Case memory

Skill yogeshg665/sleuth-fraud-investigator/skills/case-memory

Sleuth - Agent Skills that automate payment fraud investigations, plus a deterministic Python engine as the executable reference. Explainable, deterministic scoring and decisions with tokenized card references and human-review gates.

Install

npx -y skills add yogeshg665/sleuth-fraud-investigator --skill case-memory

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Recalls prior investigations for the same account or tokenized card from collective memory and emits a contextual risk signal when adverse history exists. WHEN: "repeat offender", "prior fraud history", "seen this account before", "recall past cases", "account has chargebacks", "card previously declined", "collective memory".

SKILL.md

2.9 KB, 582 tokens by cl100k_base, as published. Nobody here has run it

Case Memory

Overview

Reads a memory_recall summary injected during enrichment from the collective memory store and converts adverse prior history into a corroborating risk signal. Memory is contextual, not definitive: the signal is never marked critical and never sets a score floor. Recall is exact-match on the pseudonymous account identifier and the tokenized card reference, so it stays deterministic and privacy-preserving.

When to Use

During the detection phase, when collective memory is enabled and the engine has injected a memory_recall summary for the case.

Inputs

Input	Required	Description
`enrichment.memory_recall.total_prior_cases`	no	Count of prior cases for this account or card.
`enrichment.memory_recall.confirmed_fraud_count`	no	Prior cases analysts labeled as fraud.
`enrichment.memory_recall.prior_decline_count`	no	Prior cases that were declined.
`enrichment.memory_recall.prior_escalation_count`	no	Prior cases that were escalated.
`enrichment.memory_recall.matched_on`	no	Which keys matched: account, card, or both.

Process

Return nothing when no recall summary or no prior cases are present.
If there is confirmed-fraud history, emit a high-severity signal.
Otherwise, if there are prior declines, emit a moderate signal.
Otherwise, if there are prior escalations, emit a low-moderate signal.
Attach the matched keys and counts as evidence.

Outputs

Zero or one RiskSignal named adverse_history. The signal is never critical.

Reference Implementation

src/fraud_investigator/skills/case_memory.py. The store and recall logic live in src/fraud_investigator/memory/.

Rationalizations

Excuse	Rebuttal
"Past fraud proves this transaction is fraud."	History is corroborating context only; it informs, it does not decide.
"Store the raw card number to match better."	Only tokenized card references and pseudonymous accounts are ever persisted.
"Let memory override the score."	Memory contributes a weighted signal; it never floors or overrides the score.

Red Flags

The skill marks the memory signal as critical.
Raw cardholder data is written to the store.
Recall is non-deterministic or depends on wall-clock time.

Verification

With no prior history, the skill returns no signal.
With a confirmed-fraud prior case on the same account, the skill emits an adverse_history signal with elevated severity and the matched keys as evidence.

Gives 0 of the 12 instructions most memory context skills give in 582 tokens

Counted across 674 of the 847 authors here whose files we hold, read 2026-08-06

inform the user when setup is completein 21 of 674, across 6 files
confirm the draft with the user before writingin 21 of 674, across 6 files
update the agent skills block in place if it existsin 21 of 674, across 6 files
present findings to the userin 20 of 674, across 5 files
write the three docs files from seed templatesin 20 of 674, across 5 files
ask the user about each decision one at a timein 19 of 674, across 4 files
edit CLAUDE.md if it existsin 18 of 674, across 3 files
explore current repo statein 18 of 674, across 3 files
do not overwrite user edits to surrounding sectionsin 18 of 674, across 3 files
back up the original file before overwritingin 16 of 674, across 8 files
keep the memory index under 200 linesin 15 of 674
Provide actionable steps and verificationin 13 of 674, across 2 files

Said here and by no other author read

emit high severity signal for confirmed fraud history
emit moderate signal for prior declines
emit low-moderate signal for prior escalations
attach matched keys and counts as evidence
return nothing when no recall summary is present
return nothing when no prior cases exist

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.