What problem does it solve? Fraud and abuse teams need to find accounts that resell access to US frontier models through relay or proxy gateways, but per-request signals alone produce false positives against legitimate customers. This Skill runs an account-level dominance analysis over ClickHouse generation logs and files survivors as reversible restriction proposals instead of bans. ## Core Features & Use Cases - Account-level signal dominance detection: Flags accounts where relay user agents or Go-client-on-Chinese-cloud egress carry at least 80% of usage in the window, avoiding per-request false positives. - Short-lived vs long-lived cohort separation: Files configured-ring burners and ambiguous long-lived accounts as separate review cases with different confidence levels. - Compromised-key gate: Checks whether a harvested key replayed through a relay explains the traffic before filing, escalating for key revocation instead of restriction when it does. - Use Case: Run a 48-hour sweep over default.generations, subtract already-restricted accounts, and file the survivors as frontier_us_models proposals in Sentinel ban candidates. ## Quick Start Ask the agent to sweep the last 48 hours of traffic for proxy-shaped relay accounts and file the survivors as Sentinel ban candidates.
