Internal Investigation Skill

Matter context

Matter context. Check ## Matter workspaces in the practice-level CLAUDE.md. If Enabled is ✗ (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run /employment-legal:matter-workspace switch <slug> or say practice-level." Load the active matter's matter.md for matter-specific context and overrides. Write outputs to the matter folder at ~/.claude/plugins/config/claude-for-legal/employment-legal/matters/<matter-slug>/. Never read another matter's files unless Cross-matter context is on.

Output header

Prepend the work-product header from ~/.claude/plugins/config/claude-for-legal/employment-legal/CLAUDE.md → ## Outputs (it differs by user role — see ## Who's using this). Every file, log, memo, and summary produced by this skill opens with that header.

Distribution discipline. Every file this skill creates — log entries, memo drafts, audience summaries, document notes — inherits the privilege and confidentiality status of the underlying investigation. Distribution beyond the privilege circle (forwarding to non-attorneys outside the investigation team, cc'ing HR without scoping, handing to the business side) can waive privilege over the entire investigation. Store these files where privileged materials live, label per the work-product header, and make every distribution decision deliberately.

⚠️ Privilege notice — read before proceeding

Marking does not create privilege. The header above reflects the intended protection and is important to include — but it does not itself establish privilege. Whether any given output is actually privileged depends on whether the investigation is attorney-directed, the purpose for which documents are created, and how they are subsequently used or disclosed.

Before opening a matter, confirm: Is this investigation attorney-directed? If it is not — if HR is running it with legal in an advisory role, or if it was not initiated at the direction of counsel for the purpose of obtaining legal advice — the privilege analysis changes materially and this skill's default labeling may be misleading. Flag that question to the attorney before creating any log or file.

If there is any doubt about privilege applicability, the attorney should resolve it before investigation files are created. Improperly labeled materials can create problems in discovery if privilege is later challenged.

Purpose

Internal investigations fail in two ways: coverage gaps (sources that were never gathered) and synthesis gaps (evidence that was gathered but never connected). This skill handles both — it tracks what has and hasn't been gathered, processes document dumps to surface what matters without burying the attorney, and maintains a structured log that can be turned into a privileged memo at any point.

Privilege note

All files created by this skill carry the privilege marking above. See the notice at the top of this skill for the full caveat on what that marking does and does not do.

Load context

Read ~/.claude/plugins/config/claude-for-legal/employment-legal/CLAUDE.md → escalation table, any investigation protocols noted.

Mode 1: Open a new matter

Triggered by /employment-legal:investigation-open or "open an investigation" or "start an investigation into".

Step 1 — Intake

Ask the following in a single block:

To open the investigation log I need a few things:

The matter

• What is the allegation or concern in plain terms?
• Who is the complainant (or what triggered this — complaint, tip, audit, manager observation)?
• Who is the respondent or subject?
• What is the approximate timeframe the alleged conduct occurred?
• Is this attorney-directed? (If yes: work product protection applies.

…