skills/chatbot-analytics/SKILL.md
Implement AI chatbot analytics and conversation monitoring. Use when adding conversation metrics, tracking AI usage, measuring user engagement with chat, or building conversation dashboards. Activates for AI analytics, token tracking, conversation categorization, and chat performance.
npx skillsauth add curiositech/windags-skills chatbot-analyticsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill helps you implement analytics for the AI coaching chat feature while maintaining HIPAA compliance.
IF abandonment_rate > 40% within 24h
→ THEN escalate to admin team
→ ELSE log for trending analysis
IF crisis_escalations > 5 within 24h
→ THEN send email alert immediately
→ ELSE track for weekly review
IF error_rate > 10% within 1h
→ THEN send Slack alert
→ ELSE continue monitoring
IF token_cost > budget_threshold
→ THEN enable cost controls
→ ELSE continue tracking
IF metadata.usedCrisisProtocol == true
→ category = "crisis_support"
ELSE IF metadata.usedCopingStrategies == true
→ category = "coping_strategies"
ELSE IF metadata.usedCheckInSupport == true
→ category = "checkin_support"
ELSE IF metadata.requestedClarification == true
→ category = "clarification"
ELSE
→ category = "general_chat"
IF data_contains(PHI_indicators)
→ REJECT storage, log metadata only
ELSE IF data_is_aggregate()
→ STORE for analytics
ELSE IF data_is_metadata()
→ STORE with encryption
ELSE
→ REVIEW manually before storage
messageContent, userQuery, or specificTopicstrackConversationEnd() is called in all exit paths, add session timeout logicstarted_at, user_id, and outcome columns, implement query optimizationSetup: User reports feeling overwhelmed, AI detects crisis indicators
// 1. Start tracking conversation
await trackConversationStart('conv-789', 'user-123');
// 2. AI processes message and sets metadata flags
const aiResponse = await processMessage(userMessage);
const metadata = {
usedCrisisProtocol: true,
usedCopingStrategies: false,
requestedClarification: false
};
// 3. Expert decision: Check crisis threshold first
if (metadata.usedCrisisProtocol) {
// Set category immediately
const category = 'crisis_support';
// Track the exchange with crisis flag
await trackMessageExchange('conv-789',
{ input: 150, output: 300 },
1200, // 1.2s response time
{ hadFallback: false, hasCrisisIndicator: true }
);
}
// 4. End conversation with escalation
await trackConversationEnd('conv-789', 'crisis_escalated');
// 5. Check if alert threshold reached
const recentCrises = await countCrisisEscalations(24); // last 24h
if (recentCrises > 5) {
await sendAlert('crisis_spike', { count: recentCrises });
}
Expert catches: The crisis flag triggers immediate categorization and outcome tracking, bypassing normal conversation flow analysis.
Novice misses: Would wait until conversation end to classify, missing real-time escalation opportunity.
Do NOT use this skill for:
Delegate when:
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.