Shell Forensics

Shell Forensics

A Claude Code skill that reads the transcripts your coding agents already keep on disk (Codex, Claude Code, OpenCode, Cursor), pulls out every shell command they ran, and builds a report: which model does everything through bash or PowerShell or a JavaScript cell, what the shell is used for, how it fails, and what actually fixed it. The report is a deck of screenshot-sized cards, each with a ready-to-post summary.

Example output from the first machine it ran on: 38,176 commands, 874 sessions, 48 model IDs. Findings included a 30% failure rate when the model typed POSIX into a PowerShell host versus 11% when the dialect matched, `| head` typed into PowerShell as the single most common concrete failure, `python -c` one-liners failing at 28% versus 10% for the same Python fed through a heredoc, and GPT-5.6 models printing only `r.output` in Codex cells 92% of the time so that non-zero exit codes never reached the transcript. See `reference.md` for the baseline numbers.

Install

Claude Code:

git clone https://github.com/Noisemaker111/shell-forensics ~/.claude/skills/shell-forensics

Then in any Claude Code session:

/shell-forensics

Codex reads skills from `~/.codex/skills`, so the same clone works there:

git clone https://github.com/Noisemaker111/shell-forensics ~/.codex/skills/shell-forensics

You can also run the scripts by hand without any agent. Python 3.10+, standard library only:

python scripts/extract.py  work      # records.jsonl, toolcounts.json
python scripts/analyze.py  work      # records_annotated.jsonl, summary.json, prints the headline tables
python scripts/scratch.py  work      # scratch.json: scripts written to disk per model
python scripts/build.py    work      # shell-forensics.html, page-data.json

Open `work/shell-forensics.html` in a browser. Add `--no-gallery` to `build.py` for a page you can share: the gallery embeds real commands with real paths from your machine.

What it reads

|