detecing some automation hacks are pretty trivial as long as you have sc2gears available.what you will be looking for is impossible / improbable and unusual sequences of input. each action in a replay has a timestamp, the timestamp can be showed in seconds and in frames. to detect automation we usually need to view frames. to show frames instead of seconds uncheck the "In Seconds" radiobox.
impossible actions
doing several distinct actions within one frame is close to impossible. note that there is a possibility of lag messing with the replay file, and show actions that were done seperatly in one frame, but if you see it several times in a replay on f.ex prodcution on workers, or injects it is safe to assume that it is automation. an autoproduction of scv or probe usually follows the pattern selection of base, production of worker, relesection by boxing whatever was selected before the base was selected.
three minimap chronoboosts followed by a manual box selection in one frame
impossible selections
and impossible selection is boxing units or structures that you do not have vision of. this can happen both when using automation and zoom-out hacks. look for selection actions after what looks like automation in sc2gears and look through the replay from the suspects camera, and see if he makes any selections that are not visible in his view. you can press esc to clear any selection you as observer have made to make his selections visible. note that camera might change with aspect ratio, and the 'camera' box in sc2gears mapview does not take different heights on map into account.
when the manual box selection is made the lings are halfway across the map, but AnnaProssers view is still in the main as denoted by the cyan rectangle on the sc2gears print.