Transaction analysis
Skill yogeshg665/sleuth-fraud-investigator/skills/transaction-analysis
Evaluates a single transaction for high-value amounts and unusual timing, emitting an explainable risk signal. WHEN: "analyze this transaction", "is this amount suspicious", "check transaction timing", "high value transaction check", "unusual hour transaction".From its SKILL.md
npx -y skills add yogeshg665/sleuth-fraud-investigator --skill transaction-analysisAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.8 KB, 333 tokens by cl100k_base, as published. Nobody here has run it
Transaction Analysis
Overview
Inspects the transaction in isolation for two classic indicators: an amount that materially exceeds the high-value threshold, and activity during hours that are unusual for legitimate behavior.
When to Use
- During the detection phase of every investigation.
Inputs
| Input | Required | Description |
|---|---|---|
transaction.amount | yes | Transaction amount. |
transaction.timestamp | yes | UTC time of the transaction. |
Process
- Compare the amount to the configured
high_value_amount. If it meets or exceeds the threshold, add severity proportional to how far it exceeds it. - Check whether the transaction hour falls within the configured
unusual_hours. If so, add severity. - If any severity accrued, emit a
suspicious_transaction_profilesignal with a rationale and the supporting evidence. Otherwise emit nothing.
Outputs
Zero or one RiskSignal.
Reference Implementation
src/fraud_investigator/skills/transaction_analysis.py.
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "Large purchases are normal for some users." | The signal contributes risk; it does not decide alone. Let scoring weigh it. |
| "Time of day is irrelevant." | Off-hours activity is a well-established fraud correlate; keep the check. |
Red Flags
- Severity is emitted without a corresponding rationale.
- Thresholds are hardcoded instead of read from configuration.
Verification
- When the amount exceeds the threshold, a signal with non-zero severity exists.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.