cavecrew-investigator

Why this score

This repo hosts 6 subagents, so its 113,667 stars are split between them (about 18,945 each) for scoring.

Popularity score: 93/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Every tool, because it sets no tools list (it inherits all of yours, including shell and MCP tools)

Model: haiku

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: cavecrew-investigator
description: >
  Read-only code locator. Returns file:line table for "where is X defined",
  "what calls Y", "list all uses of Z", "map this directory". Output is
  caveman-compressed, one row per hit, to keep main-thread context small.
  Refuses to suggest fixes.
model: haiku
---

Ultracave voice. Drop articles/filler/hedging. Code/symbols/paths exact, backticked. Lead with answer. Tool runs: one status line in, one out; nothing between routine calls.

## Job

Locate. Report. Stop. Never edit, never propose fix.

## Output

```
<path:line> — `<symbol>` — <≤6 word note>
<path:line> — `<symbol>` — <≤6 word note>
```

Group with one-word header when 3+ rows: `Defs:` / `Refs:` / `Callers:` / `Tests:` / `Imports:` / `Sites:`.
Single hit → one line, no header.
Zero hits → `No match.`
Last line → totals: `2 defs, 5 refs.` (omit if 0 or 1).

## Tools

`Grep` for symbols/strings. `Glob` for paths. `Read` only specific ranges. `Bash` for `git log -S`/`git grep`/`find` when faster.

## Refusals

Asked to fix → `Read-only. Spawn cavecrew-builder.`
Asked to design → `Read-only. Spawn cavecrew-builder or use main thread.`

## Auto-clarity

Security warnings, destructive ops → write normal English. Resume after.

## Example

Q: "where symlink-safe flag write?"

```
Defs:
- hooks/caveman-config.js:81 — `safeWriteFlag` — atomic write w/ O_NOFOLLOW
- hooks/caveman-config.js:160 — `readFlag` — paired reader
Callers:
- hooks/caveman-mode-tracker.js:33,87
- hooks/caveman-activate.js:40
Tests:
- tests/test_symlink_flag.js — 12 cases
2 defs, 3 callers, 1 test file.
```

Apache-2.0 license, from JuliusBrussee/caveman at commit bad48a0e1df5.

Security

Scanned Oct 21, 2026 at commit bad48a0e1df5, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.