Velocity analysis
Skill yogeshg665/sleuth-fraud-investigator/skills/velocity-analysis
Detects abnormal transaction frequency or cumulative spend on a single account within a short time window. WHEN: "check transaction velocity", "rapid transactions", "card testing", "too many charges", "burst of activity", "velocity check".From its SKILL.md
npx -y skills add yogeshg665/sleuth-fraud-investigator --skill velocity-analysisAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.8 KB, 339 tokens by cl100k_base, as published. Nobody here has run it
Velocity Analysis
Overview
Identifies bursts of activity that are characteristic of card testing and account takeover: many transactions or a large cumulative spend within a short window on the same account.
When to Use
- During the detection phase, whenever account history is available.
Inputs
| Input | Required | Description |
|---|---|---|
transaction | yes | The current transaction. |
account_history | yes | Prior transactions for the same account. |
Process
- Define the window as
window_minutesending at the transaction timestamp. - Count transactions for the account within the window, including the current
one. If the count exceeds
max_transactions, add severity. - Sum the spend within the window. If it exceeds
max_amount, add severity. - Emit a
high_velocity_activitysignal with the count, window, and cumulative amount as evidence.
Outputs
Zero or one RiskSignal.
Reference Implementation
src/fraud_investigator/skills/velocity_check.py.
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "The account has no history, so velocity is irrelevant." | A first transaction simply yields no velocity signal; do not infer safety. |
| "A few rapid purchases are normal." | The threshold encodes normal; exceeding it is the signal. |
Red Flags
- The current transaction is excluded from the window count.
- The window is measured from the wrong anchor time.
Verification
- When activity exceeds the configured limits, a signal reports the count and cumulative amount.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most research analysis skills give in 339 tokens
Counted across 1,063 of the 1,754 authors here whose files we hold, read 2026-08-07
- Generate a markdown reportin 32 of 1063, across 23 files
- Cite each claim's sourcein 30 of 1063, across 15 files
- Define the ideal customer profilein 20 of 1063, across 2 files
- Search for companies matching the criteriain 20 of 1063, across 2 files
- Assign a fit score from one to tenin 20 of 1063, across 2 files
- Analyze the codebase to understand the productin 19 of 1063, across 1 file
- Ask clarifying questions about the value propositionin 19 of 1063, across 1 file
- Look for signals of immediate needin 19 of 1063, across 1 file
- Identify the target decision maker rolein 19 of 1063, across 1 file
- Suggest a personalized contact strategyin 19 of 1063, across 1 file
- Provide conversation starters for outreachin 19 of 1063, across 1 file
- Format results in a scannable markdown templatein 19 of 1063, across 1 file
Said here and by no other author read
- define window ending at transaction timestamp
- count transactions within the window including current one
- add severity when transaction count exceeds limit
- sum spend within the window
- emit high velocity activity signal with evidence
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.