Investigate anything

The front door. Everything downstream is faster than the thinking that should precede it, which is why most bad investigations are not collection failures — they are framing failures. You can run forty tools against a name and produce a confident dossier on the wrong person. The work here is deciding what question you are answering, what would count as an answer, and what would prove you wrong.

Core vocabulary

Used across every skill in this repo, defined only here.

• Selector — one identifiable data point: name, handle, email, phone, domain, IP, wallet, hash, plate, IMO, company number.
• Pivot — turning one selector into new selectors (email → breach record → reused handle → forum profile → real name). An investigation is a chain of pivots. Every pivot is also a chance to jump onto a different person.