@1aboveio/skills 1.0.10 → 1.0.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.codex-plugin/plugin.json +1 -1
- package/.codex-plugin/resources.json +297 -216
- package/README.md +3 -3
- package/package.json +10 -8
- package/skills/app-dev/airflow/SKILL.md +1 -1
- package/skills/app-dev/android-foundation/SKILL.md +35 -37
- package/skills/app-dev/android-foundation/references/delivery-focus.md +4 -2
- package/skills/app-dev/android-foundation/references/feature-work.md +50 -0
- package/skills/app-dev/android-foundation/references/setup.md +24 -9
- package/skills/app-dev/android-foundation/references/workspace.md +81 -0
- package/skills/app-dev/android-foundation/scripts/workspace-runtime/bin/workspaces.mjs +52 -0
- package/skills/app-dev/android-foundation/scripts/workspace-runtime/native-workspace.mjs +239 -0
- package/skills/app-dev/android-foundation/scripts/workspace-runtime/workspace-lifecycle.mjs +2154 -0
- package/skills/app-dev/app-debug/SKILL.md +1 -1
- package/skills/app-dev/better-auth/SKILL.md +1 -1
- package/skills/app-dev/data-catalog/SKILL.md +1 -1
- package/skills/app-dev/data-quality/SKILL.md +1 -1
- package/skills/app-dev/ios-foundation/SKILL.md +15 -10
- package/skills/app-dev/ios-foundation/references/setup.md +25 -9
- package/skills/app-dev/ios-foundation/references/workspace.md +82 -0
- package/skills/app-dev/ios-foundation/scripts/workspace-runtime/bin/workspaces.mjs +52 -0
- package/skills/app-dev/ios-foundation/scripts/workspace-runtime/native-workspace.mjs +239 -0
- package/skills/app-dev/ios-foundation/scripts/workspace-runtime/workspace-lifecycle.mjs +2154 -0
- package/skills/app-dev/monorepo/SKILL.md +1 -1
- package/skills/app-dev/nextjs-fullstack/SKILL.md +1 -1
- package/skills/app-dev/prisma-setup/SKILL.md +1 -1
- package/skills/app-dev/pyspark/SKILL.md +1 -1
- package/skills/app-dev/python-backend/SKILL.md +1 -1
- package/skills/app-dev/shadcn/SKILL.md +1 -1
- package/skills/app-dev/zod-v4/SKILL.md +1 -1
- package/skills/cicd/cloud-build/SKILL.md +1 -1
- package/skills/cicd/cloud-debug/SKILL.md +1 -1
- package/skills/cicd/cloud-deploy/SKILL.md +1 -1
- package/skills/cicd/docker/SKILL.md +1 -1
- package/skills/cicd/github-actions/SKILL.md +1 -1
- package/skills/cicd/github-flow/SKILL.md +1 -1
- package/skills/cicd/google-cloud/SKILL.md +1 -1
- package/skills/cicd/mergify/SKILL.md +1 -1
- package/skills/cicd/podman/SKILL.md +1 -1
- package/skills/content/article-review/SKILL.md +1 -1
- package/skills/content/article-to-image/SKILL.md +1 -1
- package/skills/content/flowchart-svg/SKILL.md +1 -1
- package/skills/content/image-gen/SKILL.md +1 -1
- package/skills/content/mermaid/SKILL.md +1 -1
- package/skills/content/wechat-article-writer/SKILL.md +1 -1
- package/skills/content/wechat-publisher/SKILL.md +1 -1
- package/skills/content/wechat-search/SKILL.md +1 -1
- package/skills/content/xai-search/SKILL.md +1 -1
- package/skills/core/distill-writing/SKILL.md +3 -3
- package/skills/core/distill-writing/references/extraction.md +1 -1
- package/skills/core/doc-to-md/SKILL.md +1 -1
- package/skills/core/editorial-review/SKILL.md +82 -12
- package/skills/core/editorial-review/references/checklist.md +26 -1
- package/skills/core/house-style/SKILL.md +8 -3
- package/skills/core/house-style/references/analytical-reporting.md +123 -0
- package/skills/core/house-style/references/analytical-writing-patterns.md +79 -0
- package/skills/core/house-style/references/analytical-writing-research.md +129 -0
- package/skills/core/{write-doc → house-style}/references/bilingual.md +7 -5
- package/skills/core/house-style/references/definitions-and-metrics.md +86 -0
- package/skills/core/house-style/references/document-workflow.md +193 -0
- package/skills/core/house-style/references/initialization.md +66 -0
- package/skills/core/house-style/references/persistence.md +9 -4
- package/skills/core/house-style/references/rules.md +11 -4
- package/skills/core/house-style/scripts/init-guidance.mjs +213 -0
- package/skills/core/house-style/templates/analytical-report.md +54 -0
- package/skills/core/house-style/templates/gap-analysis.md +1 -1
- package/skills/core/plain-language/SKILL.md +2 -2
- package/skills/core/polish-cn/SKILL.md +9 -2
- package/skills/core/reg-parser/SKILL.md +3 -3
- package/skills/core/terminology/SKILL.md +8 -4
- package/skills/core/write-doc/SKILL.md +40 -151
- package/skills/core/write-report/SKILL.md +129 -0
- package/skills/core/{write-doc → write-report}/references/compliance-reports.md +4 -4
- package/skills/engineering/better-review/SKILL.md +37 -37
- package/skills/engineering/better-review/references/passes.md +35 -41
- package/skills/engineering/better-review/references/result.md +10 -9
- package/skills/engineering/e2e-test/SKILL.md +17 -17
- package/skills/engineering/e2e-test/references/authoring/playwright-config.md +11 -13
- package/skills/engineering/e2e-test/references/presentation-sweep.md +7 -7
- package/skills/engineering/e2e-test/references/reviewing.md +9 -11
- package/skills/engineering/e2e-test/references/route-manifest.md +1 -1
- package/skills/engineering/engineering/SKILL.md +124 -0
- package/skills/engineering/engineering/references/engineering-conventions.md +32 -0
- package/skills/engineering/engineering/references/feature-delivery.md +8 -0
- package/skills/engineering/engineering/references/init-scope.md +37 -0
- package/skills/engineering/engineering/scripts/init.mjs +160 -0
- package/skills/engineering/{contributing → engineering}/scripts/persist-conventions.mjs +1 -1
- package/skills/engineering/engineering-runtime/SKILL.md +1 -1
- package/skills/engineering/engineering-runtime/coherence/workflow.json +19 -19
- package/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs +1 -1
- package/skills/engineering/ensure-coverage/SKILL.md +22 -109
- package/skills/engineering/ensure-coverage/references/breadth/coverage-ledger.md +7 -5
- package/skills/engineering/ensure-coverage/references/breadth/surface-baseline.md +4 -4
- package/skills/engineering/ensure-coverage/references/breadth/surface-discovery.md +3 -3
- package/skills/engineering/ensure-coverage/references/depth/characterization.md +4 -65
- package/skills/engineering/ensure-coverage/references/depth/grading.md +5 -7
- package/skills/engineering/ensure-coverage/references/depth/mock-policy.md +6 -12
- package/skills/engineering/ensure-coverage/references/enforcement/ci-contract.md +1 -1
- package/skills/engineering/ensure-coverage/references/presentation/axis.md +6 -6
- package/skills/engineering/ensure-coverage/references/process/audit-mode.md +7 -23
- package/skills/engineering/ensure-coverage/references/process/output-template.md +18 -133
- package/skills/engineering/ensure-coverage/references/process/test-strategy.md +7 -12
- package/skills/engineering/ensure-coverage/scripts/README.md +12 -4
- package/skills/engineering/golden-path/SKILL.md +1 -1
- package/skills/engineering/harness-runtime/SKILL.md +3 -1
- package/skills/engineering/harness-runtime/bin/workspaces.mjs +52 -0
- package/skills/engineering/harness-runtime/native-workspace.mjs +239 -0
- package/skills/engineering/harness-runtime/references/workspaces.md +78 -0
- package/skills/engineering/harness-runtime/workspace-lifecycle.mjs +2154 -0
- package/skills/engineering/resolve-issues/SKILL.md +40 -61
- package/skills/engineering/resolve-issues/references/ci.md +13 -3
- package/skills/engineering/resolve-issues/references/delivery-progress.md +4 -3
- package/skills/engineering/resolve-issues/references/done.md +11 -2
- package/skills/engineering/resolve-issues/references/expire.md +9 -2
- package/skills/engineering/resolve-issues/references/implementation.md +33 -17
- package/skills/engineering/resolve-issues/references/preflight.md +3 -1
- package/skills/engineering/resolve-issues/references/principles.md +52 -0
- package/skills/engineering/resolve-issues/references/review.md +25 -15
- package/skills/engineering/resolve-issues/references/task-plan.md +64 -27
- package/skills/engineering/resolve-issues/references/workspaces.md +164 -0
- package/skills/engineering/resolve-issues/scripts/cleanup-runs.mjs +185 -317
- package/skills/engineering/resolve-issues/scripts/next-actions.mjs +44 -7
- package/skills/engineering/resolve-issues/scripts/rehydrate.mjs +36 -2
- package/skills/engineering/resolve-issues/scripts/review-verdict.mjs +9 -8
- package/skills/engineering/resolve-issues/scripts/workspace-lifecycle.mjs +1 -0
- package/skills/engineering/resolve-release/SKILL.md +1 -1
- package/skills/engineering/rush-issues/SKILL.md +7 -5
- package/skills/engineering/rush-release/SKILL.md +1 -1
- package/skills/engineering/test-quality/SKILL.md +19 -4
- package/skills/engineering/test-quality/references/lint.md +1 -1
- package/skills/engineering/test-quality/references/principles.md +2 -2
- package/skills/engineering/test-quality/references/testing-conventions.md +1 -1
- package/skills/risk-compliance/compliance-audit/SKILL.md +4 -8
- package/skills/risk-compliance/compliance-audit/references/audience-and-reports.md +12 -0
- package/skills/risk-compliance/contract-compare/SKILL.md +17 -1
- package/skills/risk-compliance/contract-review/SKILL.md +6 -1
- package/skills/risk-compliance/contract-review/references/report-stage.md +17 -0
- package/skills/risk-compliance/doc-authenticity/SKILL.md +11 -1
- package/skills/risk-compliance/fraud-detection/LICENSE +3 -0
- package/skills/risk-compliance/fraud-detection/SKILL.md +148 -0
- package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/archetypes/first-party-fraud.md +3 -2
- package/skills/risk-compliance/fraud-detection/references/archetypes/third-party-fraud.md +47 -0
- package/skills/risk-compliance/fraud-detection/references/collection-payout-features.md +151 -0
- package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/contexts/bank-transfer.md +4 -3
- package/skills/risk-compliance/fraud-detection/references/contexts/card-payment.md +70 -0
- package/skills/risk-compliance/fraud-detection/references/contexts/payment-collection.md +34 -0
- package/skills/risk-compliance/fraud-detection/references/contexts/payout.md +34 -0
- package/skills/risk-compliance/fraud-detection/references/enrichment.md +74 -0
- package/skills/risk-compliance/fraud-detection/references/entities.md +48 -0
- package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/feature-engineering.md +69 -33
- package/skills/risk-compliance/fraud-detection/references/feature-sql.md +150 -0
- package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/report-rationale.md +4 -2
- package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/report-template.md +45 -23
- package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/review-checklist.md +60 -20
- package/skills/risk-compliance/fraud-detection/references/workflow.md +216 -0
- package/skills/risk-compliance/fraud-detection/release-check.mjs +95 -0
- package/skills/risk-compliance/payment-analysis/SKILL.md +36 -17
- package/skills/risk-compliance/payment-analysis/references/auth-rate-actions.md +2 -2
- package/skills/risk-compliance/payment-analysis/references/report-template.md +10 -2
- package/skills/risk-compliance/payment-analysis/references/visualization.md +11 -1
- package/skills/risk-compliance/portfolio-payment-analysis/LICENSE +3 -0
- package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md +170 -0
- package/skills/risk-compliance/portfolio-payment-analysis/references/identity-and-reconciliation.md +46 -0
- package/skills/risk-compliance/portfolio-payment-analysis/references/metrics-and-reporting.md +170 -0
- package/skills/risk-compliance/portfolio-payment-analysis/references/risk-history.md +89 -0
- package/skills/risk-compliance/portfolio-payment-analysis/release-check.mjs +95 -0
- package/skills/risk-compliance/portfolio-payment-analysis/scripts/analyze.py +636 -0
- package/skills/risk-compliance/portfolio-payment-analysis/scripts/build_report.py +386 -0
- package/skills/risk-compliance/portfolio-payment-analysis/scripts/comparison_charts.py +425 -0
- package/skills/risk-compliance/portfolio-payment-analysis/scripts/csv_export.py +52 -0
- package/skills/risk-compliance/portfolio-payment-analysis/scripts/render.py +160 -0
- package/skills/risk-compliance/portfolio-payment-analysis/scripts/risk_history.py +435 -0
- package/skills/risk-compliance/similar-domain/SKILL.md +9 -4
- package/skills/risk-compliance/tld-detection/SKILL.md +124 -239
- package/skills/risk-compliance/tld-detection/agents/openai.yaml +1 -1
- package/skills/risk-compliance/tld-detection/references/clean.md +18 -51
- package/skills/risk-compliance/tld-detection/references/fx-conversion.md +56 -219
- package/skills/risk-compliance/tld-detection/references/metric-contract.md +109 -0
- package/skills/risk-compliance/tld-detection/references/pattern.md +99 -0
- package/skills/risk-compliance/tld-detection/references/report-template.md +49 -272
- package/skills/risk-compliance/tld-detection/scripts/detect_ladders.py +46 -13
- package/skills/risk-compliance/tld-detection/scripts/detect_patterns.py +346 -0
- package/skills/risk-compliance/tld-detection/scripts/detect_streams.py +51 -19
- package/skills/risk-compliance/tld-detection/scripts/profile_groups.py +109 -0
- package/skills/risk-compliance/tld-detection/scripts/render_charts.py +218 -0
- package/skills/risk-compliance/tld-detection/scripts/tld_common.py +243 -0
- package/skills/engineering/contributing/SKILL.md +0 -70
- package/skills/risk-compliance/fraud-analysis/SKILL.md +0 -114
- package/skills/risk-compliance/fraud-analysis/references/archetypes/third-party-fraud.md +0 -27
- package/skills/risk-compliance/fraud-analysis/references/contexts/card-payment.md +0 -30
- package/skills/risk-compliance/fraud-analysis/references/contexts/payment-collection.md +0 -20
- package/skills/risk-compliance/fraud-analysis/references/contexts/payout.md +0 -20
- package/skills/risk-compliance/fraud-analysis/references/workflow.md +0 -175
- package/skills/risk-compliance/tld-detection/references/chinese-polish.md +0 -55
- package/skills/risk-compliance/tld-detection/references/clustering.md +0 -235
- package/skills/risk-compliance/tld-detection/references/decision.md +0 -189
- package/skills/risk-compliance/tld-detection/references/streams.md +0 -141
- package/skills/risk-compliance/tld-detection/references/terminology.md +0 -95
- package/skills/risk-compliance/tld-detection/references/workflow.md +0 -95
- /package/skills/{engineering/contributing → core/write-report}/LICENSE +0 -0
- /package/skills/core/{write-doc → write-report}/references/reports/audit-report-template.md +0 -0
- /package/skills/core/{write-doc → write-report}/references/reports/external-assessment-template.md +0 -0
- /package/skills/core/{write-doc → write-report}/references/reports/management-report-template.md +0 -0
- /package/skills/core/{write-doc → write-report}/references/reports/vars-report-template.md +0 -0
- /package/skills/{engineering/contributing → core/write-report}/release-check.mjs +0 -0
- /package/skills/{risk-compliance/fraud-analysis → engineering/engineering}/LICENSE +0 -0
- /package/skills/engineering/{contributing → engineering}/references/tracker-conventions.md +0 -0
- /package/skills/{risk-compliance/fraud-analysis → engineering/engineering}/release-check.mjs +0 -0
- /package/skills/engineering/{contributing → engineering}/scripts/persist-conventions-core.mjs +0 -0
- /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/archetypes/authorized-payment-scam.md +0 -0
- /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/mechanisms/account-takeover.md +0 -0
- /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/taxonomy.md +0 -0
- /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/terminology.md +0 -0
|
@@ -1,245 +1,130 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: tld-detection
|
|
3
3
|
description: >
|
|
4
|
-
Explicit-only.
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
BIN-country base-currency FX sensitivity when requested or indicated, with
|
|
9
|
-
same-descriptor baseline contrasts, high/medium/low risk
|
|
10
|
-
tiers, exposure sizing, and a plain-language investigation conclusion
|
|
11
|
-
with a ≤3-sentence summary.
|
|
12
|
-
Not payment-analysis, fraud-analysis, or website research (similar-domain).
|
|
4
|
+
Explicit-only. Investigate potential transaction-laundering patterns in
|
|
5
|
+
transaction data using amount concentration, escalating amounts and pricing
|
|
6
|
+
patterns, with USD and BIN-country currency views, group profiles and priorities.
|
|
7
|
+
Not payment-analysis, fraud-detection, or website research.
|
|
13
8
|
disable-model-invocation: true
|
|
14
|
-
release-version: 0.
|
|
9
|
+
release-version: 0.45.0
|
|
15
10
|
---
|
|
16
11
|
**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
|
|
17
|
-
# TLD
|
|
18
|
-
|
|
19
|
-
Find
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
target currency in
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
[
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
and exposure in supporting tables; no qualifying cluster does not mean low risk.
|
|
137
|
-
|
|
138
|
-
### 5 — Report
|
|
139
|
-
|
|
140
|
-
[references/report-template.md](references/report-template.md). Use three main
|
|
141
|
-
sections: Period conclusion, Main findings, Next checks (Month conclusion for
|
|
142
|
-
monthly reports). Within each finding, explain observed evidence before the
|
|
143
|
-
payment-pattern hypothesis and its reconciled relationship to amount clusters.
|
|
144
|
-
Pattern count is not a count of upstream businesses. If a supported menu has
|
|
145
|
-
non-doubling presets, explicitly explain in the finding why its prices need
|
|
146
|
-
not satisfy the formal cluster gate; do not leave that distinction implicit
|
|
147
|
-
in separate amount lists. Terms:
|
|
148
|
-
[references/terminology.md](references/terminology.md).
|
|
149
|
-
|
|
150
|
-
Use the main-report, evidence, and methodology filenames listed in
|
|
151
|
-
[report-template.md](references/report-template.md); provide matching Chinese
|
|
152
|
-
Markdown and HTML where required.
|
|
153
|
-
|
|
154
|
-
Keep the main report selective: supported findings and useful original charts,
|
|
155
|
-
not repeated conclusions or exhaustive tables. Preserve every identified
|
|
156
|
-
cluster, its descriptor share, comparisons, and by-tier/by-descriptor exposure
|
|
157
|
-
in complete linked evidence. Sort High → Medium → Low, then by evidence
|
|
158
|
-
strength and attempts inside each tier. Put the
|
|
159
|
-
actual run's cleaning, partitioning, parameter selection, sensitivity evidence,
|
|
160
|
-
baseline definition, and audit details in the methodology documents; link the
|
|
161
|
-
three document types together. HTML is preferred when there are charts.
|
|
162
|
-
Use new revision-qualified paths for delivered revisions; never overwrite prior
|
|
163
|
-
outputs. Presentation-only revisions reuse frozen results without rerunning
|
|
164
|
-
inference, detection, or risk assignment. Retain all valid original charts,
|
|
165
|
-
putting important amount/rate charts inline and secondary views in expandable
|
|
166
|
-
sections; verify chart payload fidelity and desktop/mobile rendering.
|
|
167
|
-
Review the written documents with `editorial-review`
|
|
168
|
-
(`{editorial-review baseDir}/SKILL.md`), naming
|
|
169
|
-
[references/report-template.md](references/report-template.md) as its template. For Chinese deliverables,
|
|
170
|
-
including a Chinese final chat handoff, then run `polish-cn`
|
|
171
|
-
(`{polish-cn baseDir}/SKILL.md`) with the coverage, protected terms and guardrails in
|
|
172
|
-
[references/chinese-polish.md](references/chinese-polish.md). Then verify factual
|
|
173
|
-
fidelity, synchronize Markdown and HTML, and grep banned strings before delivery.
|
|
174
|
-
|
|
175
|
-
## Progress
|
|
176
|
-
|
|
177
|
-
Track a task plan. One item is `in_progress` at a time.
|
|
178
|
-
|
|
179
|
-
1. Pass pre-flight
|
|
180
|
-
2. Freeze cleaned universe and descriptor partitions
|
|
181
|
-
2b. Infer payment patterns and record them per descriptor without splitting detection
|
|
182
|
-
3. Assign High / Medium / Low risk tiers
|
|
183
|
-
4. Publish complete cluster evidence + same-descriptor baselines
|
|
184
|
-
5. Write main report: conclusion (≤3 sentences), findings, next checks
|
|
185
|
-
6. Link report, evidence, and run methodology; retain charts and prior revisions; run `editorial-review`, then `polish-cn` on Chinese; verify and proofread
|
|
186
|
-
|
|
187
|
-
## Boundary
|
|
188
|
-
|
|
189
|
-
| Need | Skill |
|
|
190
|
-
|---|---|
|
|
191
|
-
| Potential TLD clusters, currency-amount pairs, stuffing / 掺量, MCC miscoding, descriptor mixing, upstream streams behind one descriptor | `tld-detection` |
|
|
192
|
-
| Which websites, mirrors and operators sit behind a merchant domain | `similar-domain` |
|
|
193
|
-
| Volume, journey Sankey, auth rate, decline mix, settlement overview | `payment-analysis` |
|
|
194
|
-
| Proxy/confirmed fraud labels, holdout precision/recall, rule packages | `fraud-analysis` |
|
|
195
|
-
|
|
196
|
-
A suspected-fraud *rate contrast* in this skill is not a fraud-analysis
|
|
197
|
-
rule package.
|
|
198
|
-
|
|
199
|
-
## Reference index
|
|
200
|
-
|
|
201
|
-
| Need | Read |
|
|
202
|
-
|---|---|
|
|
203
|
-
| Grain, columns, window | [workflow.md](references/workflow.md) |
|
|
204
|
-
| Dedup | [clean.md](references/clean.md) |
|
|
205
|
-
| Payment-pattern names, direct vs FX-converted top-ups, fixed-amount characteristics, behavior metrics | [streams.md](references/streams.md) |
|
|
206
|
-
| Currency-amount pairs, anchors, same-descriptor baseline | [clustering.md](references/clustering.md) |
|
|
207
|
-
| BIN-country base-currency FX sensitivity | [fx-conversion.md](references/fx-conversion.md) |
|
|
208
|
-
| Business-readable conclusion and ≤3-sentence summary | [decision.md](references/decision.md) |
|
|
209
|
-
| Report chapters | [report-template.md](references/report-template.md) |
|
|
210
|
-
| Chinese polish coverage, protected terms, and fidelity checks | [chinese-polish.md](references/chinese-polish.md) |
|
|
211
|
-
| Language / banned strings | [terminology.md](references/terminology.md) |
|
|
212
|
-
|
|
213
|
-
## Sanity check
|
|
214
|
-
|
|
215
|
-
- [ ] Auth grain; dedup counts are stated; no BIN-country row filter
|
|
216
|
-
- [ ] Partition key is normalized descriptor; missing descriptor is an explicit bucket
|
|
217
|
-
- [ ] Payment-pattern inference ran; direct/FX-converted top-up, e-commerce, and other labels are hypotheses; inferred top-up and actual charge currencies are separate
|
|
218
|
-
- [ ] Fixed amounts are a supplementary characteristic; fixed FX requires tested source-to-top-up rate movement, not same-currency prices or untested `live` labels
|
|
219
|
-
- [ ] Canonical detection, exact membership, thresholds, and baseline use the whole descriptor; inferred patterns and BIN-country groups never filter members
|
|
220
|
-
- [ ] Clustering key is original currency + amount, not USD
|
|
221
|
-
- [ ] Canonical `C*` results use original amounts; any FX run is separate, uses `FXC*` ids, and does not alter canonical membership or exposure
|
|
222
|
-
- [ ] FX run records as-of-date country→legal-tender mapping, the versioned immutable Frankfurter v2 exact-date request/cache facts, formula, minor-unit rounding, exclusions, and converted-universe coverage
|
|
223
|
-
- [ ] Within each frozen descriptor, `|P_FX|` contains only exact-date-converted attempts; FX thresholds and same-descriptor baselines use only `P_FX`, while exclusions reconcile only to canonical `U`
|
|
224
|
-
- [ ] FX country concentration is descriptive only because BIN country constructs the target currency; it does not independently raise risk
|
|
225
|
-
- [ ] Each rung-pool currency has an explicit adjacent absolute-residual cap and sensitivity evidence
|
|
226
|
-
- [ ] Multi-anchor levels state their portfolio support floor; final membership uses exact selected amount keys
|
|
227
|
-
- [ ] Cluster attempts ≥100
|
|
228
|
-
- [ ] Every cluster has a High / Medium / Low risk tier and results sort in that order
|
|
229
|
-
- [ ] Currency-amount pairs show seed and representative anchors; `*` marks a multi-amount level
|
|
230
|
-
- [ ] Same amount pair may recur across descriptor partitions; never merge them automatically
|
|
231
|
-
- [ ] BIN country is post-membership reporting data, not a membership key; Mixed is neutral
|
|
232
|
-
- [ ] Canonical exact 100% single-country concentration is a standout; FX concentration is descriptive only; descriptor-country coverage has no risk threshold
|
|
233
|
-
- [ ] Each cluster baseline is the same descriptor after removing that cluster
|
|
234
|
-
- [ ] Complete linked evidence, not the main report, uses one consolidated profile/comparison table per cluster; descriptor, seed, anchors, attempts, descriptor totals/share, MCC, and baseline metrics are not repeated in separate definition/characteristic/metric tables
|
|
235
|
-
- [ ] Anchor table reports attempts, authorization success rate, and suspected-fraud share for every level, including n < 30
|
|
236
|
-
- [ ] Characteristics contain descriptor total, cluster attempts/share, MCC, and cluster-vs-baseline auth rate, suspected-fraud share, top 3 banks, and top 3 BIN countries
|
|
237
|
-
- [ ] Summary is ≤3 short sentences; explanation answers who to review, why, what remains unknown, and what to check next without decoding technical labels
|
|
238
|
-
- [ ] No qualifying cluster is not described as low merchant risk; unqualified leads have no cluster tier or cluster exposure; current-period findings are separate from historical results
|
|
239
|
-
- [ ] Report answers highest-risk, identified-cluster characteristics, and by-tier/by-descriptor exposure
|
|
240
|
-
- [ ] Main report has exactly three sections: conclusion, findings, next checks; findings explain observations before hypotheses and reconciled cluster relationships
|
|
241
|
-
- [ ] Main report, complete evidence, and methodology are separate and mutually linked; prior revisions and frozen facts remain intact
|
|
242
|
-
- [ ] Valid original chart payloads are retained; important amount/rate charts are inline, secondary charts render on expansion, and desktop/mobile views are nonblank without page overflow
|
|
243
|
-
- [ ] Zero families → ranking only; no descriptor-invented clusters
|
|
244
|
-
- [ ] Language matches terminology.md; no confirmed-laundering claim
|
|
245
|
-
- [ ] Documents passed `editorial-review`; Chinese report, evidence, methodology, chart captions, and handoff passed `polish-cn`; the model that ran is recorded, facts are unchanged, and Markdown / HTML agree
|
|
12
|
+
# TLD detection
|
|
13
|
+
|
|
14
|
+
Find patterns that warrant investigation, not proof of transaction laundering
|
|
15
|
+
(TLD). Declare selection thresholds and rating criteria before interpreting results.
|
|
16
|
+
|
|
17
|
+
## Data contract
|
|
18
|
+
|
|
19
|
+
One row represents one **transaction**. Require transaction time, transaction ID,
|
|
20
|
+
currency, amount, MCC, billing descriptor, MID, card scheme, card BIN, card issuer,
|
|
21
|
+
and card BIN country. Record column aliases, types and missingness. Use the requested
|
|
22
|
+
reporting period; otherwise state the cleaned data's observed time range.
|
|
23
|
+
|
|
24
|
+
Missing required columns or unresolved transaction identities block analysis.
|
|
25
|
+
Request the data or an explicit aggregation rule; do not substitute authorization
|
|
26
|
+
attempts or orders. A constant MID needs an established value and scope. The prepared
|
|
27
|
+
script input requires nonempty identity and business fields; resolve missing values
|
|
28
|
+
before running it. BIN country may be null: retain that transaction in USD if valid,
|
|
29
|
+
and explicitly exclude its BIN-country view. Status fields may independently be
|
|
30
|
+
unknown. Never invent missing dimensions or merge unknown scopes.
|
|
31
|
+
Follow [transaction preparation](references/clean.md) for deduplication and normalization.
|
|
32
|
+
|
|
33
|
+
Rates additionally require transaction-level authorization status and a suspected-
|
|
34
|
+
fraud indicator or documented response-code mapping. Missing status is unknown,
|
|
35
|
+
not failure or zero fraud. Report coverage and withhold complete-population rates
|
|
36
|
+
when classifications are incomplete. A separately labeled known-only rate may
|
|
37
|
+
accompany coverage, but cannot replace the requested total-denominator rate.
|
|
38
|
+
|
|
39
|
+
## 1. Pattern sniffing
|
|
40
|
+
|
|
41
|
+
Prepare two views from the same cleaned transactions: **USD-converted amounts**
|
|
42
|
+
and **BIN-country-currency amounts**. Follow [FX conversion](references/fx-conversion.md)
|
|
43
|
+
for dated mappings, exact-date quotes, rounding and exclusions. Partition each view
|
|
44
|
+
by MID, normalized billing descriptor and target currency within the reporting period.
|
|
45
|
+
Keep the views distinct even when both target USD.
|
|
46
|
+
|
|
47
|
+
Look independently for:
|
|
48
|
+
|
|
49
|
+
- **Amount concentration:** repeated prices such as 8.00 or 9.9. Declare minimum
|
|
50
|
+
transaction count and share before selection; a concentration needs no ladder.
|
|
51
|
+
- **Escalating amounts:** doubling prices such as 8, 16, 32, 64. Default to at least
|
|
52
|
+
three levels and 100 transactions. Keep the multiplier at 2x; record any changes
|
|
53
|
+
to level count, minimum support or discovery tolerances.
|
|
54
|
+
- **Pricing patterns:** supported preset menus such as 10, 20, 50, FX-converted
|
|
55
|
+
menus, or retail-like prices sharing a fitted multiplier. Keep inferred pricing
|
|
56
|
+
currency separate from charge currency and BIN-country currency.
|
|
57
|
+
|
|
58
|
+
Read [pattern.md](references/pattern.md) for detection methods, eligibility and
|
|
59
|
+
membership. Freeze exact transaction IDs for every group and amount keys where
|
|
60
|
+
applicable. Retain below-threshold and insufficient-evidence candidates without
|
|
61
|
+
priority tiers. Pricing groups follow the same profiling and rating steps; they do
|
|
62
|
+
not need to pass the escalation gates.
|
|
63
|
+
|
|
64
|
+
Supply prepared transaction views; these scripts do not fetch rates or prepare
|
|
65
|
+
live FX conversions. Follow the [script and metric contract](references/metric-contract.md)
|
|
66
|
+
for the dataset schema, exclusions, output schemas and formulas. Replace `{baseDir}`
|
|
67
|
+
with the absolute skill directory and use thresholds agreed for the analysis. Input and
|
|
68
|
+
output paths below are relative to the working directory; these values are examples:
|
|
69
|
+
|
|
70
|
+
```bash
|
|
71
|
+
python3 "{baseDir}/scripts/detect_patterns.py" dataset.json groups.json \
|
|
72
|
+
--pattern concentration --concentration-min-count 30 --concentration-min-share .2 \
|
|
73
|
+
--pattern escalating --cap USD=.15 \
|
|
74
|
+
--pattern pricing --pricing-currency EUR --pricing-rates rates.json
|
|
75
|
+
python3 "{baseDir}/scripts/profile_groups.py" dataset.json groups.json profile.json
|
|
76
|
+
python3 "{baseDir}/scripts/render_charts.py" profile.json charts.html --overwrite
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
Give `--cap` for every target currency in the prepared views. `--pricing-rates`
|
|
80
|
+
is optional and supplies an exact-date adapter, not a live feed; see
|
|
81
|
+
[pattern.md](references/pattern.md). Pricing quotes use UTC transaction dates;
|
|
82
|
+
profiles use the declared reporting timezone. `profile_groups.py` accepts optional `--tier-edges`
|
|
83
|
+
followed by sorted decimal boundaries. Outputs refuse replacement unless
|
|
84
|
+
`--overwrite` is explicit; omit it above for a new chart path.
|
|
85
|
+
|
|
86
|
+
## 2. Group profiling
|
|
87
|
+
|
|
88
|
+
Compare each eligible group with the **out-group**: converted transactions in the
|
|
89
|
+
same MID, descriptor, view, target currency and period, minus that group's IDs.
|
|
90
|
+
Other groups remain in the out-group; conversion exclusions do not. Save membership
|
|
91
|
+
and population counts. Groups can overlap across patterns or views: use the union
|
|
92
|
+
of transaction IDs for combined totals and state how overlapping tiers are handled.
|
|
93
|
+
|
|
94
|
+
For both populations, present daily amount-tier counts, success and suspected-fraud
|
|
95
|
+
rates, transaction counts and shares, and 24-hour counts. Declare the timezone,
|
|
96
|
+
default UTC, and show status coverage and unavailable rates. See the
|
|
97
|
+
[metric contract](references/metric-contract.md) for denominators, zero-filling and
|
|
98
|
+
reconciliation. Add issuer, BIN-country, MCC and card-scheme composition where useful.
|
|
99
|
+
|
|
100
|
+
## 3. Rating and decision
|
|
101
|
+
|
|
102
|
+
Assign **investigation priority** from independent, material profile differences:
|
|
103
|
+
|
|
104
|
+
- **High:** several independent, materially adverse observations converge.
|
|
105
|
+
- **Medium:** at least two independent material differences warrant follow-up,
|
|
106
|
+
but High is not supported.
|
|
107
|
+
- **Low:** adequate observed evidence provides little corroboration beyond the
|
|
108
|
+
amount pattern. Insufficient evidence leaves a group unrated, not automatically Low.
|
|
109
|
+
|
|
110
|
+
State the basis, sample size, materiality criteria and confidence. Avoid counting
|
|
111
|
+
correlated observations twice or inventing a calibrated numeric score. BIN country
|
|
112
|
+
constructs the target currency in that view, so its concentration cannot independently
|
|
113
|
+
raise priority. MCC and descriptor alone do not establish a business mismatch.
|
|
114
|
+
No qualifying group does not establish low merchant risk.
|
|
115
|
+
|
|
116
|
+
Explain whom to review, why, what remains unknown, and which orders, products,
|
|
117
|
+
sellers or fulfillment records to check next. Do not claim unperformed checks or
|
|
118
|
+
recommend enforcement from these patterns alone. Keep current and historical findings
|
|
119
|
+
separate.
|
|
120
|
+
|
|
121
|
+
## Deliver
|
|
122
|
+
|
|
123
|
+
Write a concise report in the requested language, preserving evidence, methodology
|
|
124
|
+
and useful charts under revision-qualified paths in `reports/tld-detection/`.
|
|
125
|
+
Read `{house-style baseDir}/references/analytical-reporting.md` and its required
|
|
126
|
+
references, and use `{write-report baseDir}/SKILL.md` with the frozen analysis for the
|
|
127
|
+
report stage. If a required skill or reference is unavailable, report the blocker.
|
|
128
|
+
Follow [reporting](references/report-template.md) for evidence contents, terminology,
|
|
129
|
+
review and presentation-only revisions; do not rerun analysis for report writing. The scripts produce detection, profiles and
|
|
130
|
+
charts; interpretation, priority and the final report still require analyst judgment.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
interface:
|
|
2
2
|
display_name: "TLD Detection"
|
|
3
|
-
short_description: "
|
|
3
|
+
short_description: "Investigate transaction amount patterns across currency views"
|
|
4
4
|
|
|
5
5
|
policy:
|
|
6
6
|
# Codex counterpart to SKILL.md disable-model-invocation: true
|
|
@@ -1,51 +1,18 @@
|
|
|
1
|
-
#
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
count
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
Otherwise, if `Order ID` is present, keep one row per
|
|
20
|
-
(`Order ID`, time, amount, currency, masked PAN / last4 if present).
|
|
21
|
-
Retries of the same order at different times stay distinct.
|
|
22
|
-
|
|
23
|
-
If none of those identities exist, **skip this step** — keep the
|
|
24
|
-
exact-row-deduped table and say identity-dup was skipped. Do not stop
|
|
25
|
-
the run. Do not invent a customer id from BIN + amount.
|
|
26
|
-
|
|
27
|
-
## 3. Amount and currency
|
|
28
|
-
|
|
29
|
-
- The canonical clustering key uses the **original** amount and currency. A BIN-country base-currency sensitivity may derive a separate key only after this cleaned universe is frozen; see [fx-conversion.md](fx-conversion.md).
|
|
30
|
-
- Normalize `10`, `10.0`, `10.00` to the same decimal key.
|
|
31
|
-
- Drop rows with missing amount or currency; count them.
|
|
32
|
-
- Do not FX-convert before clustering. A 9.99 EUR rung is not a 9.99 USD
|
|
33
|
-
rung. Amount sums later stay inside one currency; never add EUR to USD.
|
|
34
|
-
|
|
35
|
-
## 4. Missing dimensions
|
|
36
|
-
|
|
37
|
-
Rows with missing descriptor or BIN / issuer country stay in the
|
|
38
|
-
clustering universe. Missing descriptors enter the `UNKNOWN_DESCRIPTOR`
|
|
39
|
-
partition; missing countries enter the `UNKNOWN_BIN_COUNTRY` reporting
|
|
40
|
-
bucket after membership is frozen.
|
|
41
|
-
|
|
42
|
-
## Output of this step
|
|
43
|
-
|
|
44
|
-
A cleaned table plus a one-line census:
|
|
45
|
-
|
|
46
|
-
```
|
|
47
|
-
raw N → exact-dup drop n1 → identity-dup drop n2 (or skipped)
|
|
48
|
-
→ missing amount/currency n3 → cleaned universe U
|
|
49
|
-
```
|
|
50
|
-
|
|
51
|
-
All later attempt counts use `U`, not `raw N`.
|
|
1
|
+
# Transaction preparation
|
|
2
|
+
|
|
3
|
+
Record source rows, duplicate removals, unresolved IDs, exclusions and the final
|
|
4
|
+
transaction count. Remove only demonstrably identical extract duplicates. Inspect
|
|
5
|
+
all rows sharing a transaction ID: conflicting times, statuses, amounts or other
|
|
6
|
+
events may represent retries or state changes. Never keep the first row by default
|
|
7
|
+
or collapse conflicting records without an explicit, documented transaction-level
|
|
8
|
+
aggregation rule. If no rule resolves them, stop and ask; do not silently switch
|
|
9
|
+
to authorization-attempt or order grain. Preserve a row-to-transaction audit map.
|
|
10
|
+
|
|
11
|
+
Normalize currency codes, exact decimal amounts and descriptor whitespace/case;
|
|
12
|
+
do not fuzzy-merge descriptors or strip suffixes without documented semantics.
|
|
13
|
+
Keep MID separate. Resolve missing identity and business values before preparing
|
|
14
|
+
script input; the validator rejects incomplete required values instead of silently
|
|
15
|
+
dropping rows. BIN country and metric statuses are the documented exceptions.
|
|
16
|
+
Keep rows with missing BIN country in the USD view when otherwise valid;
|
|
17
|
+
they cannot enter the BIN-country view without a valid mapping. See
|
|
18
|
+
[FX conversion](fx-conversion.md). Never sum amounts in different currencies.
|