agentsclimarketplace

Anomaly alert

Skill hoangsonww/Claude-Code-Agent-Monitor/plugins/ccam-insights/skills/anomaly-alert

πŸš€ A real-time monitoring dashboard for Claude Code, built with SQLite3, Node.js, Express, React, Vite, TailwindCSS, and WebSockets. It tracks sessions, agent activity, tool usage, and subagent orchestration, providing live analytics, a Kanban status board, status notifications, a cute buddy, and an interactive web UI/MacOS/Windows native app.

Install
npx -y skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Identify anomalous sessions using Agent Monitor data β€” cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turn_count, high thinking_blocks, zero turn_duration).

SKILL.md

3.1 KB, as published. Nobody here has run it

Anomaly Alert

Detect anomalous sessions in Claude Code Agent Monitor data.

Input

The user provides: $ARGUMENTS

This may be:

  • "all" or empty (default: check all anomaly types)
  • "cost" for cost anomalies only
  • "duration" for duration anomalies only
  • "errors" for error rate anomalies only
  • A sensitivity level: "strict" (1Οƒ), "normal" (2Οƒ), "relaxed" (3Οƒ)

Procedure

  1. Fetch baseline data from http://localhost:4820:

    • GET /api/sessions?limit=500 β€” historical sessions for baseline
    • GET /api/analytics β€” aggregated metrics
    • GET /api/pricing/cost β€” cost data per session

  2. Compute baselines for each metric:

    • Mean, median, standard deviation
    • P25, P75, P90, P95, P99 percentiles
    • Interquartile range (IQR) for robust outlier detection

  3. Detect anomalies using statistical thresholds:

    Cost Anomalies

    • Sessions costing >2Οƒ above mean
    • Single sessions exceeding daily average
    • Sudden cost spikes (session-over-session increase >200%)

    Duration Anomalies

    • Sessions lasting >2Οƒ above mean duration
    • Extremely short sessions (<1 minute) that still incur cost
    • Sessions with unusual active-vs-idle ratios

    Error Rate Anomalies

    • Sessions with error rates >2Οƒ above baseline
    • New error types not seen in previous sessions
    • Sessions with >3 consecutive tool failures

    Behavioral Anomalies

    • Unusual tool combinations not seen before
    • Sessions with abnormally high compaction counts
    • Model switches mid-session (if unexpected)
    • Sessions with no tool usage (pure conversation)

    Token Anomalies

    • Input/output token ratio far from historical norm
    • Cache miss rate significantly higher than average
    • Token usage growing faster than session count

  4. Classify each anomaly:

    • πŸ”΄ Critical: Likely indicates a real problem requiring attention
    • 🟑 Warning: Unusual but may be expected for certain tasks
    • πŸ”΅ Info: Interesting deviation worth noting

Output Format

Present as an Anomaly Report:

═══════════════════════════════════════════════
  ANOMALY DETECTION REPORT
  Analyzed: N sessions | Baseline: last 30 days
  Anomalies found: N (πŸ”΄ N critical, 🟑 N warn, πŸ”΅ N info)
═══════════════════════════════════════════════

For each anomaly:

  • Session ID and timestamp
  • Anomaly type and severity
  • Observed value vs expected range
  • Possible explanation
  • Recommended action (if any)

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.