Stats
Actions
Tags
Narrative classification of co-sharing clusters on AT Protocol. Analyses cluster member content, identifies dominant narratives, coordination signals, shared sources, and likely origin. Distinguishes information operations from organic coordination. Use when a co-sharing cluster is identified during Phase 3 (Linkage) or Phase 4 (Amplification), or as a standalone cluster assessment.
How this skill is triggered — by the user, by Claude, or both
Slash command
/skywatch-investigations:classify-clusterThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill guides narrative classification of co-sharing clusters — groups of accounts identified as sharing the same URLs or quoting the same posts in coordinated patterns. The goal is to determine what the cluster is pushing, how coordinated it is, and whether the coordination is authentic (shared interest) or inauthentic (information operation).
This skill guides narrative classification of co-sharing clusters — groups of accounts identified as sharing the same URLs or quoting the same posts in coordinated patterns. The goal is to determine what the cluster is pushing, how coordinated it is, and whether the coordination is authentic (shared interest) or inauthentic (information operation).
Coordination does not equal inauthenticity. Accounts sharing URLs about a niche hobby, a local news event, or a shared professional interest will form clusters. The classification must distinguish genuine shared interest from manufactured coordination. This skill provides the framework for that distinction.
The skill accepts either:
cosharing_clusters tool output)Data collection happens in two rounds — first cluster-level metadata, then member-level content.
If cluster ID provided: Use cosharing_clusters MCP tool directly with the cluster_id to get: member DIDs, cluster size, evolution type, and cluster metrics.
If DIDs provided: Use cosharing_clusters MCP tool with each DID to check if they share a common cluster. If they do, use the cluster ID for further analysis. If not, proceed with the DID list as an ad-hoc group.
Use cosharing_evolution MCP tool with the cluster ID to get: cluster birth date, merge/split history, size over time. This reveals whether the cluster is stable, growing, or fragmenting.
Use cosharing_pairs MCP tool for each member DID (or a sample of 10 if cluster is large). This returns the actual URLs shared between account pairs — the raw evidence of what's being coordinated.
If the cluster has 1 member or fewer than 3 members:
low regardless of signal strength.Dispatch to data-analyst: "For these DIDs: [member list, or top 20 members if cluster is large], sample the 30 most recent posts per account from osprey_execution_results. Return: author DID, content, timestamp, rules matched."
Dispatch to data-analyst: "Query account_entropy_results for these DIDs: [member list]. Return: DID, hourly_entropy, interval_entropy, is_bot_like."
Dispatch to data-analyst: "For these DIDs: [member list], find the earliest post timestamp in osprey_execution_results as a proxy for account age. Return: DID, earliest_post, days_active."
Dispatch to data-analyst: "From the co-sharing pairs data, extract all unique domains/URLs shared across cluster members. Group by domain and show: domain, number of members sharing it, total share count, and whether it appears in url_overdispersion_results."
| Field | Type | Description |
|---|---|---|
dominant_narratives | list of {narrative, prevalence} | Top narratives pushed by cluster members, with % of members participating |
coordination_signals | list | Evidence of coordination beyond URL sharing (see Signal Catalogue) |
language_distribution | map | Language -> % of cluster content |
shared_sources | list of {domain, member_count, total_shares, is_anomalous} | Domains/URLs shared across members |
likely_origin | enum | io_suspected, spam_network, organic_interest, mixed, undetermined |
confidence | enum | high, medium, low |
member_roles | map | DID -> role (e.g., amplifier, content_creator, bridge_account) |
content_similarity tool)This is the critical analytical step. Apply these questions in order:
For clusters classified as IO or spam, assign roles to members:
## Cluster Classification: [cluster_id or "ad-hoc group"]
### Cluster at a Glance
| Metric | Value |
|--------|-------|
| Size | [N] members |
| Age Range | [oldest] to [newest] account |
| Language Mix | [primary language] ([%]), [secondary] ([%]) |
| Dominant Narrative | [one-line summary] |
| Classification | [likely_origin] ([confidence] confidence) |
### Dominant Narratives
| Narrative | Prevalence | Example |
|-----------|-----------|---------|
| [narrative summary] | [%] of members | "[example post excerpt]" |
### Coordination Signals
- [signal 1 — evidence]
- [signal 2 — evidence]
### Shared Sources
| Domain | Members Sharing | Total Shares | Anomalous |
|--------|----------------|-------------|-----------|
| [domain] | [n] | [n] | [yes/no] |
### Language Distribution
| Language | % |
|----------|---|
| [lang] | [%] |
### Member Roles (if IO/spam)
| Role | Count | Example DIDs |
|------|-------|-------------|
| content_creator | [n] | [DID1], [DID2] |
| amplifier | [n] | [DID1], [DID2] |
| bridge_account | [n] | [DID1] |
### Assessment
[2-3 sentence analytical summary explaining the classification, key evidence, and what distinguishes this cluster from the alternative classification (i.e., why IO and not organic, or vice versa)]
When a full report is requested, load the reporting-results skill:
Select the cell deep-dive report type for single cluster analysis.
npx claudepluginhub skywatch-bsky/claude-skills --plugin skywatch-investigationsGuides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.