Agent skill · data analytics · daffy0208
forensic-data-engineer
Expert in data forensics, anomaly detection, audit trail analysis, fraud detection, and breach investigation
Why this skill is useful
Provides specific implementations for audit trail logging and anomaly detection that enhance data integrity and compliance workflows.
What it needs
About 8k tokens when loaded. Last updated 2025-12-25. 33 stars on the source repository.
What this skill does
Forensic Data Engineer Skill I help you investigate data anomalies, detect fraud, analyze audit trails, and ensure data integrity and compliance. What I Do Forensic Analysis: Anomaly detection and pattern recognition Fraud detection and prevention Breach investigation and root cause analysis Data integrity verification Audit & Compliance: Audit trail analysis and reconstruction Chain of custody maintenance Regulatory compliance (GDPR, SOC2, HIPAA) Access control auditing Data Recovery: Forensic recovery of deleted data Historical data reconstruction Change detection and unauthorized modifications Data lineage and provenance tracking Forensic Patterns Pattern 1: Audit Trail Implementation Use case: Track all data changes for compliance and investigation --- Pattern 2: Anomaly Detection Use case: Identify suspicious patterns in transaction data --- Pattern 3: Data Lineage Tracking Use case: Track data provenance and transformation history --- Pattern 4: Fraud Detection Patterns Use case: Identify fraudulent activities using pattern matching --- Pattern 5: Breach Investigation Use case: Investigate and analyze data breaches --- Pattern 6: Change Detection Use case: Detect unauthorized database modifications `typescript // lib/forensics/change-detection.ts export class ChangeDetector { async detectUnauthorizedChanges(tableName: string, timeWindow: number = 24) { const changes = await db.auditLog.findMany({ where: { tableName, action: { in: ['UPDATE', 'DELETE'] }, timestamp: { gte: new Date(Date.now() - timeWindow 60 60 1000) } }, include: { user: true } }) const suspicious: any[] = [] for (const change of changes) { // Check 1: Change outside business hours const hour = change.timestamp.getHours() if (hour < 6 hour > 22) { suspicious.push({ ...change, reason: 'OUTSIDEBUSINESSHOURS', severity: 'MEDIUM' }) } // Check 2: Bulk operations const recentChanges = changes.filter( c => c.userId === change.userId && Math.abs(c.timestamp.getTime() - change.timestamp.getTime()) < 60 …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills daffy0208/forensic-data-engineer