# Campaign Identification > Orchestrates a full campaign investigation from a set of seed entities. Expands from seeds to full campaign scope using available investigation skills, applies multi-signal confirmation, and produces a structured campaign summary. - **Type:** Skill - **Install:** `agentstack add skill-starxedsteph-agent-skills-investigations-campaign-identification` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [starxedsteph](https://agentstack.voostack.com/s/starxedsteph) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [starxedsteph](https://github.com/starxedsteph) - **Source:** https://github.com/starxedsteph/agent-skills-investigations/tree/main/skills/campaign-identification - **Website:** https://starxedsteph.github.io/agent-skills-investigations/ ## Install ```sh agentstack add skill-starxedsteph-agent-skills-investigations-campaign-identification ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Campaign Identification ## Purpose Given a set of seed accounts or entities suspected of coordinated abuse, identify the full campaign: who else is part of it, what signals connect them, and how confident we are in the scope. This skill orchestrates across investigation skills (e.g., `investigation-signup`, `investigation-billing`, `investigation-seo-spam`). Load whichever are available and relevant to the abuse type you're investigating. --- ## Methodology ### Guiding principles - **Prefer actionable over complete.** A cluster of 500 accounts you're 95% confident in is more useful than 2,000 accounts at 60% confidence. Stop before the signal gets noisy. - **Require ≥ 2 independent signals.** One shared signal is a hypothesis. Two independent signals is a campaign. Don't call it a campaign on one signal alone. The signals must be genuinely independent — two views of the same underlying fact don't count — and at least one should be discriminating rather than a trait shared by large numbers of legitimate users. - **Split before you force.** If your seeds don't all share the same signals, you probably have two campaigns, not one. It's better to report two internally consistent clusters than one cluster held together by a signal that only half the accounts actually share. - **Surface the unexpected.** Follow every thread, not just the most obvious one. If an additional pattern appears during expansion — a second content template, a shared infrastructure signal you didn't start with — note it and investigate. --- ## Step 1 — Understand the seeds Before expanding, pull the signals present across the seed accounts: - Registration signals: creation timestamp, IP or network fingerprint, email provider, proxy/VPN indicators, device fingerprint if available - Behavioral signals: timing patterns, content created, actions taken within first N hours of account creation - Content signals: templated content, shared URLs, shared anchor text, referral patterns Note which signals are present across all seeds vs. a subset. The strongest signals are those present across 80%+ of seeds. --- ## Step 2 — Identify expansion signals From the signals present in the seeds, select 1–2 to expand on first. Criteria for a good expansion signal: - Present across ≥ 80% of seeds - Specific enough to be meaningful (a shared JA4 fingerprint, a tight creation window, a specific content template — not just "has an email address") - Not a platform-wide behavior (a fingerprint used by millions of legitimate users is not an expansion signal) Name each signal configuration as you identify it (C1, C2, etc.) if multiple distinct configurations emerge. --- ## Step 3 — Expand For each expansion signal: 1. Query for all entities matching that signal within a relevant time window 2. Record the count before filtering to the investigation window 3. Apply any necessary filters (exclude known-legitimate patterns — see below) 4. Cross-reference with a second signal to confirm overlap **Stopping criteria — stop expanding when:** - The next expansion step adds **Express the campaign as signals, not as a list of IDs.** A signal-based > description — a shared fingerprint, a tight creation window, a specific content > template — can be re-run, audited, and understood by a teammate. An opaque list > of account IDs can't be verified or re-checked as the campaign evolves. If you > provide identifiers for immediate actioning, include them *alongside* the signal > definition, never instead of it. --- ## Patterns that look like abuse but often aren't These are common sources of false positives. Do not use them as expansion signals without additional corroboration: - **Privacy relay / Hide My Email services** (e.g., iCloud's privaterelay.appleid.com, Firefox Relay, Apple's Hide My Email) — these produce shared email domain patterns for millions of legitimate users - **Corporate proxy pools** — many legitimate enterprise users share egress IPs through proxied corporate networks - **VPN services** — widespread among legitimate users; VPN IP ≠ abuse - **Mobile carrier NAT** — multiple users behind a single IP via carrier-grade NAT - **Automated browser fingerprints** — headless browser fingerprints can match legitimate users running accessibility tools or automation for legitimate purposes When a potential signal is flagged for one of the above, require a second independent signal before including it in the expansion. --- ## What to load When this skill is activated, also load any `investigation-*` skills available that are relevant to the abuse type described by the user. These skills carry your environment's table documentation, column gotchas, and query patterns. If no investigation skills are available, proceed with the methodology above and ask the user to provide the relevant tables and signals. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [starxedsteph](https://github.com/starxedsteph) - **Source:** [starxedsteph/agent-skills-investigations](https://github.com/starxedsteph/agent-skills-investigations) - **License:** MIT - **Homepage:** https://starxedsteph.github.io/agent-skills-investigations/ Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-starxedsteph-agent-skills-investigations-campaign-identification - Seller: https://agentstack.voostack.com/s/starxedsteph - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.