What problem does it solve? Daily balance snapshots in the analytics mart lag by a day or more, so raw balance queries miss recent top-ups and usage. This Skill runs the same intraday balance-correction logic as the negative-balance-usage-sync cron against ClickHouse, giving an accurate, current list of accounts in the red for fraud and ban investigations. ## Core Features & Use Cases - Live balance correction: Combines the daily dim_users.outstanding_balance snapshot with post-snapshot credits and minute-level usage to compute a current balance. - Cron-matched eligibility filters: Excludes deleted users, enterprise accounts, billed-in-arrears accounts, autobuy triggers, credit pools, and accounts allowed to go negative. - Fraud investigation support: Returns clerk user ID, corrected balance, email, and signup date ranked most-negative-first, with guidance for adding ring-evidence columns like signup IP hash, JA4, and ASN. - Use Case: A Trust & Safety analyst investigating a suspected abuse ring runs the query with a -10 USD threshold to pull all accounts currently more than $10 in the hole, then cross-references shared signals before filing ban-candidate suggestions. ## Quick Start Ask the assistant to run the negative balance query with a threshold of -10 and list the top 100 overspending accounts from ClickHouse.
