# Build Fraud Detection and Risk Controls

Fraud teams need practical methods to identify abuse, test controls, and monitor drift. This skill guides risk analysis, rules, models, backtesting, and real-time system design.

## Install

```bash
npx skillstore add zl2023github/risk-control-engineer
```

## Metadata

- Status: approved
- Slug: zl2023github-risk-control-engineer
- Skillstore revision: r2
- Version status: missing
- Tree hash: 6fc2076acede0c422de8d8336ac735d190a7ece29e4e2622e1ed836f11295ee4
- Author: zl2023github
- GitHub username: zl2023github
- License: MIT
- Repository: https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/risk-control-engineer
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands
- Quality score: 50
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/zl2023github-risk-control-engineer
- Manifest: https://skillstore.pages.dev/api/skills/zl2023github-risk-control-engineer/manifest

## Capabilities

- Identifies fraud scenarios and documents attack paths, business impact, and control gaps.
- Drafts single-dimension, combined, and sequence rules with priorities and decisions.
- Provides Python templates for feature extraction, model training, anomaly detection, and graph analysis.
- Proposes backtest metrics, threshold evaluation, and business impact analysis.
- Designs real-time risk architectures using streaming, feature storage, rules, models, and monitoring.
- Outlines dashboards and alerts for approval rates, rejection rates, fraud rates, and feature drift.

## Use Cases

- Assess a New Abuse Scenario: Map likely attacks, affected workflows, evidence, control gaps, and prioritized defenses for a new product flow.
- Plan Model and Rule Backtests: Define features, temporal validation, evaluation metrics, thresholds, and cost assumptions for candidate controls.
- Design Real-Time Decisioning: Create a scalable architecture for streaming features, rule evaluation, model inference, case review, monitoring, and rollout.

## Prompt Templates

### Identify Fraud Risks

```
Analyze fraud risks for [business flow]. List attack paths, affected users, existing control gaps, and prioritized defenses.
```

### Design Risk Rules

```
Design rules for [scenario] using [available fields]. Include rule IDs, conditions, actions, priorities, conflicts, and measurable review criteria.
```

### Create a Backtest Plan

```
Create a backtest plan for [dataset] and [rules]. Define temporal splits, metrics, cost assumptions, leakage checks, and threshold selection.
```

### Architect Real-Time Controls

```
Design a real-time fraud platform for [QPS] and [latency target]. Cover data flows, feature storage, decisioning, monitoring, resilience, and rollout.
```

## Limitations

- The provided rule-engine example uses Python eval and is unsafe for untrusted conditions.
- Reliable model and backtest results require representative, time-aware, labeled historical data.
- The skill does not connect to live fraud feeds, reputation services, or production systems.
- Controls require independent privacy, fairness, legal, and operational review before deployment.

## Best Practices

- Validate rules and model thresholds on time-separated data before production rollout.
- Combine deterministic rules, model scores, lists, and human review with explicit decision precedence.
- Release controls gradually and monitor fraud capture, customer impact, review volume, latency, and drift.

## Anti Patterns

- Do not execute untrusted rule expressions with eval or another general-purpose interpreter.
- Do not optimize only for fraud capture while ignoring false positives, review capacity, and customer impact.
- Do not use future information, random temporal splits, or post-decision fields during validation.

## Security Audit

- Audited at: 2026-07-23T23:57:16.704\+00:00
- Summary: The Python rule-engine example performs dynamic evaluation of rule text and is a confirmed code-execution risk. The 21 command alerts, two reconnaissance alerts, and entropy alert are false positives caused by Markdown fences, graph variables, and multilingual text. Two additional control-quality defects could hide rule failures or misstate backtest performance.

## Stats

- Views: 1
- Downloads: 4
- Favorites: 0
- Popularity score: 0