Geolocation risk
Skill yogeshg665/sleuth-fraud-investigator/skills/geolocation-risk
Sleuth - Agent Skills that automate payment fraud investigations, plus a deterministic Python engine as the executable reference. Explainable, deterministic scoring and decisions with tokenized card references and human-review gates.
npx -y skills add yogeshg665/sleuth-fraud-investigator --skill geolocation-riskAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Flags transactions from high-risk geographies and physically impossible travel between consecutive transactions. WHEN: "check transaction location", "impossible travel", "high risk country", "geolocation fraud", "location mismatch", "geo velocity".
SKILL.md
1.9 KB, 369 tokens by cl100k_base, as published. Nobody here has run it
Geolocation Risk
Overview
Evaluates where a transaction originates. It flags high-risk countries and computes whether the implied travel speed between consecutive transactions is physically impossible.
When to Use
- During the detection phase, whenever the transaction carries a location.
Inputs
| Input | Required | Description |
|---|---|---|
transaction.location | yes | Latitude, longitude, and country code. |
account_history | no | Prior located transactions for impossible-travel checks. |
Process
- If the transaction country is on the
high_risk_countrieslist, add severity. - Find the most recent prior located transaction for the account.
- Compute the great-circle distance and divide by the elapsed time to get the implied speed.
- If the implied speed exceeds
impossible_travel_kmh, add severity and record the speed and distance as evidence. - Emit a
geolocation_risksignal when any severity accrued.
Outputs
Zero or one RiskSignal.
Reference Implementation
src/fraud_investigator/skills/geolocation_check.py, including the
haversine_km distance function.
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "VPNs make location unreliable." | Treat it as one signal among many; scoring weighs uncertainty via confidence. |
| "The two transactions are close in time, so ignore distance." | Close time plus large distance is exactly the impossible-travel case. |
Red Flags
- Distance is computed with a flat-earth approximation instead of haversine.
- Elapsed time of zero is divided without guarding against it.
Verification
- An impossible-travel case yields a signal containing the implied speed.