sherlock

Validate hypotheses against investigation evidence with confidence scoring.

Updated Aug 27, 2026

Search Tags:#validation #evidence #confidence #hypothesis #falsification #cappy

Ready to run

npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill sherlock-thelightarchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sherlock
Source: https://github.com/theLightArchitect/cappy-toolkit/tree/main/skills/sherlock
Command: npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill sherlock-thelightarchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CAPPY investigators need a rigorous way to ensure that a proposed root‑cause hypothesis truly matches the collected evidence, avoiding wasted effort on false leads.

Core Features & Use Cases

Evidence Alignment Check: Scores how well each hypothesis claim is backed by Phase 3 evidence.
Contradiction Detection: Flags temporal, behavioral, data‑type, and architectural conflicts.
Assumption Validation: Identifies and ranks unverified assumptions for Phase 5 focus.
Confidence Adjustment: Calculates confidence delta to guide hypothesis acceptance or revision.
Use Case: During a TAC investigation, run the sherlock skill to automatically validate a hypothesis about an expired X.509 certificate before proceeding to remediation.

Quick Start

Ask CAPPY to validate the current hypothesis against the gathered evidence and report any weak assumptions.

Frequently Asked Questions about sherlock

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate a root cause hypothesis against collected evidence?▼

To validate a root cause hypothesis, you score evidence alignment, detect temporal or behavioral contradictions, and calculate a confidence delta to guide acceptance or revision.

What is falsification first methodology in incident investigation?▼

Falsification first methodology prioritizes actively disproving a root cause hypothesis by testing unverified assumptions against evidence, ensuring accuracy before proceeding to remediation.

How do I detect contradictions in investigation evidence?▼

Detect contradictions in investigation evidence by flagging temporal, behavioral, data type, and architectural conflicts between collected facts and your proposed root cause claims.

Can I use automated hypothesis validation for expired certificate investigations?▼

Yes, you can validate a hypothesis about an expired X.509 certificate by scoring evidence alignment and checking assumptions before proceeding to remediation.

How do I identify unverified assumptions in a root cause analysis?▼

Identify unverified assumptions in root cause analysis by ranking hypothesis claims that lack direct backing from collected evidence, highlighting areas needing further focus.

When should I adjust confidence scores during an investigation?▼

Adjust confidence scores during an investigation after evaluating evidence alignment and detecting contradictions, using the confidence delta to decide whether to accept or revise the hypothesis.