Data enrichment
Skill yogeshg665/sleuth-fraud-investigator/skills/data-enrichment
Sleuth - Agent Skills that automate payment fraud investigations, plus a deterministic Python engine as the executable reference. Explainable, deterministic scoring and decisions with tokenized card references and human-review gates.
npx -y skills add yogeshg665/sleuth-fraud-investigator --skill data-enrichmentAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Augments an investigation case with derived context features such as device familiarity and account history signals, and merges external reference data. WHEN: "enrich the case", "add context to transaction", "look up device history", "gather reference data", "prepare case for scoring".
SKILL.md
2.1 KB, 378 tokens by cl100k_base, as published. Nobody here has run it
Data Enrichment
Overview
Adds the contextual features that detection skills depend on. Enrichment derives features deterministically from account history and merges any externally supplied reference data, such as deny-list flags from upstream services.
When to Use
- Immediately after
transaction-intake, before any detection skill runs. - When detection skills require context that is not present on the raw event.
Inputs
| Input | Required | Description |
|---|---|---|
case | yes | The validated investigation case. |
enrichment | no | Externally supplied flags, for example card_blacklisted, ip_blacklisted, device_known. |
Process
- For the transaction device, determine whether it has prior history for this
account and set
device_known. - Count the distinct accounts that have transacted on the same device and set
device_account_count. - Merge externally supplied enrichment. External values take precedence over derived values.
- Record which features could not be derived as unavailable rather than guessing.
Outputs
The same case with a populated enrichment map.
Reference Implementation
src/fraud_investigator/agents/enrichment_agent.py.
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "There is no history, so skip enrichment." | Absence of history is itself a feature. Record it explicitly. |
| "Guess a value to fill the gap." | Guessing corrupts the score. Mark unknowns as unavailable. |
Red Flags
- Derived features silently overwrite authoritative external reference data.
- Missing data is filled with assumed defaults.
Verification
- The case enrichment map reflects either derived values or an explicit unavailable marker for each expected feature.