Conducting Investigations

Conducting Investigations

This skill guides investigation of suspicious activity on the AT Protocol, using a structured six-phase methodology that moves from broad discovery to targeted evidence gathering and final reporting.

ClickHouse Query Delegation

All ClickHouse queries must be dispatched to Sonnet subagents. ClickHouse querying is a rote activity — formulate SQL, execute, parse — and it consumes context window space with raw data. Dispatch a subagent with the research question, receive a structured summary back. The investigator works from summaries, not raw query results. MCP tools (co-sharing, recon) can be called directly.

Phase 1: Discovery

Start from a lead — reported accounts, rule hits, or suspicious patterns observed. The goal is rapid initial assessment to decide whether deeper investigation is warranted.

Data Collection:

• Query ClickHouse for the target account's rule hit history
• Pull all hits across all rules for the past 30-90 days
• Note which rules trigger most frequently
• Check for domain or URL mentions in the flagged content
• Check account_entropy_results for bot-like flags on target accounts
• Check url_overdispersion_results for anomalous domain sharing involving target accounts
• Check quote_overdispersion_results — are this account's posts being quoted at anomalous rates?
• Check URL and quote co-sharing clusters for the target account
• Check pds_signup_anomalies for the account's PDS host
• Pull Ozone moderation history — prior labels, reports, escalations, appeals
• Fetch the AT Protocol profile record for presentation and impersonation checks

Tool Guidance:

Dispatch a Sonnet subagent for all ClickHouse queries — the task is rote and preserves the investigator's context window for analysis:

• Subagent: "Pull rule hit history for DID [X] — temporal distribution, rule types triggered, counts by rule over the past 90 days"
• Subagent: "Check accountentropyresults for DID [X] — is it flagged as bot-like? Return entropy values"
• Subagent: "Check urloverdispersionresults for DID [X] — does this account appear in sample_dids for any anomalous domains?"
• Subagent: "Check quoteoverdispersionresults for DID [X] — does this account appear as quotedauthordid with anomalous quoting rates? Also check if this DID appears in sample_dids (as a quoter in campaigns)"
• Subagent: "Check pdssignupanomalies for the PDS hosting DID [X] — any anomalous signup volume?"
• Subagent: "Check quotecosharingmembership for DID [X] — is this account part of any quote co-sharing clusters?"
• cosharing_clusters with did — Check if target accounts belong to any URL co-sharing clusters. Cluster membership is an early coordination signal.
• ozone_query_statuses with the target DID — Pull current moderation status: existing labels, review state, tags, open reports
• ozone_query_events with the target DID — Pull moderation event log: prior labelling actions, escalations, appeals, reviewer comments
• domain_check — Verify any domains mentioned in problematic content
• describe_repo (PDSX) or Slingshot getRecord — Fetch the AT Protocol profile (display name, bio, avatar) for impersonation checks

Signals to Document:

• Volume of rule hits (count and frequency)
• Temporal clustering — are hits concentrated in time windows?
• Rule patterns — which rules trigger repeatedly?
• Content red flags — domains, repeated phrases, suspicious URLs
• Account entropy flags — is the account flagged as bot-like? What are the entropy values?
• Domain overdispersion — are any domains shared by this account flagged as anomalous?
• Quote overdispersion — are this account's posts being quoted at anomalous rates (target of pile-on)?
• Co-sharing cluster membership — URL clusters and/or quote clusters? What's the cluster size and evolution type?
• Moderation history — prior labels, appeals, escalations? Repeat offender pattern?
• Profile signals — impersonation indicators, custom domain handle registration details?

Decision Point:

• Does the account show patterns worth deeper investigation?
• Are there multiple rules triggered or a single isolated hit?
• Proceed to Phase 2 (Characterization) if the pattern warrants further analysis.

---

Phase 2: Characterization

Build a comprehensive profile of the target account(s). This phase focuses on understanding the account's normal behaviour, infrastructure, and operational patterns.

Data Collection:

• Complete activity timeline from account creation to present
• Posting patterns: frequency, timing, content themes
• Infrastructure: PDS host, account creation date, registration domain (if applicable)
• Profile characteristics: avatar, display name, bio changes (from AT Protocol profile record)
• Account entropy scores — hourly and interval entropy values, bot-like classification
• Ozone moderation history — build a timeline of prior moderation actions alongside the activity timeline
• Protocol-level identity — handle history, PDS migrations, custom domain details

Tool Guidance:

Dispatch a Sonnet subagent for ClickHouse queries:

• Subagent: "Generate a detailed activity timeline for DID [X] — posting statistics by hour/day, content themes, total volume"
• Subagent: "Get entropy scores from accountentropyresults for DID [X]. High hourlyentropy (≥ 3.9) = uniform 24-hour posting; low intervalentropy (≤ 1.5) = mechanical spacing. Both = isbotlike."
• ozone_query_events with the target DID — Integrate moderation events into the activity timeline (when were labels applied? when were appeals filed? when were labels removed?)
• describe_repo (PDSX) or Slingshot — Fetch current profile record. Check app.bsky.actor.profile/self for bio, avatar, display name. Use list_records with app.bsky.graph.follow to sample follow targets if follow-farming is suspected.
• ip_lookup — Resolve any IP addresses associated with content or metadata
• whois_lookup — Query registration details for discovered domains. Always run on custom-domain handles.

Signals to Document:

• Posting volume and temporal distribution (concentrated hours vs. 24/7 activity?)
• Content themes and language patterns
• Account age relative to activity intensity
• Infrastructure patterns (shared PDS, content delivery patterns)
• Entropy profile — does the account's temporal signature look automated? Compare raw values against thresholds.
• Moderation timeline — when were labels applied/removed? Is there a pattern of offence → label → appeal → re-offence?
• Profile presentation — does the bio/avatar suggest impersonation? Has the display name changed to evade detection?

Decision Point:

• Is the behaviour consistent with a bot, human, or coordinated group?
• Are there indicators of deception (fake profile, mismatched metadata)?
• Does the account show sustained policy violations regardless of coordination?

Three branches:

1. Signs of coordination or anomalous multi-account behaviour → Proceed to Phase 3 (Linkage)
2. Individual account with sustained policy violations (genuine human, not coordinated, but repeatedly violating rules) → Skip to Phase 6 (Reporting) with enforcement recommendation. Coordination is not a prerequisite for action — an uncoordinated account with a pattern of policy-violating behaviour warrants labelling based on its own conduct. Use assess-account to produce a structured assessment if not already done.
3. Benign / explained / isolated one-off → Document conclusion and close investigation.

---

Phase 3: Linkage

Find connected accounts. This phase identifies other accounts exhibiting similar behaviour, content, or infrastructure characteristics.

Data Collection:

• Content similarity matching across the network
• Temporal correlation: accounts posting identical or similar content at similar times
• Infrastructure correlation: accounts sharing PDS hosts, domains, or IP patterns
• Shared bot-like entropy profiles across accounts
• Shared anomalous domain sharing patterns
• URL co-sharing cluster membership — accounts in the same cluster are sharing the same URLs on the same days
• Quote co-sharing cluster membership — accounts in the same cluster are quoting the same posts on the same days
• Quote overdispersion — are specific posts being quote-amplified by the network?
• Ozone cross-referencing — do linked accounts share moderation tags, labels, or escalation history?

Tool Guidance:

Dispatch a Sonnet subagent for ClickHouse queries:

• Subagent: "Cluster these DIDs by shared patterns — same URLs, same domains, same posting times. Use GROUP BY to find commonalities."
• Subagent: "Check accountentropyresults for DIDs [list]. Which are flagged isbotlike? Do they share similar entropy profiles?"
• Subagent: "Check urloverdispersionresults — do any of these DIDs appear together in sample_dids for the same anomalous domain?"
• Subagent: "Check quoteoverdispersionresults — are any posts by these DIDs being quoted at anomalous rates? Also check if these DIDs co-appear in sample_dids as quoters of the same target"
• Subagent: "Check quotecosharingmembership for DIDs [list] — are any of these accounts in the same quote co-sharing clusters? Return clusterids, membercounts, sample_uris"
• content_similarity — Find accounts posting the same or similar content (detects copypasta, template reuse)
• cosharing_clusters with did — Check if target accounts belong to URL co-sharing clusters. Multiple target accounts in the same cluster is strong evidence of coordination.
• cosharing_pairs with did — Drill into raw co-sharing edges to see exactly which URLs are being co-shared and with whom.
• cosharing_evolution with cluster_id — If a cluster is found, trace its history to understand when the coordination started and how the network has evolved.
• ozone_query_statuses with tags — Check if linked accounts share Ozone tags (e.g., same campaign tag applied by a prior reviewer). Shared tags from prior reviews are a strong linkage signal.

Signals to Document:

• Content overlap (exact matches vs. paraphrased)
• Timing synchronisation — do linked accounts post within minutes of each other?
• Shared infrastructure — PDS hosts, domain registrations, ASN overlap
• Account clustering — which accounts form tight groups?
• Shared automation signature — do linked accounts have similar entropy profiles?
• Domain campaign co-participation — do accounts share the same anomalous domains?
• URL co-sharing cluster membership — are accounts in the same cluster? How large is the cluster? What URLs are being pushed?
• Quote co-sharing cluster membership — are accounts coordinating quote-post campaigns? Which posts are being targeted?
• Quote overdispersion targets — are specific posts from the network (or targeting the network) being amplified at anomalous rates?
• Shared moderation history — do linked accounts carry the same Ozone tags or labels from prior reviews?

Decision Point:

• Is there evidence of coordination or are these coincidental similarities?
• Are there 2-3 accounts or a larger network?
• Proceed to Phase 4 (Amplification Mapping) if coordination is evident.

---

Phase 4: Amplification Mapping

Understand how the network's content spreads and what it targets. This phase reveals strategy and impact.

Data Collection:

• Repost chains: track how content spreads through the network
• Quote posts and replies: identify engagement patterns
• Target identification: which accounts/topics receive amplification?
• Engagement metrics: likes, reposts, replies per content
• Quote overdispersion: which specific posts are being amplified at anomalous rates?
• External domain campaigns: which URLs are being pushed and at what volume?

Tool Guidance:

Dispatch a Sonnet subagent for ClickHouse queries:

• Subagent: "Aggregate engagement patterns for these DIDs [list] — track content through reply trees, repost chains, quote posts"
• Subagent: "Query quoteoverdispersionresults for quotedauthordid IN [network DIDs]. Which posts from the network are receiving anomalous quote amplification? Return quoteduri, totalshares, uniquesharers, volumep_value"
• Subagent: "Query urloverdispersionresults for domains shared by the network. Are any domains being pushed at anomalous rates? Cross-reference sample_dids with network DIDs."
• url_expand — Resolve shortened URLs and link redirects to understand traffic targeting
• Slingshot getRecordByUri — Hydrate the most-amplified AT-URIs into full post records for content analysis
• ozone_query_statuses — Check if amplification targets have already been reported or labelled

Signals to Document:

• Most-amplified content themes
• Primary targets (accounts, topics, hashtags)
• Amplification velocity (how quickly content spreads)
• External links and traffic destinations
• Quote overdispersion hits — specific posts receiving statistically anomalous amplification
• Domain overdispersion hits — specific domains being pushed at anomalous rates by the network

Decision Point:

• What is the network's strategic objective (harassment, propaganda, viral content)?
• Is the amplification effective (significant reach)?
• Proceed to Phase 5 (Rule Validation) to assess current detection coverage.

---

Phase 5: Rule Validation

Test whether existing rules catch the identified network. This phase reveals detection gaps.

Data Collection:

• Analyse rule hit coverage across all identified accounts
• Compare rule triggers with actual problematic behaviour
• Identify patterns that should trigger rules but don't

Tool Guidance:

Dispatch a Sonnet subagent for ClickHouse queries:

• Subagent: "Aggregate rule hits for DIDs [list] by account and rule type. Compare hit distribution before and after [date] to assess detection coverage."

Signals to Document:

• Rules that catch the network (coverage percentage)
• Rules that miss the network (gaps)
• Behaviour patterns that evade detection
• Suggested rule improvements or new rules needed

Decision Point:

• Is the network adequately covered by existing rules?
• Are there actionable gaps that require new rules?
• Proceed to Phase 6 (Reporting) with findings.

---

Phase 6: Reporting

Synthesise all findings into a structured, actionable report. This phase produces the final artefact.

Actions:

• Select appropriate report type (memo, cluster deep-dive, cross-cluster, rule check)
• Structure findings using the BLIND format (see reporting-results skill)
• Apply labels via ozone_label if the investigation warrants enforcement action
• Apply tags via ozone_tag to link accounts to the investigation (e.g., campaign name tags)
• Add investigator notes via ozone_comment for accounts that need ongoing monitoring
• Store the report in the investigation directory using the naming convention

Tool Guidance:

• Consult reporting-results skill for formatting requirements
• ozone_label — Apply moderation labels if warranted
• ozone_tag — Tag investigated accounts with the case name for future correlation
• ozone_comment — Add context notes that future reviewers will see when the account surfaces again
• ozone_escalate — Escalate accounts that meet the escalation criteria above

Output:

• Formatted investigation report ready for review or distribution
• Supporting data files (tables, network graphs, query results)
• Ozone artefacts: labels applied, tags added, comments written, escalations filed

---

Evidence Standards

What constitutes sufficient evidence for different conclusion types:

Account Linkage:

• Single signal (e.g., one matching URL): low confidence, flag for review
• Two independent signals (e.g., content + timing): moderate confidence, actionable
• Three or more signals across different categories: high confidence, reportable

Coordination:

• Temporal clustering of identical content: strong indicator
• Shared infrastructure + content

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: skywatch-bsky
• Source: skywatch-bsky/skywatch-agent-skills
• License: MIT
• Homepage: https://bsky.app/profile/skywatch.blue

Install and usage instructions live in the source repository linked above.