Skill: newageinvestments25-byte/isp-throttle-detective (version 1.0.0)

--- name: isp-throttle-detective description: Run speed tests to multiple endpoints, log results, and detect ISP throttling patterns. Use when the user mentions speed test, internet slow, ISP throttling, bandwidth test, is my ISP throttling, speed history, internet speed, slow at night, or peak-hour slowdowns. Measures download speed from Cloudflare, Google, and CDN endpoints plus upload, logs with timestamps and time-of-day context, and generates evidence reports (peak vs off-peak tables, CDN discrimination analysis, trend charts) suitable for ISP complaints or plan upgrade decisions. --- # ISP Throttle Detective Scripts live in `scripts/`. Log and config default to `~/.isp-throttle-detective/`. See `references/setup-guide.md` for full setup, scheduling, and interpretation guidance. ## Workflow ### Run a single test and log it ```bash python3 scripts/speedtest.py | python3 scripts/log_result.py ``` ### Analyze patterns (needs ≥5 tests across multiple hours/days) ```bash python3 scripts/analyze.py python3 scripts/analyze.py --days 30 --json # machine-readable ``` ### Generate evidence report ```bash python3 scripts/report.py --days 30 --out ~/report.md ``` ## Scripts | Script | Purpose | |--------|---------| | `speedtest.py` | Download from 3 endpoints + upload to Cloudflare. Outputs JSON to stdout. | | `log_result.py` | Append speedtest JSON to JSONL log with hour, day_of_week enrichment. | | `analyze.py` | Detect peak vs off-peak, CDN discrimination, trend, anomalies. | | `report.py` | Generate markdown evidence report with tables and plain-English conclusion. | ## Configuration Copy `assets/config.example.json` to `~/.isp-throttle-detective/config.json`. All scripts auto-detect it. Key fields: - `log_file` — where the JSONL log lives - `endpoints` — add/remove test targets; set `category: "cdn"` vs `"general"` to enable CDN discrimination detection - `peak_hours` — list of hours (0–23) considered peak Pass `--config /path/to/config.json` to any script to override. ## Scheduling See `references/setup-guide.md` for launchd (macOS) and cron (Linux) snippets. Recommended: every 30 minutes for meaningful data within a day or two. ## Throttling Signals - Peak-hour drop **>20%** vs off-peak → time-based throttling - CDN speed **<75%** of general internet → destination-based throttling - Declining trend slope → infrastructure degradation - Multiple low-speed anomalies at the same hour → systematic, not random ## Using the Evidence Report `report.py` produces a markdown file with a peak/off-peak comparison table, per-endpoint breakdown, hourly chart, trend analysis, and a plain-English conclusion. Share it directly with ISP support or use it to evaluate whether upgrading your plan would actually help (if CDN throttling is confirmed, a faster plan won't fix it).

path: assets/config.example.json
content: {
  "_comment": "Copy to ~/.isp-throttle-detective/config.json and customize",

  "log_file": "~/.isp-throttle-detective/speed_log.jsonl",

  "timeout_seconds": 30,
  "upload_timeout_seconds": 20,
  "max_download_bytes": 25000000,

  "peak_hours": [18, 19, 20, 21, 22, 23, 0],

  "endpoints": {
    "cloudflare": {
      "url": "https://speed.cloudflare.com/__down?bytes=25000000",
      "label": "Cloudflare",
      "category": "general",
      "_comment": "Dedicated speed test endpoint — most reliable baseline"
    },
    "fastly_npm": {
      "url": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
      "label": "Fastly CDN (npm registry)",
      "category": "cdn",
      "_comment": "Tests Fastly CDN network — used by many streaming/media companies"
    },
    "github_releases": {
      "url": "https://github.com/git/git/archive/refs/tags/v2.44.0.tar.gz",
      "label": "GitHub Releases (Fastly)",
      "category": "cdn",
      "_comment": "GitHub release downloads also go through Fastly"
    },
    "cloudfront": {
      "url": "https://d1vvhvl2y92vvt.cloudfront.net/awscli-exe-linux-x86_64.zip",
      "label": "AWS CloudFront CDN",
      "category": "cdn",
      "_comment": "Optional: tests CloudFront separately — verify URL is accessible first"
    }
  }
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)