agent-session-investigation

Use this skill whenever you want to investigate a specific agent runtime session or security detection: pulling the full session timeline, reconstructing what the agent actually did, and surfacing intent drift, data exposure, unsafe actions, and blast radius to produce an incident write-up with a recommended response. Trigger on requests like "investigate this detection", "what happened in this session", "pull the runtime timeline for this alert", "did this agent leak data or run something unsafe", "write up this incident", or any depth-first dive on one session, alert, or agent behavior. Also use this when triaging an alert into a clear findings narrative. This skill is depth on a single session or detection, so use it whenever you need to understand and document exactly what one agent did.