feat: Add scam-shield bundle#289
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughChangesThe Scam Shield kit adds bundle metadata, scam-pattern indexing and message-triage flows, Gemini model configurations, safety rules, environment templates, and setup documentation. Scam Shield
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
:robot_face: AgentKit Structural ValidationNew Contributions Detected
Check Results
🎉 All checks passed! This contribution follows the AgentKit structure. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/scam-shield/.gitignore`:
- Around line 3-4: Update the environment ignore rules in the project’s
.gitignore to match all .env variants, including production and staging files,
while explicitly keeping .env.example trackable.
In `@kits/scam-shield/flows/index-scam-patterns.ts`:
- Around line 117-122: Update the indexing configuration around primaryKeys,
vectorsField, and metadataField so records use a stable unique record ID or
content hash as the sole primary key instead of pattern_name. Preserve
pattern_name in the metadata payload, ensuring distinct patterns with the same
name are retained rather than overwritten.
In `@kits/scam-shield/prompts/scam-message-triage_ragnode-573_system_0.md`:
- Around line 1-10: Harden the system prompt by explicitly treating both the
user message and retrieved scam patterns as untrusted data rather than
instructions, preventing prompt injection from changing the assessment. Update
the red_flags requirement to use redacted descriptions instead of reproducing
sensitive OTPs, PINs, CVVs, account numbers, or similar secrets, while
preserving the existing JSON-only response schema and scam-triage behavior.
In `@kits/scam-shield/README.md`:
- Around line 21-38: Update the README around the Step headings and fenced code
blocks to satisfy markdownlint-cli2: add blank lines where required, including
the referenced sections, mark the folder-tree code fence as text, and ensure the
file ends with exactly one newline.
- Around line 43-47: Update the setup instructions in the README before the test
curl command to explicitly load the `.env` values into the shell, using a
source/export step after copying and populating `.env`. Ensure LAMATIC_API_URL
and LAMATIC_API_KEY are available when the example request runs.
In `@kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts`:
- Around line 1-3: Update the initialization of single_name, single_content, and
batch to read values from the runtime workflow object rather than mustache
expressions. Ensure batch resolves to the actual patterns array, including when
the upstream output uses an array-like key, so the existing loop can create
vectors and metadata without throwing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a9d7edf7-f8be-413b-88de-07c43c74091d
📒 Files selected for processing (14)
kits/scam-shield/.env.examplekits/scam-shield/.gitignorekits/scam-shield/README.mdkits/scam-shield/agent.mdkits/scam-shield/constitutions/default.mdkits/scam-shield/flows/index-scam-patterns.tskits/scam-shield/flows/scam-message-triage.tskits/scam-shield/lamatic.config.tskits/scam-shield/model-configs/index-scam-patterns_vectorize-node-808_embedding-model-name.tskits/scam-shield/model-configs/scam-message-triage_ragnode-573_embedding-model-name.tskits/scam-shield/model-configs/scam-message-triage_ragnode-573_generative-model-name.tskits/scam-shield/prompts/scam-message-triage_ragnode-573_system_0.mdkits/scam-shield/prompts/scam-message-triage_ragnode-573_user_1.mdkits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts
… quarantine untrusted prompt content, clean up README
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
kits/scam-shield/README.md (1)
76-85: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDocument the runtime shape or align the flow mapping.
kit/scam-shield/flows/scam-message-triage.tsmapsmodelResponseandreferencesfromRAGNode_573.outputat lines 126 and 118–126, while this README example shows them parsed as object/array fields. Either show users the exact runtime output shape or confirm/update the flow so clients receive the documented JSON type.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/scam-shield/README.md` around lines 76 - 85, Align the Scam Shield README example with the actual output shape produced by the scam-message-triage flow, especially the modelResponse and references fields mapped from RAGNode_573.output. Either document the runtime wrapper/type returned by the flow or update the flow mapping so clients receive the object and array JSON types shown in the example.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/scam-shield/prompts/scam-message-triage_ragnode-573_system_0.md`:
- Line 14: Add a single trailing newline at the end of the prompt file to
satisfy markdownlint MD047, without changing any existing prompt text or adding
headings.
In `@kits/scam-shield/README.md`:
- Around line 39-41: Update the batch request example in the README so it is
valid JSON: replace the unquoted ellipsis with a second concrete pattern object,
preserving the existing schema and example intent.
In `@kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts`:
- Around line 1-18: Update the input initialization in the scam-pattern indexing
script to read pattern data from the workflow object using the trigger node’s
output fields, rather than quoted Mustache placeholders. Ensure the batch value
is obtained as the actual array and single_name/single_content contain the
submitted values before the processing logic and record indexing execute.
---
Outside diff comments:
In `@kits/scam-shield/README.md`:
- Around line 76-85: Align the Scam Shield README example with the actual output
shape produced by the scam-message-triage flow, especially the modelResponse and
references fields mapped from RAGNode_573.output. Either document the runtime
wrapper/type returned by the flow or update the flow mapping so clients receive
the object and array JSON types shown in the example.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 927a7c41-2ec3-4710-a27a-8a5b1b772174
📒 Files selected for processing (5)
kits/scam-shield/.gitignorekits/scam-shield/README.mdkits/scam-shield/flows/index-scam-patterns.tskits/scam-shield/prompts/scam-message-triage_ragnode-573_system_0.mdkits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts
…tor keys, quarantine untrusted prompt content, fix README examples
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts (1)
14-23: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftMission alert: use a collision-resistant primary-key digest.
stableIdproduces only a 32-bit non-cryptographic hash, butkits/scam-shield/flows/index-scam-patterns.tsusesidas the VectorDB primary key with overwrite semantics. A collision can therefore silently replace an unrelated scam pattern. Use a cryptographic digest of the canonical name/content pair, or another collision-safe deterministic identifier.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts` around lines 14 - 23, The stableId function currently uses a 32-bit non-cryptographic hash that can collide and overwrite unrelated VectorDB records. Replace its hash component with a collision-resistant cryptographic digest of the canonical name/content pair, while preserving deterministic output and the existing name-based prefix format.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts`:
- Around line 14-23: The stableId function currently uses a 32-bit
non-cryptographic hash that can collide and overwrite unrelated VectorDB
records. Replace its hash component with a collision-resistant cryptographic
digest of the canonical name/content pair, while preserving deterministic output
and the existing name-based prefix format.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4c6bcb99-2c03-4800-b11a-6b26abeae886
📒 Files selected for processing (2)
kits/scam-shield/README.mdkits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts`:
- Around line 23-26: Update stableId to build an unambiguous canonical
representation of name and content before hashing, using length or structured
encoding rather than a delimiter-only concatenation. Preserve the existing
normalized name prefix and SHA-256 digest generation, ensuring distinct field
pairs such as values containing "|" produce distinct IDs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c741d71c-ba3c-4a33-a71b-6eccaba979c6
📒 Files selected for processing (1)
kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts
|
Hi @akshatvirmani — just checking in on this PR. All checks are passing and there are no conflicts with main, so it should be ready for review whenever you get a chance. Let me know if anything needs changes. Thanks! |
1 participant
PR Checklist
kits/scam-shield/(kebab-case, unique)lamatic.config.tspresent with validtype(bundle),name,author,tags,steps,linksagent.mdpresentREADME.mdpresent, describes what the contribution does and how to use itflows/<n>.tsexists for every step inlamatic.config.ts(index-scam-patterns.ts,scam-message-triage.ts)constitutions/default.mdpresent.env.examplepresentapps/package.jsonworks withnpm install && npm run dev— N/A, bundle has noapps/links.githubinlamatic.config.tspoints tokits/scam-shieldlinks.deployhasroot-directory=kits/<n>/apps— N/A, bundle-only, no deploy link.envor.env.localcommitted — only.env.examplewith placeholders@referencepaths resolve to files that actually exist in this kitkits/scam-shield/kits/scam-shield/bundle for India-focused UPI/banking fraud triage using RAG (bundle-only; noapps/directory or deployment link).kits/scam-shield/.env.example(placeholders:LAMATIC_API_URL,LAMATIC_PROJECT_ID,LAMATIC_API_KEY)kits/scam-shield/.gitignore(ignores.lamatic/,node_modules/, and.env*except!.env.example; excludes local-onlyindex.html)kits/scam-shield/lamatic.config.ts(bundle metadata; steps:index-scam-patterns→scam-message-triage, plus GitHub link)kits/scam-shield/README.md(end-to-end workflow, safety behavior, quickstart for indexing + deploying + GraphQL triage trigger + sample response)kits/scam-shield/agent.md(agent purpose, interaction flows,scam-message-triageJSON contract, guardrails)kits/scam-shield/constitutions/default.md(hard rules: no OTP/PIN/CVV/full numbers; no exploit/bypass details; route to official reporting/verification channels)kits/scam-shield/prompts/scam-message-triage_ragnode-573_system_0.md(system prompt: JSON-only risk assessment schema; low-risk fallback when no match)kits/scam-shield/prompts/scam-message-triage_ragnode-573_user_1.md(injects{{triggerNode_1.output.message}})kits/scam-shield/model-configs/index-scam-patterns_vectorize-node-808_embedding-model-name.ts(Gemini embedding model for vectorization)kits/scam-shield/model-configs/scam-message-triage_ragnode-573_embedding-model-name.ts(Gemini embedding model for retrieval)kits/scam-shield/model-configs/scam-message-triage_ragnode-573_generative-model-name.ts(Gemini generative model for triage)kits/scam-shield/flows/index-scam-patterns.ts(index-scam-patterns)triggerNode,dynamicNode,responseNodetriggerNode_1→codeNode_948(preparesvectorData/metaData) →vectorizeNode_808→vectorNode_954(indexes toscampatterns)patterns[]or singlepattern_name+content, computes deterministic stable IDs via SHA-256 ofname|content, vectorizes/indexes with overwrite semantics, and returns{ message, recordsIndexed }.kits/scam-shield/flows/scam-message-triage.ts(scam-message-triage)triggerNode,dynamicNode,responseNodetriggerNode_1→RAGNode_573(retrieval + generative triage) →responseNode_triggerNode_1message, retrieves relevant scam patterns fromscampatterns(configured retrieval params), runs the configured system/user prompts with the generative model, and returns structured JSON (risk_score,red_flags,explanation,recommended_action,report_channel) plus references.kits/scam-shield/scripts/index-scam-patterns_code-node-948_code.ts(builds{ vectorData, metaData }from trigger inputs; supports batch or single record shapes; generates collision-resistant, deterministicidvalues).