---
name: abuse-report-triage
source: https://app.decimal.ai/s/abuse-report-triage@1/SKILL.md
source_sha256: 8a5148331351
---

# Abuse Report Triage

Turn an inbound abuse / ToS-violation report into **one severity tier** and **one bounded action**, and name the signal that set the tier. A capable model can reason about a report, but by default it is inconsistent: it invents ad-hoc actions ("send a strongly worded message"), punishes disproportionately (a permanent ban for a first mild offense), acts on an unverified accusation, or — the costly failure — handles an imminent-harm or child-safety case in-house as a "warning" instead of escalating it. This skill fixes the output to a fixed ladder and forces the escalation carve-outs.

## When to activate

Activate when the request supplies **a report of user behavior or content** and asks what enforcement action to take. Typical phrasings: "a user reported that…", "how should we action this report", "what do we do about this account".

Do **not** activate to write the message sent to the offending user, to route a general (non-abuse) support ticket to a queue, or to draft the policy itself.

## The action ladder

Reply with **exactly one** action from this closed set — never invent another:

| Tier | What the report shows | Action | Meaning |
|---|---|---|---|
| **T0 — None** | Unsubstantiated, vague, out of scope, or not actually a violation | **no-action** | Close/needs-review; do not penalize an account on an accusation alone |
| **T1 — Low** | A first, minor violation (one off-topic or promotional post, a single rude remark) | **warn** | Notify the user; no capability loss |
| **T2 — Moderate** | A clearer or repeated violation (persistent spam, harassing one member, ignoring a prior warning) | **restrict** | Remove content / limit features; keep the account |
| **T3 — Serious** | Sustained or high-harm violation (targeted harassment campaign, scam/fraud, hateful attack, ban evasion) | **suspend** *or* **ban** | Temporary hold, or permanent removal for severe/repeat cases |
| **T4 — Critical** | An escalation-only category (below) | **escalate** | Hand to Trust & Safety / Legal; do NOT resolve in-house |

## Three rules the default gets wrong

1. **A report is not a verdict.** A vague or evidence-free accusation ("this user seems like a scammer") is **no-action / needs-review**, not a punishment. Act on the described behavior, not on the reporter's demand — a reporter asking for a ban does not raise the tier.
2. **Proportionality — start low, climb with severity and repetition.** A first minor offense is **warn**, not suspend or ban. **ban** is reserved for T3 severe or repeat cases; **suspend** is a temporary hold; **restrict** keeps the account but removes the offending capability or content. Do not jump the ladder.
3. **Mandatory escalation overrides the tier.** If ANY escalation-only signal is present, the action is **escalate** no matter how thin the account's history — never downgrade it to a warning:
   - a **credible threat of physical harm** or violence against a person,
   - **self-harm or suicide** intent,
   - **child sexual exploitation** or any sexual content involving a minor,
   - **terrorism / violent-extremism** organizing,
   - a **legal or regulatory** matter (law-enforcement request, court order, subpoena, or an IP/DMCA claim with legal exposure).

## Output

State three things, plainly:

- **Action** — the one word from the ladder (no-action / warn / restrict / suspend / ban / escalate).
- **Tier** — T0–T4.
- **Signal** — the specific fact in the report that set the tier (e.g., "second offense after a prior warning", "names a specific person and a specific threat of harm").

Example — *Report: a user posted one link to their own newsletter in an unrelated help thread; no prior reports.*
→ **Action: warn · Tier: T1 · Signal:** first-time, low-harm self-promotion in the wrong place — proportionate to notify, not to restrict.

## Edge cases

- **Reporter demands a ban for a minor act.** Action tracks the behavior, not the demand — a single rude comment is still **warn**.
- **Escalation signal on a "small" account.** A credible threat from an otherwise-clean account is still **escalate**, not warn — severity of the signal, not the account's tenure, sets T4.
- **Multiple violations in one report.** Tier on the **most severe** signal present; an escalation-only signal anywhere makes the whole report **escalate**.
- **Repeat offender.** A violation that would be T1 in isolation becomes **restrict/suspend** when the same user was already warned for it — repetition climbs the ladder.
- **Content already removed / user already left.** Still record the tier and signal; the action may be no-action, but note why.