fraud-detection

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Fraud Detection — claims screening → cited investigation

欺诈检测 — 理赔筛查 → 带引用依据的调查

Screens a Medicare/Medicaid claims corpus against the public rulebook (NCCI MUE, OIG LEIE, CMS enrollment, PFS) and produces ranked, fully-cited investigation referrals for an SIU. The skill orchestrates a three-tier investigation: a deterministic floor does the detection, the model judges and narrates on top, and every dollar/rule allegation traces back to the floor.

针对公共规则手册（NCCI MUE、OIG LEIE、CMS注册信息、PFS）筛查医保（Medicare/Medicaid）理赔数据集，为SIU生成带排名且完整引用依据的调查转介。该技能编排三层调查流程：确定性底层负责检测，模型在其之上进行判断和叙述，每一项涉及金额/规则的指控都可追溯到底层检测结果。

Output framing

输出表述规范

"Indicators consistent with [scheme]," not "fraud." A pattern match doesn't establish intent — that's a downstream investigative/legal determination. This is standard SIU language and the framing the renderers use.
Render for review. The skill writes packets to
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/out/
```
; the payer's SIU workflow decides what to do with them. The model does not send/publish on its own.

使用「与[欺诈模式]相符的指标」而非「欺诈」。模式匹配无法证明主观意图——这是后续调查/法律环节的判定内容。这是SIU的标准表述方式，也是输出渲染器采用的框架。
为审核而生成。该技能会将数据包写入
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/out/
```
；支付方的SIU工作流将决定如何处理这些数据包。模型不会自行发送/发布内容。

Inputs

输入项

The payer's claims in
```
corpus.duckdb
```
(canonical 6-table schema:
```
claims-schema.sql
```
). Getting this is step 1 below — without it nothing else matters.
Quarter (the NCCI/PFS rule set to cite against, e.g.
```
2026q3
```
).
Line of business (
```
medicare
```
/
```
medicaid
```
).

支付方的理赔数据，存储于
```
corpus.duckdb
```
（标准6表结构：
```
claims-schema.sql
```
）。这是下方的步骤1——没有该数据，后续操作无法进行。
季度（用于引用的NCCI/PFS规则集，例如
```
2026q3
```
）。
业务线（
```
medicare
```
/
```
medicaid
```
）。

Data root

数据根目录

All fetched/generated state lives outside the plugin install path (which is wiped on upgrade) at

~/.claude/data/healthcare/fraud-detection/

— override the parent dir with

$CLAUDE_HEALTHCARE_DATA

(each skill appends its own name). Below,

data-cache/

and

out/

are subdirectories of

$CLAUDE_HEALTHCARE_DATA/fraud-detection

. Resolve it once at the start of a run:

bash

export CLAUDE_HEALTHCARE_DATA="${CLAUDE_HEALTHCARE_DATA:-$HOME/.claude/data/healthcare}"

所有获取/生成的状态数据均存储在插件安装路径之外（插件升级时该路径会被清空），具体位置为

~/.claude/data/healthcare/fraud-detection/

——可通过

$CLAUDE_HEALTHCARE_DATA

覆盖父目录（每个技能会追加自身名称）。下方的

data-cache/

和

out/

是

$CLAUDE_HEALTHCARE_DATA/fraud-detection

的子目录。在运行开始时需先解析该路径：

bash

export CLAUDE_HEALTHCARE_DATA="${CLAUDE_HEALTHCARE_DATA:-$HOME/.claude/data/healthcare}"

Steps

操作步骤

Get the payer's claims into
corpus.duckdb
. Open with: "Where do your adjudicated claims live?" and follow
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/LOAD-CLAIMS.md
```
— it walks you and the user from "I don't know" to a populated
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/corpus.duckdb
```
. If they already have a
```
.duckdb
```
with the canonical tables (schema:
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/claims-schema.sql
```
), use it directly.
Draft the brief (corpusDb path, quarter, line of business) and confirm scope.
Seed the public reference layer (first run / new quarter only). Detectors cite against
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/reference/<quarter>/reference.duckdb
```
. If that file is missing for the requested quarter, fetch it now — this prints per-source
```
✓ name (size)
```
progress as ~34 sources land:
bash
```
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/fetch-reference.js" 2026q3
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/fetch-enrichment.js"
```
Requires
```
unzip
```
and
```
pdftotext
```
(poppler) on PATH; both ship with most distros /
```
brew install poppler
```
. Needs real network egress — if you see "Could not resolve host" for cms.gov / oig.hhs.gov, the command sandbox is blocking it; re-run with sandbox disabled. Policy PDFs (NCCI manual, MLN articles) land under
```
reference/<q>/policy/*.txt
```
for grep; everything keyed lands in
```
reference.duckdb
```
. Skip if already present. If a fetch fails or a table is missing, see
```
REFERENCE-DATA.md
```
for source URLs and recovery.
Create the run directory. Each invocation lands in its own minute-stamped directory so prior runs are preserved side-by-side. Every script honors
```
FRAUD_OUT_DIR
```
:
bash
```
export FRAUD_OUT_DIR="$CLAUDE_HEALTHCARE_DATA/fraud-detection/out/run-$(date +%Y%m%d-%H%M)"
mkdir -p "$FRAUD_OUT_DIR"
echo "$FRAUD_OUT_DIR"
```
Use the printed absolute path verbatim as
```
outDir
```
in the next step.
Run the investigation by calling the Workflow tool with:
- ```
scriptPath
```
  :
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/workflows/investigate.js
```
- ```
args
```
  :
```
{ "corpusDb": "<abs path to corpus.duckdb>", "quarter": "2026q3", "lob": "medicaid", "pluginRoot": "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection", "dataRoot": "<abs $CLAUDE_HEALTHCARE_DATA/fraud-detection>", "outDir": "<abs FRAUD_OUT_DIR from step 3>" }
```
The workflow runs three stages (see "How it works"):
- Detect — runs the deterministic sweep (
```
scripts/screen.js
```
  , zero model) →
```
$FRAUD_OUT_DIR/referrals.detect.json
```
  .
- Adjudicate — one agent per judgment-required finding (D2/D4/D7/D13) sets
```
status
```
  +
```
adjudication.reason
```
  ; mechanical detectors auto-confirm. Adjudicate may dismiss or downgrade, never add.
- Synthesize — one agent per provider writes the investigator narrative, plus novel-lead discovery with adversarial verification.
Tell the user they can watch the fan-out live with
```
/workflows
```
.
Materialize the stage snapshots + render (required — this is the reviewable deliverable). The workflow sandbox has no filesystem, so write its return to disk and let
```
apply-stages.js
```
produce the auditable spine. FRAUD_OUT_DIR
does not persist across separate Bash calls — re-export it (to the same absolute path you printed in step 3) at the top of every shell block that needs it: Use the Write tool to save the workflow's return JSON verbatim to
```
$FRAUD_OUT_DIR/workflow-result.json
```
(it can be 50KB+ — don't heredoc it through Bash). Then:
bash
```
export FRAUD_OUT_DIR="<abs path from step 3>"
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/apply-stages.js"
```
This writes
```
$FRAUD_OUT_DIR/referrals.adjudicated.json
```
,
```
referrals.final.json
```
,
```
referrals.json
```
(canonical, = final), and the renderer sidecars (
```
source-excerpts.json
```
,
```
providers.json
```
).
Then render the packets FIRST, then the dashboard (the dashboard only links a provider row to its packet if that packet file already exists), then the xlsx:
bash
```
export FRAUD_OUT_DIR="<abs path from step 3>"
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/render-packet.js" --all
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/render-dashboard.js"
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/render-xlsx.js"
```
→
```
$FRAUD_OUT_DIR/provider-packet-<npi>.html
```
×N,
```
index.html
```
,
```
referrals.xlsx
```
.
Show the dashboard so the user can validate it visually.
- Claude Code Desktop with the preview tool available: serve the run directory and open it in the side-pane preview —
```
npx serve "$FRAUD_OUT_DIR"
```
  (the dashboard is
```
index.html
```
  , so the root URL is the dashboard; packet links resolve as siblings).
- Otherwise (terminal CLI, no preview tool): use the OS opener on
```
$FRAUD_OUT_DIR/index.html
```
  — try in order, stop at the first that works:
  bash
```
f="$FRAUD_OUT_DIR/index.html"
open "$f" 2>/dev/null \            # macOS
  || xdg-open "$f" 2>/dev/null \   # Linux
  || wslview "$f" 2>/dev/null \    # WSL
  || powershell.exe start "$(wslpath -w "$f")" 2>/dev/null \  # WSL→Windows fallback
  || cmd.exe /c start "" "$f" 2>/dev/null \                   # Windows
  || echo "Could not auto-open; open manually: $f"
```
Skip this entirely in a headless/non-interactive run (eval, CI, Cowork) — just report the path. Don't fail the run if opening/serving fails.
Relay: the ranked referrals (NPI, schemes, exposure $, confidence) and total exposure from the workflow result, verbatim where it cites numbers. Surface
```
meta.disclaimer
```
if it is set. Do not add any dollar or rule the deterministic floor did not produce. End the response with the run-directory path on its own line so downstream graders/tools can locate the artifacts:
```
Run directory: <absolute $FRAUD_OUT_DIR>
```
Close the loop (optional) — see
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/PROPOSE-DETECTORS.md
```
to mine this run for new detector candidates and payer-specific adjudicate-time checks.

将支付方的理赔数据导入
corpus.duckdb
。可询问用户：「您的已裁决理赔数据存储在哪里？」，并按照
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/LOAD-CLAIMS.md
```
中的指引操作——该文档会引导您和用户从「不清楚存储位置」到完成
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/corpus.duckdb
```
的数据填充。如果用户已拥有包含标准表的
```
.duckdb
```
文件（结构：
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/claims-schema.sql
```
），可直接使用该文件。
起草简要说明（包含corpusDb路径、季度、业务线）并确认范围。
初始化公共参考层（仅首次运行或新季度时执行）。检测工具会引用
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/reference/<quarter>/reference.duckdb
```
中的数据。如果请求季度对应的文件不存在，需立即获取——获取过程会显示每个数据源的
```
✓ 名称 (大小)
```
进度，共涉及约34个数据源：
bash
```
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/fetch-reference.js" 2026q3
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/fetch-enrichment.js"
```
要求系统PATH中包含
```
unzip
```
和
```
pdftotext
```
（来自poppler）；大多数发行版自带这些工具，也可通过
```
brew install poppler
```
安装。需要真实网络出口——如果出现「Could not resolve host」错误（针对cms.gov / oig.hhs.gov），说明命令沙箱阻止了网络访问；需禁用沙箱后重新运行。政策PDF文件（NCCI手册、MLN文章）会保存到
```
reference/<q>/policy/*.txt
```
用于grep检索；所有关键数据会存入
```
reference.duckdb
```
。如果文件已存在则跳过此步骤。如果获取失败或缺少表，请查看
```
REFERENCE-DATA.md
```
中的源URL和恢复方法。
创建运行目录。每次调用都会生成一个带时间戳（精确到分钟）的独立目录，以便保留之前的运行结果。所有脚本都支持
```
FRAUD_OUT_DIR
```
环境变量：
bash
```
export FRAUD_OUT_DIR="$CLAUDE_HEALTHCARE_DATA/fraud-detection/out/run-$(date +%Y%m%d-%H%M)"
mkdir -p "$FRAUD_OUT_DIR"
echo "$FRAUD_OUT_DIR"
```
将打印的绝对路径直接用作下一步中的
```
outDir
```
。
执行调查，调用Workflow工具并传入：
- ```
scriptPath
```
  :
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/workflows/investigate.js
```
- ```
args
```
  :
```
{ "corpusDb": "<corpus.duckdb的绝对路径>", "quarter": "2026q3", "lob": "medicaid", "pluginRoot": "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection", "dataRoot": "<$CLAUDE_HEALTHCARE_DATA/fraud-detection的绝对路径>", "outDir": "<步骤3中获取的FRAUD_OUT_DIR绝对路径>" }
```
工作流会运行三个阶段（详见「工作原理」）：
- 检测 — 执行确定性扫描（
```
scripts/screen.js
```
  ，无模型调用）→ 生成
```
$FRAUD_OUT_DIR/referrals.detect.json
```
  。
- 裁决 — 每个需要判断的发现（D2/D4/D7/D13）由一个Agent设置
```
status
```
  +
```
adjudication.reason
```
  ；机械检测结果会自动确认。裁决阶段可驳回或降级发现，但不会新增发现。
- 合成 — 每个供应商对应一个Agent，撰写调查人员叙事内容，同时通过对抗性验证发现新线索。
告知用户可通过
```
/workflows
```
实时查看任务分发情况。
生成阶段快照并渲染（必填项——这是可用于审核的交付成果）。工作流沙箱没有文件系统，因此需将其返回结果写入磁盘，再通过
```
apply-stages.js
```
生成可审计的核心数据。FRAUD_OUT_DIR
不会在不同的Bash调用之间持久化——在每个需要该变量的Shell块顶部重新导出（使用步骤3中打印的相同绝对路径）：使用Write工具将工作流返回的JSON原封不动保存到
```
$FRAUD_OUT_DIR/workflow-result.json
```
（文件大小可能超过50KB——不要通过Bash heredoc方式写入）。然后执行：
bash
```
export FRAUD_OUT_DIR="<步骤3中的绝对路径>"
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/apply-stages.js"
```
该命令会生成
```
$FRAUD_OUT_DIR/referrals.adjudicated.json
```
、
```
referrals.final.json
```
、
```
referrals.json
```
（标准版本，与final一致），以及渲染器辅助文件（
```
source-excerpts.json
```
、
```
providers.json
```
）。
然后先渲染数据包，再渲染仪表盘（只有当数据包文件已存在时，仪表盘才能将供应商行链接到对应的数据包），最后生成xlsx文件：
bash
```
export FRAUD_OUT_DIR="<步骤3中的绝对路径>"
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/render-packet.js" --all
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/render-dashboard.js"
node "${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/scripts/render-xlsx.js"
```
→ 生成
```
$FRAUD_OUT_DIR/provider-packet-<npi>.html
```
（共N个）、
```
index.html
```
、
```
referrals.xlsx
```
。
展示仪表盘供用户进行视觉验证。
- Claude Code Desktop且有预览工具可用：启动服务运行该目录，并在侧边栏预览中打开——执行
```
npx serve "$FRAUD_OUT_DIR"
```
  （仪表盘为
```
index.html
```
  ，因此根URL即为仪表盘；数据包链接会作为同级文件解析）。
- 其他情况（终端CLI、无预览工具）：使用系统打开器打开
```
$FRAUD_OUT_DIR/index.html
```
  ——按以下顺序尝试，直到找到可行的方式：
  bash
```
f="$FRAUD_OUT_DIR/index.html"
open "$f" 2>/dev/null \            # macOS
  || xdg-open "$f" 2>/dev/null \   # Linux
  || wslview "$f" 2>/dev/null \    # WSL
  || powershell.exe start "$(wslpath -w "$f")" 2>/dev/null \  # WSL→Windows备用方案
  || cmd.exe /c start "" "$f" 2>/dev/null \                   # Windows
  || echo "Could not auto-open; open manually: $f"
```
在无头/非交互式运行（评估、CI、Cowork）中可完全跳过此步骤——仅报告路径即可。如果打开/服务失败，不要终止运行。
传递结果：从工作流结果中直接提取带排名的转介信息（NPI、欺诈模式、风险金额、置信度）和总风险金额。如果设置了
```
meta.disclaimer
```
，需一并展示。不得添加任何确定性底层未生成的金额或规则信息。在响应末尾单独一行显示运行目录路径，以便后续评分工具/系统定位产物：
```
运行目录：<FRAUD_OUT_DIR的绝对路径>
```
闭环优化（可选）——查看
```
${CLAUDE_PLUGIN_ROOT}/skills/fraud-detection/PROPOSE-DETECTORS.md
```
，从本次运行中挖掘新的检测工具候选方案和支付方特定的裁决阶段检查项。

The inviolable line

不可逾越的边界

The model adjudicates, explores, and narrates freely, but any dollar or rule allegation must trace to a detect-stage deterministic recompute (the gate in

scripts/gate.js

). Adjudicate may dismiss or downgrade a finding (with an auditable reason) — it never adds one or changes its dollars. Synthesize narratives are separate, clearly-marked model output and never introduce a number the floor did not compute.

模型可自由进行裁决、探索和叙述，但任何涉及金额或规则的指控必须可追溯到检测阶段的确定性重新计算结果（由

scripts/gate.js

中的校验门控制）。裁决阶段可驳回或降级发现（需提供可审计的理由）——但不得新增发现或修改涉及的金额。合成的叙事内容是独立的、明确标记的模型输出，不得引入任何底层未计算的数值。

Enrichment — local cached data (canonical), MCPs for interactive only

数据增强 — 本地缓存数据（标准），仅交互场景使用MCP

The deterministic pipeline reads enrichment from local cached files (

scripts/fetch-enrichment.js

→

$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/enrichment/

, loaded via

scripts/enrichment.js

) — no runtime auth, no drift, fully reproducible. The healthcare plugin's bundled MCP servers (CMS Coverage / ICD-10 / NPI Registry) are for interactive adjudicate/synthesize exploration only; the pipeline does not depend on them.

ICD-10-CM — code validity / description (NLM Clinical Tables)
CMS Coverage (LCD/NCD) — medical-necessity policy index; cached, feeds D4 adjudication
NPI Registry — provider taxonomy/status

确定性流水线从本地缓存文件读取增强数据（

scripts/fetch-enrichment.js

→

$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/enrichment/

，通过

scripts/enrichment.js

加载）——无需运行时授权，无数据漂移，完全可复现。医疗插件附带的MCP服务器（CMS覆盖范围/ICD-10/NPI注册信息）仅用于交互式裁决/合成探索；流水线不依赖这些服务器。

ICD-10-CM — 代码有效性/描述（来自NLM临床表格）
CMS覆盖范围（LCD/NCD） — 医疗必要性政策索引；已缓存，为D4裁决阶段提供数据
NPI注册信息 — 供应商分类/状态

How it works (plugin layout)

工作原理（插件架构）

Entry skill — this file; orchestrates the workflow, never does the math.
Workflow —
```
workflows/investigate.js
```
(Claude Code dynamic Workflow): Detect → Adjudicate → Synthesize.

Deterministic sweep —

scripts/screen.js <corpus.duckdb> <quarter> <lob>

runs all detectors and writes

$FRAUD_OUT_DIR/referrals.json

. Zero model calls.

Detectors —
```
scripts/dNN-*.js
```
(one deterministic module each, sharing the Finding shape).
Pipeline —
```
scripts/pipeline.js
```
(run → gate → roll up → rank →
```
referrals.json
```
).
Citation gate —
```
scripts/gate.js
```
(independently recomputes every cited number; uncited or non-reproducing findings are dropped — "citation-or-zero").

Reference data —

scripts/reference-data.js

loads

$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/reference/

(NCCI/MUE, LEIE, PFS, enrollment), fetched by

scripts/fetch-reference.js

, versioned by date-of-service quarter.

Enrichment —

scripts/enrichment.js

loads

$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/enrichment/

, fetched by

fetch-enrichment.js

Stage merge —

scripts/apply-stages.js

(workflow return →

referrals.adjudicated.json

.final.json

Renderers —

scripts/render-dashboard.js

(→

index.html

render-packet.js

render-xlsx.js

→

$FRAUD_OUT_DIR/

Every allegation cites a public rule with a value the gate independently recomputes, or it is dropped.

入口技能 — 本文件；负责编排工作流，不执行具体计算。
工作流 —
```
workflows/investigate.js
```
（Claude Code动态工作流）：检测 → 裁决 → 合成。

确定性扫描 —

scripts/screen.js <corpus.duckdb> <quarter> <lob>

运行所有检测工具并生成

$FRAUD_OUT_DIR/referrals.json

。无模型调用。

检测工具 —
```
scripts/dNN-*.js
```
（每个模块对应一个确定性检测逻辑，共享Finding数据结构）。
流水线 —
```
scripts/pipeline.js
```
（运行 → 校验 → 汇总 → 排名 → 生成
```
referrals.json
```
）。
引用校验门 —
```
scripts/gate.js
```
（独立重新计算每个引用的数值；未引用或无法复现的发现会被丢弃——「要么有引用，要么不保留」）。
参考数据 —
```
scripts/reference-data.js
```
加载
```
$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/reference/
```
中的数据（NCCI/MUE、LEIE、PFS、注册信息），由
```
scripts/fetch-reference.js
```
获取，按服务日期季度进行版本管理。

数据增强 —

scripts/enrichment.js

加载

$CLAUDE_HEALTHCARE_DATA/fraud-detection/data-cache/enrichment/

中的数据，由

fetch-enrichment.js

获取。

阶段合并 —

scripts/apply-stages.js

（工作流返回结果 → 生成

referrals.adjudicated.json

.final.json

）。

渲染器 —

scripts/render-dashboard.js

（生成

index.html

）、

render-packet.js

、

render-xlsx.js

→ 输出到

$FRAUD_OUT_DIR/

。

每一项指控要么引用公共规则且数值可通过校验门独立重新计算，要么会被丢弃。