cost-anomaly
MAD-based outlier detection on session spend. Robust to the very outliers it hunts (unlike mean+sigma). Surfaces specific anomalous sessions with modified-z scores; optional --alert-on-outliers exit code for CI gates. Distinct from cost-burn (aggregate trend) — this answers "which INDIVIDUAL session is the outlier?".
Profile →npx skills add ruvnet/ruflo --skill cost-anomaly --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
Per-session outlier detection — the diagnostic counterpart to cost-burn's aggregate-trend signal. | Question | Skill | |---|---| | "Is the AGGREGATE rate accelerating?" | `cost-burn` | | "Which SPECIFIC sessions are anomalous outliers?" | **`cost-anomaly`** ← this | | "Could we have spent less in aggregate?" | `cost-counterfactual` | | "When will we hit budget?" | `cost-projection` | ## Algorithm Implementation: [`scripts/anomaly.mjs`](../../scripts/anomaly.mjs). 1. Read all `session-*` records from `cost-tracking` namespace. 2. Filter to `--since` window (default: all-time). 3. Compute `median(total_cost_usd)` and `MAD = median(|x - median|)`. 4. Per-session modified z-score (Iglewicz-Hoaglin 1993): `z = 0.6745 * (x - median) / MAD` 5. Flag sessions with `|z| > --threshold` (default 3.5). ## Why MAD and not mean + sigma? | Approach | What breaks | |---|---| | `mean + sigma` | A single $50 session inflates BOTH mean and sigma so badly that subsequent outliers hide inside the new "normal" band. Catastrophic on small samples. | | `median + MAD` | Both estimators ignore up to 50% of the data — the outliers themselves can't shift them. Robust on n=10. The canonical cutoff `\|z\| > 3.5`
- Algorithm
- Why MAD and not mean + sigma?
- Smoke transcript (5 baseline sessions $0.08-$0.12 + 1 outlier $5.00)
- Exit codes
- CI integration
- Edge cases
- Direction column
Fail the build if any session this week is a >3.5σ outlier cost anomaly --since 7d --alert-on-outliers 1 || investigate-bad-session cost burn --alert-on-acceleration-pct 50 || page-oncall # rate-of-change alert cost anomaly --alert-on-outliers 1 || investigate # point-anomaly alert
What does the cost-anomaly skill do?
MAD-based outlier detection on session spend. Robust to the very outliers it hunts (unlike mean+sigma). Surfaces specific anomalous sessions with modified-z scores; optional --alert-on-outliers exit code for CI gates. Distinct from cost-burn (aggregate trend) — this answers "which INDIVIDUAL session is the outlier?".
How do I install it?
Run `npx skills add ruvnet/ruflo --skill cost-anomaly --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From ruvnet/ruflo, a repository with 67,015 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.