fraud-detection-agent-oss

Look up whether a specific email address has submitted an account ban appeal in Warp's Front Appeals inbox. Use when given an email address (e.g. from a fraud investigation) and you need to check if that user has appealed, and retrieve the content of their appeal. Returns conversations and message bodies for downstream use by other skills. Part of the fraud-bot skill suite.

Detect coordinated free-tier AI abuse by analyzing IP address concentration in client telemetry. Use when investigating usage spikes, geographic anomalies in AI spend, or suspected fraud rings that bypass Verisoul (which only checks the first AI query). This skill queries the enriched client-events table to find IPs and /24 subnets with suspiciously many distinct free users creating AI blocks, then trends them over time to distinguish new fraud surges from persistent abuse.

Detect and investigate fraud rings that use Warp as a free LLM backend by injecting third-party system prompts (e.g., OpenClaw, Claude Code) into agent mode queries. Use when you see unusual agent mode cost spikes, high volumes of identical-looking first messages, or tool-call loops referencing tools that don't exist in Warp (e.g., Bash, Read, exec). This skill covers how to identify prompt injection patterns, backtest proposed denylist strings for false positives, and monitor cost impact.

Check if a Warp user is an active member of the Warp Community Slack workspace. Use when investigating a ban appeal to determine if the user has recent posting activity (last 90 days) in the community — a strong signal of legitimate developer engagement. All Slack API logic runs in a deterministic script; the agent reads only the JSON result and never calls Slack APIs directly, reads message text, or joins channels. Part of the fraud-bot skill suite.

Summarize a Warp user's agent mode conversation history to understand how they use Warp. Use when asked to profile, summarize, or investigate what a specific user has been doing in agent mode (e.g., "summarize agent mode usage for user@example.com", "what has this user been using Warp for?", "get conversation info for this user").

Traverse a Warp user's terminal ID / user graph to find all accounts that have shared the same computer (anonymous terminal ID). Use when investigating whether a user has multiple accounts, finding connected fraud rings via shared devices, or asked to "traverse the user graph", "find related accounts", "find accounts sharing the same computer", or "find connected users" for a given email or user.

Look up a user account in Verisoul to check for fraud signals and account authenticity. Use when given an email address (e.g. from a fraud investigation) and you need to verify the account's legitimacy, check risk scores, and analyze email domain and device signals. Returns detailed account information including decision (Real/Fake), risk scores, email analysis, and device/network risk signals. Part of the fraud-bot skill suite.

Investigate Warp's user data to identify fraudulent account patterns and quantify their impact. Use when asked to detect fraud, investigate suspicious accounts, analyze abuse patterns, create fraud reports, or block malicious domains.