anomaly-alert
Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turn_count, high thinking_blocks, zero turn_duration).
npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Anomaly Alert Detect anomalous sessions in Claude Code Agent Monitor data. ## Input The user provides: **$ARGUMENTS** This may be: - "all" or empty (default: check all anomaly types) - "cost" for cost anomalies only - "duration" for duration anomalies only - "errors" for error rate anomalies only - A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ) ## Procedure 1. **Fetch baseline data** from `http://localhost:4820`: - `GET /api/sessions?limit=500` — historical sessions for baseline - `GET /api/analytics` — aggregated metrics - `GET /api/pricing/cost` — cost data per session 2. **Compute baselines** for each metric: - Mean, median, standard deviation - P25, P75, P90, P95, P99 percentiles - Interquartile range (IQR) for robust outlier detection 3. **Detect anomalies** using statistical thresholds: ### Cost Anomalies - Sessions costing >2σ above mean - Single sessions exceeding daily average - Sudden cost spikes (session-over-session increase >200%) ### Duration Anomalies - Sessions lasting >2σ above mean duration - Extremely short sessions (<1 minute) that still incur cost - Sessions with unusual active-vs-idle ratios ### Error Rate Anomalies - Sessions with error r
- Input
- Procedure
- Output Format
What does the anomaly-alert skill do?
Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turn_count, high thinking_blocks, zero turn_duration).
How do I install it?
Run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From hoangsonww/Claude-Code-Agent-Monitor, a repository with 869 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.