Skill files

Skill ericyanpek/agentcore-private-registry-blueprint/skill-package/src/aws_cost_anomaly_triage/skill_files

Use when the user reports an unexpected AWS cost spike, an alert from AWS Cost Anomaly Detection, or asks "why did my AWS bill go up". Walks through a structured triage SOP using Cost Explorer, CUR, and service-specific signals before recommending remediation.From its SKILL.md

Install

npx -y skills add ericyanpek/agentcore-private-registry-blueprint --skill skill_files

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.4 KB, 752 tokens by cl100k_base, as published. Nobody here has run it

AWS Cost Anomaly Triage

This skill encodes the internal SOP our FinOps team uses when an AWS cost anomaly is raised. Apply it whenever you see a cost spike alert, an unfamiliar line item on the bill, or a customer-reported overage.

When to invoke

An anomaly is reported by AWS Cost Anomaly Detection (email, Slack, EventBridge)
Month-over-month spend on any service rises by more than the threshold in resources/thresholds.md
A customer or team asks "why is my AWS bill higher than expected"

Triage workflow

Follow these steps in order. Do not skip ahead even if the cause seems obvious — early steps surface confounding factors that shape later recommendations.

Step 1 — Bound the anomaly

Identify the time window (start, end, ongoing?). Use Cost Explorer GetCostAndUsage grouped by SERVICE over the past 30 days at daily granularity.
Identify the scope: account, region, service, usage type, linked account, or tag dimension. Always confirm the anomaly persists when you remove plausible confounders (RI/SP amortization, credits, refunds — see resources/confounders.md).
Quantify: absolute $ delta and % delta. If <$50 or <5%, downgrade to monitoring rather than active triage.

Step 2 — Classify

Match against the patterns in resources/anomaly-patterns.md. The common ones in order of frequency:

Compute scale-up (EC2/Fargate/Lambda)
Data transfer (especially cross-AZ and NAT GW egress)
Storage growth (S3 standard creep, EBS snapshots)
New service activation (Bedrock, OpenSearch, Aurora upgrade)
Tagging gap surfacing previously hidden cost
Credit / discount expiration

Step 3 — Drill down

Use service-specific dashboards listed in resources/per-service-drilldown.md. Always check:

CloudTrail for unusual Run* / Create* API spikes around the anomaly start time
Cost and Usage Report (CUR) at hourly granularity if Cost Explorer daily isn't enough
Resource tags to attribute to a team or workload

Step 4 — Decide remediation

Map the classified cause to one of the responses in resources/remediation-playbook.md. Never propose:

Disabling a security service (GuardDuty, Macie, Detective) without the security team's written sign-off
Deleting CloudTrail logs or VPC Flow Logs to save storage
Removing tags to "simplify"

Step 5 — Document

Write up findings using the template in resources/postmortem-template.md. File it in the FinOps tracker even if cause was benign — the patterns compound across incidents.

Resources

What this skill is NOT

Not a substitute for Cost Optimization Hub or Trusted Advisor recommendations — those are starting points, not conclusions.
Not for capacity planning or pricing-model selection (RI/SP). Use the aws-savings-plan-modeling skill for those.

What ships with it: 6 files

8.5 KB alongside SKILL.md