Anti-Fraud Master

The Problem of Telecom Fraud and Immediate Intervention

In daily communications, users frequently receive scam messages impersonating customer service, law enforcement, or acquaintances. These messages employ high-pressure tactics, deceptive links, or vague requests to "secure accounts," making it difficult for ordinary users to quickly and accurately assess the risk level and true intent. Traditional rule-based or keyword-matching systems often fail to catch new variants and lack deep analysis of context and conversational patterns, leading to delayed intervention.

Skill Workflow and Core Mechanics

The Anti-Fraud Master skill provides a structured, explainable framework for real-time risk assessment and response. Its core principle is "Grade First, Respond Second"—all outputs are based on an auditable decision pipeline.

Core Capabilities: Detection, Protection, and Education

The skill integrates capabilities through four roles:
* Scam Talk Detector: Parses input text, extracts the five elements (who, what, money, link, urgency), and performs predicate matching against the built-in risk-levels.md rule set.
* Proactive Guardian: Monitors the dialogue flow, automatically inserts risk scans upon trigger words (e.g., transfer, verification code, screen sharing), and outputs reminders consistent with the final grade, preventing weak "incidental reminders."
* Verification Chain: Executes a six-layer verification from L1 predicate hits to L6 human review. Notably, at layer L3, when red predicates (R-series) are matched or semantic anomalies are detected, it automatically initiates external verification (e.g., web_search, official freeze-list checks) and labels conclusions as [Verified], [Inferred], or [Pending Verification].
* Education Coach: Tailors response scripts and anti-fraud education based on user demographics and context.

Key Steps: The Five-Step Grading Process and Advanced Analysis

The entire workflow strictly follows five steps:
1. Information Collection and Emergency Triage: First assess if the user is in a dangerous action (e.g., already transferred funds). If yes, immediately execute the emergency-sop.md stop-loss procedure, prioritized over grading. Otherwise, issue a one-time batch clarification list to fill the five elements.
2. Risk Scanning and Pre-routing: Scans predicates item-by-item and automatically determines if the deeper "brainstorming analysis process" should be triggered.
3. Risk Grading: Performs counter-hypothesis testing first, then outputs red, yellow, or green grades. Upgrade rules are explicit; for example, ≥2 yellow predicates involving funds or pressure upgrade to red.
4. Output Judgment: Before output, it enforces completion of L3-L5 verification and confidence calibration, providing evidence labels (e.g., [Verified]) and confidence basis (high/medium/low) for conclusions.
5. Action Recommendations: Outputs a verification checklist or a mandatory red strong-warning card based on the grade, along with specific stop-loss guidance and official helpline channels (e.g., 96110).

For complex or indeterminate cases (e.g., multi-role compound scams), the skill automatically or upon request enters the brainstorming analysis process, conducting step-by-step clarification and presenting multiple options with trade-offs, but never acts on behalf of the user.

Scope and Important Limitations

This skill focuses on individual anti-fraud education and immediate deterrence, with clear boundaries:
* Does not intervene in cases already under judicial proceedings, only provides official reporting channels.
* Does not offer professional conclusions in law, investment, or medicine; such inquiries should be directed to licensed professionals.
* Does not execute any actions for the user, such as clicking links, transferring money, or deleting information; all action suggestions require autonomous user confirmation.
* Does not fabricate scam types not in the knowledge base; for new or vague cases, it labels them as [Pending Verification] and suggests verification via official channels.
When fraud is ongoing, the skill forcefully inserts stop-loss instructions, emphasizing vigilance against secondary scams disguised as "refund," "recovery," or "unfreezing" attempts.