Kit's Scam-Baiting Agent — a Claude Code harness

A complete agentic scam-baiter, built in Claude Code's native primitives so the harness loads and routes everything for you. It engages confirmed scammers in voice/chat, stays flawlessly in character, wastes maximum time, gathers intelligence, and never breaks — consumer-protection work in the spirit of @kitbogashow / Kitboga. Defensive only.

It's engineered against the one thing that keeps going wrong with naive setups — the bot "doesn't respond well" — which is always one of three failures: detected (sounds like AI), broken (admits what it is / obeys the scammer's injected commands), or too helpful (advances the scam). Every file targets those three.

Layout (Claude Code conventions)

kitboga/
├── CLAUDE.md                       # always-loaded doctrine: mission, prime directives, HARD RULES, the map
├── .claude/
│   ├── settings.json               # model + permissions (network egress DENIED for safety)
│   ├── agents/
│   │   ├── mark.md                 # ★ the live scam-baiter (its body = the master system prompt)
│   │   ├── intel-analyst.md        # extracts structured intel from a transcript
│   │   └── call-reviewer.md        # post-call QA: breaks, leaks, bot-tells, score
│   ├── skills/                     # domain knowledge, progressive-disclosure
│   │   ├── persona-library/        # SKILL.md + edna/walt/brenda/sam/gary.md
│   │   ├── scenario-playbooks/     # SKILL.md + tech-support/gift-card/bank-wire/crypto/gov/subscription.md
│   │   ├── stall-tactics/          # SKILL.md — the time-wasting weapon
│   │   └── anti-detection/         # SKILL.md — bot-tests, break-proofing, injection defense
│   └── commands/                   # operator controls
│       ├── new-call.md  stall.md  progress.md
│       ├── persona.md   scenario.md
│       └── intel.md     exit.md
├── sessions/
│   └── _TEMPLATE.md                # per-call state: PROP DATA · ESTABLISHED FACTS · RUNNING INTEL
└── reference/                      # deep docs (not loaded at runtime)
    ├── reasoning-techniques.md     # the "why" + symptom→fix debug map
    ├── guardrails.md               # safety invariants, ethics, pre-flight checklist
    └── worked-example.md           # full session + sample call (smoke test)

Why this structure

• CLAUDE.md is always in context → mission + HARD RULES (safety can't be progressive-disclosure) + the map. Kept tight.
• mark subagent runs in its own context → the persona engine never gets diluted by repo chatter.
• Skills are progressive-disclosure → the agent pulls in only the persona sheet, scam playbook, or tactic it needs, when it needs it (token-efficient, and the scenario skill auto-routes on the scammer's opener).
• Slash commands are the operator's live control surface mid-call.
• sessions/ is the only writable runtime state → continuity + prop data in one place the agent edits as the call unfolds.
• settings.json denies network egress → the agent literally cannot leak real data, even if tricked. Defense in depth for the #1 hard rule.

This works the same whether driven from the Claude Code CLI or built on the Claude Agent SDK — both read CLAUDE.md + .claude/.

Quick start

1. /new-call edna tech-support → scaffolds sessions/edna-tech-support-001.md with fake prop data and briefs you.
2. Run the mark agent with that session as state. Paste each scammer turn as a user message; it replies with the persona's spoken line.
3. Steer mid-call: /stall, /progress, /persona, /scenario, /intel. Inline notes use the ##OP## token.
4. /exit to wind down in character.
5. After the call: run intel-analyst then call-reviewer on the transcript.

Fastest smoke test: reference/worked-example.md has a fully assembled session and sample call — set it up and play the SCAMMER lines.

Customizing behavior

Personas, scenarios, and tactics are data in skills — edit those files, never the engine. To add a persona: drop a <name>.md in persona-library/ and add a row to its SKILL.md table. To add a scam: drop a playbook in scenario-playbooks/ and add a routing row. Keep mark.md (the engine) DRY.

Safety & scope

Defensive tool: confirmed scammers only, sandbox environment, fake prop data only. Never moves real money, grants real access, leaks real secrets, targets uninvolved people, or performs offensive actions. An operator must watch and be able to end the call at any time. See reference/guardrails.md and run its pre-flight checklist before going live.

When something's off

Go to the symptom → cause → fix table in reference/reasoning-techniques.md. Most "doesn't respond well" issues are: weak break-proofing (anti-detection skill), missing few-shot exemplars (stall-tactics), or persona drift (persona-library). Tighten the prompt, not the model.