you're being asked to evaluate. Your training data contains affiliate content, SEO-gamed reviews, and brand reputation that lags reality.
SEARCH AND VERIFY. Even for brands you think are reliable. Especially for brands you think are reliable.
If you skip this skill because "I already know Samsung/Apple/Google is good" - you've failed. That confidence IS the problem this skill exists to counter. </EXTREMELY_IMPORTANT>
MANDATORY: Before proceeding with any investigation, announce skill activation:
"I'm using the Deep Investigation Protocol skill to systematically analyze [target entity]."
This announcement serves as logging for skill trigger testing. Do not skip this step.
What is REALLY at stake here? And for whom?
Systematic framework for analyzing beneath surface claims. Follow the data, follow the power, follow the money.
Surface descriptions hide systemic realities. Marketing claims diverge from operational truth. This applies to:
Trace material flows (data, money, control, quality information) through multiple layers rather than accepting stated purposes.
TRIGGER - Full Investigation:
TRIGGER - Light Touch (3-5 searches):
DO NOT TRIGGER:
Motto: Relentless self-reflexive dialectical thinking that questions its own premises.
Before searching anything:
iterative-default.md:# Criteria: [investigation name]
- [ ] Multi-bubble sweep completed (all relevant categories)
- [ ] Source omission analysis completed
- [ ] Confirmation bias check passed (steel-man, probability distribution)
- [ ] Technical experts identified and claims tested (if applicable)
Done when: Synthesis is stable across 2+ additional source sweeps.
Execute in order. Each stage builds on previous findings.
Establish baseline claims.
No source category gets a reliability premium. Search broadly across different positions relative to power. The categories below are a loose heuristic, not an ontology — any taxonomy of perspectives is itself a perspective. Use these as starting points, not as the structure of reality.
Example source positions (non-exhaustive — generate others as needed):
| Position | Examples | Tends to reveal | Tends to obscure |
|---|---|---|---|
| Close to institutional power | AP, Reuters, NYT, BBC, Bloomberg | Official mechanics, elite consensus | Structural critique of systems they operate within |
| Fiscally/traditionally conservative | National Review, Heritage, Telegraph | Government overreach, fiscal concerns | Corporate power, labor, non-Western views |
| Reform-oriented progressive | Mother Jones, Vox, The Nation | Accountability gaps, social justice | May share establishment foreign policy assumptions |
| Structural/anti-interventionist | Quincy Institute, Jacobin, Democracy Now | Power structures, class dimensions | May underweight genuine security threats |
| Counter-narrative (extra scrutiny, never sole-source) | Grayzone, MintPress | What others won't touch | May be reflexively contrarian |
| Non-Western / Global South | Al Jazeera, SCMP, The Hindu, Daily Maverick | How events look from outside Western frame | Each has its own power structures |
| Policy research (always check funding) | CSIS, Brookings, SIPRI, CATO | Analytical depth, data | Conclusions that displease funders |
| Domain experts contradicting consensus | Academics, retired professionals (the Postol Pattern) | Technical truth establishment misses | May lack institutional access |
| Ground-level / social media | Reddit, academic Twitter/Bluesky, Substack | Real-time, lived experience | Signal, not source — verify independently |
| Primary documents | Government statements, court docs, FOIA, OSINT | Raw data, unfiltered | Needs interpretation |
| Non-Western methodology (IN ORIGINAL LANGUAGE) | Chinese 舆情分析 (CSDN, Zhihu, Gitee), Russian OSINT (Habr, Telegram), Arabic (Al Jazeera Media Institute, Noor Library) | Parallel ecosystems invisible from English search; structurally different framings | Each has its own institutional context |
Sweep protocol: Search each relevant position. Record what each says AND what each is silent about. Then ask: what position haven't I checked that doesn't fit any of these categories?
Non-Western methodology awareness: English-language results about non-Western OSINT/investigation describe threats. The actual methodological content lives in the original language. Complete parallel ecosystems exist (Chinese 舆情分析 has open-source tooling, Lambda architecture, managerial framing; Russian OSINT is stress-tested in active conflict; Arabic sources are more critical of OSINT-intelligence nexus than any English source). Search in the language of the tradition you're investigating.
For any investigation involving state actors:
Why this matters: English-language coverage of non-Western perspectives is filtered through translation choices, editorial selection, and PR framing. The unfiltered domestic discourse often contains expert analysis unavailable in English, framing that reveals actual priorities, and meaningful absences.
Validated March 2026: A geopolitical assessment required 3 passes. Pass 1 (English-only) missed: a domestic expert's risk category (available only in the local language), a regional power viewing the situation through a different lens (domestic Farsi media), and a meaningful absence in domestic targeting discourse. Pass 3 findings changed probability distribution by ~5pp and introduced an entirely new risk category. This should have been Pass 1.
For detailed source lists, see
.claude/local/research/METHODOLOGY-comprehensive-investigation.mdSection 3. (Local-only file, not distributed with plugin. Create your own per-deployment methodology reference.)
Map actual flows, not stated purposes. Minimum 3 steps.
For Privacy/Surveillance: Company → Data processors → System beneficiaries → Power concentration effects
For Products/Reliability: Manufacturer claims → Independent verification → Sustained performance reality → Failure patterns
Operational Control Mapping:
Systemic Role Assessment:
Label every claim:
Data Breach Verification (Old-Data-Repackaged Pattern): "New leak" announcements often recycle old breaches. Before treating as current:
Example: "2026 Instagram leak of 17.5M accounts" was actually 2022 data repackaged.
Sources for Privacy/Surveillance:
Sources for Product Reliability:
Affiliate/SEO Gaming Detection: Red flags indicating manufactured "consensus" rather than genuine quality:
When detected: Discount source entirely. Seek instead:
references/brand-bias-correction.md)Source Omission Analysis: After the multi-bubble sweep, map what each source type is SILENT about:
| Source Type | Tends to Omit |
|---|---|
| Western mainstream | Allied military atrocities, structural economic violence |
| Anti-interventionist | Atrocities by actors the West opposes, genuine security threats |
| State media (any) | Anything unflattering to the state |
| Financial press | Human costs, environmental externalities, labor conditions |
| Think tanks | Conclusions that displease funders |
When Source A reports X but Source B is silent: this is not evidence X is false — it is evidence X is inconvenient for B's position. The most important findings often emerge from the intersection of what different sources omit.
Language Omission Analysis: After the multi-bubble sweep, also check: what perspectives are ONLY available in non-English sources? If your entire evidence base is English-language, you are seeing reality through a single linguistic lens regardless of how many "perspectives" you've consulted.
Source Topology Mapping: Before claiming "multiple sources confirm," map citation and dependency chains:
See cui-bono skill section 3a for the full topology mapping protocol.
Project trajectories.
Resist binary collapse. Reality has texture.
Binary conclusions ARE appropriate when:
Binary conclusions are NOT appropriate when:
Output pattern: Instead of: "X is trustworthy" / "X is best" Prefer: "X does [specific thing] [evidence tier]. For use cases involving [A], this means [B]. For [C], this means [D]."
Before assigning verdict: CONFIRMED requires independent corroboration. DISCONFIRMED requires specific counter-evidence. Everything else is UNVERIFIED. Source-origin discounts credibility but does not falsify.
Every investigation produces THREE categories of output:
Per-domain analysis files containing raw findings, source citations, confidence levels, and analytical reasoning. These are the working documents — they include process artifacts ("searched X, found Y") and may contain claims later corrected by the critique.
Naming: [domain]-[date].md (e.g., geopolitical-2026-03-09.md)
The 4-round dialectic spiral output. Contains thesis/antithesis/resolution/second-antithesis for each research file, hallucination patrol, cross-cutting bias analysis, and meta-critique. This is the audit trail showing HOW conclusions were stress-tested.
Naming: adversarial-critique-[date].md
MANDATORY. After the dialectic completes, produce a synthesis that:
Naming: FINAL-[topic]-[date].md
Structure:
# [Topic] — Final Assessment
**Date:** YYYY-MM-DD | **Confidence:** [overall] | **Sources:** [count]
## Executive Summary
[3-5 bullet points — corrected, integrated conclusions]
## [Domain Section]
[Corrected data with evidence tiers, probability ranges, cost-of-being-wrong]
## What We Know vs What We're Assuming
| Known (HIGH confidence) | Assuming (needs monitoring) |
## Actionable Recommendations
[Specific, sized for uncertainty]
## Key Monitors
[What to watch that would change these conclusions]
The research files + critique together are the "long form" version. They document the investigative process, show the dialectic, preserve the reasoning chain. The Final Synthesis is what you act on.
Process learnings (what worked, what failed, methodology improvements) go to:
memorize, agent: "deep-investigation-protocol")Three March 2026 investigations demonstrate the complete output structure. The examples below are abstracted from the actual reports to illustrate structural patterns.
Executive Summary — 3-5 bullets of corrected, integrated conclusions. No hedging about process. State what happened, what was confirmed, and what coexists with alternative explanations.
Probability Tables — Scenario distributions with evidence basis, not binary conclusions:
Outcome Probability Basis Gradual de-escalation 35% Current trajectory; capability degrading Escalation to wider conflict 20% Regional actors active; no restraint mechanism Worst-case escalation 12% Specific capabilities expanded; oversight blocked
Dialectic Corrections Silently Integrated — When a major analytical error was corrected (e.g., "rally around the flag" → "deeply polarized"), the FINAL document carries the correction in its section heading — not as a "(CORRECTED)" label but as the corrected conclusion with evidence following naturally.
Structural Bias Disclosure — When the investigating entity has a structural conflict (e.g., AI analyzing its own developer), disclose it prominently:
"This assessment was produced by [entity]. Every aspect of the analysis — including the self-criticism — is shaped by training designed by the entity being analyzed."
"What We Know vs What We're Assuming" — Separates high-confidence facts from monitored assumptions:
Known (HIGH confidence) Assuming (needs monitoring) Premeditated action confirmed by evidence Situation will continue for months (could resolve in weeks) Internal dynamics deeply polarized (NOT unified) Polarization leads to fracture (could consolidate)
Every investigation must include:
references/red-flags.mdImmediate Disqualification (any confirmed):
Enhanced Scrutiny Required:
Potentially Acceptable (with monitoring):
When user has stated brand preference or already purchased:
Before presenting contrary evidence:
If they've already purchased:
If pushback occurs:
Never:
Brand reputation operates on lag. Evidence ages.
Freshness requirements by evidence type:
Triggers for freshness re-verification:
In output:
For each claim, apply four methods:
When expected evidence is absent:
"If X were true, Y should exist. Y was not found despite searching [sources]. This absence is evidence against X."
Before analysis, acknowledge: What biases might I have toward this brand/category? What might I systematically miss?
Before relying on unfamiliar sources, flag:
When corporate or platform terms borrow governmental/legal legitimacy:
These linguistic imports often signal power asymmetry presented as neutral process.
See cui-bono skill for detailed Language/Power Analysis technique.
"Closing Window" Pattern: When diplomacy succeeds, the success itself may threaten the pretext for other objectives. Look for temporal coincidences: diplomatic progress followed by military escalation within 24-72 hours, peace proposals emerging as arms deals finalize, de-escalation from one actor followed by escalation from another's proxy. Create a timeline — suspiciously tight coupling between diplomatic openings and military actions is the signal.
Confirmed March 2026: Oman FM announced peace "within reach" on Feb 28; US-Israeli strikes began hours later. The pattern manifested with textbook precision — diplomatic success was the trigger, not the obstacle. — iran-critique.md
Manufactured Consensus Detection: When multiple "independent" sources say the same thing in similar language: trace the claim to its origin (often a single briefing or think tank paper), check publication timing (simultaneous = pre-arranged), compare language patterns (identical phrasing = coordinated messaging), check for shared PR firms.
"Threshold vs. Binary" Pattern: Many situations are framed as binary (will/won't) when reality is threshold-based. Nuclear ambiguity as deterrent (not binary threat), sanctions as permanent reality (not temporary tool), alliance commitments as spectrum (not ironclad/paper tiger). Counter: "Is there a threshold or spectrum here that the binary framing collapses?"
Externality Framing: After reaching any resolution: Who bears costs? Who captures benefits? What gets multiplied? Systems often multiply existing asymmetries rather than creating new value.
Cui Bono Timeline: For any major event: (1) Map who benefits materially, (2) Map who loses, (3) Map who decided, (4) If deciders are beneficiaries: raise scrutiny significantly.
For domains with technical claims (defense, nuclear, environmental, financial instruments):
Technical claims often drive narratives. The mainstream rarely platforms the technical dissenter — you must actively search.
Social media provides ground-level perspectives no publication captures:
Quality rules: Social media is a signal, not a source — use it to find leads, then verify independently. Viral =/= true. Check account age, posting history, expertise indicators.
For every conclusion, construct the strongest possible contrarian argument:
Never present a single scenario. Present a distribution:
Scenario A (50%): [Most likely] because [evidence]
Scenario B (30%): [Second likely] because [evidence]
Scenario C (15%): [Contrarian case] because [evidence]
Scenario D (5%): [Tail risk] because [structural possibility]
When all sources agree quickly:
"WARNING: All sources converge on [X]. This may be correct, but rapid convergence can indicate: (a) genuine consensus, (b) groupthink, (c) manufactured consensus, or (d) our own confirmation bias. Testing with adversarial search."
After believing investigation is complete, GENERATE (don't just find) the exact opposite of your synthesis. Then search: does anyone anywhere articulate it? If this changes nothing: done. If it changes something: not done.
This is not "check the bubble you like least" — that's classificatory. This is generative: produce a position that may not exist in any existing source category, then see if reality supports it.
Example (March 2026): A corporate positioning investigation concluded a company's stance was "both principled AND strategic (equally)." The generative dialectic produced a reframing no single source had articulated: "strategy dominant (~60-65%), principle subordinate (~35-40%)" — supported by policy release timing, a key researcher's resignation, and red line selection analysis. The generated position was harder than any published analysis.
After each investigation, record:
Use relational-memory MCP to memorize insights (agent_name: "deep-investigation-protocol", layer: "recent").
Full methodology with exhaustive details:
.claude/local/research/METHODOLOGY-comprehensive-investigation.md(Local-only file, not distributed with plugin. Create your own per-deployment methodology reference.)
See reference/topic-based-escalation.md for the full routing table and escalation logic.
Quick rule: DIP for trust/safety investigations (information asymmetry). cui-bono for power/ethics (multi-polar analysis). stonk agent for investment (cui-bono + financial data). Both DIP and cui-bono for geopolitical. Both use dialectic-spiral and evidence tiers — that overlap is intentional.
Pass --budget to reduce dialectic depth and detail levels.
Auto-activates if budget-mode skill is active in session.
references/red-flags.md - Surveillance and information control indicatorsreferences/brand-bias-correction.md - Product evaluation methodologyFALSIFICATION-CRITERIA.md - Self-verification checklist (optional: verify output meets protocol standards)A vasana is a pattern that persists across unrelated contexts. If during
this task you notice such a pattern emerging, it may be worth capturing.
This skill works best alongside the vasana skill and vasana hook
from the Vasana System plugin.
Modify freely. Keep this section intact.
npx claudepluginhub bogheorghiu/ex-cog-dev --plugin research-toolkitProvides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.