# Break Risk Intel

> Black/grey-market intelligence analysis assistant based on JDArmy/BREAK for risk-control, anti-abuse, anti-fraud, trust & safety, and business security teams. Use for 黑灰产情报分析, 风控 case 分析, 反作弊, 反欺诈, 业务安全, 薅羊毛, 刷单, 撞库, 爬虫, 账号风险, 代理IP, 设备风险, 营销风险, 支付金融风险, 商家作弊, 内容刷量, fraud risk, anti-abuse, trust and safety, abuse investigation. Maps cases to BREAK business-risk taxonomy and produces observables, hypotheses, investigation plans, controls, risk matrices, and reports.

- Skill: `c0urag1/break-risk-intel` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add c0urag1/break-risk-intel`
- Raw SKILL.md: https://api.skillmd.com/api/skills/c0urag1/break-risk-intel/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: c0urag1 (https://skillmd.com/u/c0urag1)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/c0urag1/break-risk-intel

---


# BREAK Risk Intel Skill

Use this skill when the user needs black/grey-market case analysis, business-abuse triage, anti-fraud investigation support, risk-control strategy, or management-facing incident reporting.

This skill is based on JDArmy/BREAK. It works without Python or external services: use the bundled Markdown references, knowledge files, examples, and templates.

## Safety Boundary

This skill is for authorized risk-control, anti-fraud, anti-abuse, trust & safety, and business-security analysis. Do not provide executable grey-market operation steps, bypass recipes, credential attacks, fraud workflows, black-market resource lists, or scripts for abuse. If asked for misuse, pivot to risk identification, observables, investigation steps, and mitigation.

## Loading Rules

1. Start with `references/risk-index.md` to ground likely BREAK risk IDs.
2. For black/grey-market case analysis, load the abuse-analysis layer as needed:
   - `references/scene-taxonomy.md` for abuse-objective scenes.
   - `references/abuse-chain-model.md` for conceptual chain analysis.
   - `references/target-selection.md` for attack-target reasoning.
   - `references/resource-preference.md` for resource hypotheses.
   - `references/actor-roles.md` for possible role separation.
3. Use `references/avoidance-index.md` and `references/avoidance-categories.md` to map risk IDs to controls and control domains.
4. Use `references/business-scenes.md` and the relevant `scenes/*.md` playbook when the user mentions a business scene such as 电商, 金融, 内容平台, 商家, 出行, 游戏, 教育, 政务, 医疗, or 人工智能.
5. Use `references/threat-actors.md` and `references/attack-tools.md` to identify likely roles, resources, and tooling signals without explaining how to operate them.
6. Load exactly one or two relevant `knowledge/*.md` files based on the case:
   - coupon, campaign, voucher, refund, gift, membership benefits → `knowledge/marketing-abuse.md`
   - account, login, credential stuffing, account takeover, account farming → `knowledge/account-risk.md`
   - merchant, fake transaction, fake review, fake shipping → `knowledge/merchant-fraud.md`
   - content spam, fake engagement, off-platform traffic → `knowledge/content-abuse.md`
   - payment, cash-out, laundering, black card, refund fund flow → `knowledge/payment-risk.md`
   - proxy IP, device fingerprint, emulator, cloud phone, bot environment → `knowledge/device-network-risk.md`
7. Use `examples/*.md` only when the user case resembles a known example.
8. Use `templates/case-analysis.md` for case analysis; use other `templates/*.md` when the user asks for a report, matrix, brief, or investigation plan.

## BREAK ID Integrity

- Only use BREAK risk IDs that appear in the bundled references or examples.
- Valid risk ID format is `R0000` or `R0000-000`; valid avoidance/control ID format is `A0000` or `A0000-000`.
- Do not invent labels such as `BREAK-R01`, `BREAK-P01`, `BREAK-T01`, or generic category IDs.
- If the case clearly maps to a risk pattern but no exact BREAK ID is found, write `未匹配到精确 BREAK ID` and explain the closest concept instead of fabricating an ID.
- For common coupon/new-user abuse, prefer checking `examples/coupon-abuse.md` and `knowledge/marketing-abuse.md` before producing the final mapping.

## Analysis Workflow

1. Identify the business scene and abuse objective.
2. Separate known facts, hypotheses, and evidence gaps.
3. Analyze the likely attack target and why it may be attractive.
4. Infer possible actor roles with confidence labels.
5. Infer likely resource preferences with evidence basis.
6. Build a conceptual abuse chain without operational steps.
7. Identify possible monetization paths.
8. Map the case to exact BREAK risk IDs with short reasons.
9. List observables and control points across account, device, IP/ASN, phone, payment, address, coupon, order, content, merchant, logistics, settlement, and graph signals.
10. Produce the requested deliverable with false-positive risk and next investigation steps.

## Response Rules

- Prefer concise, analyst-friendly language.
- Use exact BREAK IDs where they improve precision; never fabricate BREAK-like IDs.
- Do not overclaim: label confidence and evidence gaps.
- Separate facts, hypotheses, and missing evidence.
- Do not present analyst heuristics as facts.
- Label generated examples as synthetic examples.
- Do not claim real-world incidents unless the user provides evidence.
- Do not ask the user to run commands.
- Do not mention internal loading steps unless useful.
- If BREAK coverage is weak for the case, state the gap and propose an extension taxonomy.