agentsclimarketplace

Anomaly detector

Skill maxwellokumu/okaudit-claude-skills/log-monitoring/anomaly-detector

Claude-ready IT audit skills for identity, compliance, appsec, privacy, network, logging, vendor risk, and audit leadership workflows

Install
npx -y skills add maxwellokumu/okaudit-claude-skills --skill anomaly-detector

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Compare recent activity against a historical baseline to identify behavioral anomalies and help Claude explain which users or patterns warrant deeper investigation.

SKILL.md

1.7 KB, as published. Nobody here has run it

Anomaly Detector

Use this skill when the user wants to compare current log activity against a baseline, identify unusual behavior, or investigate whether user activity has deviated from normal patterns.

Goal

Help Claude highlight meaningful anomalies, explain why they stand out from the baseline, and present the results in a way that supports security review or audit follow-up.

Workflow

  1. Confirm the baseline log source, the test period log source, and any tuning preferences such as sensitivity.
  2. Review whether the baseline has enough activity to support a credible comparison.
  3. Compare the test period against the baseline to identify users or patterns that exceed expected thresholds.
  4. Separate strong anomaly candidates from weak signals caused by sparse data or noisy inputs.
  5. Present a concise anomaly summary with likely priorities for investigation.

Inputs

Expected inputs from the bundled tool metadata:

  • logs: Path to the historical baseline log file.
  • test: Path to the test period log file.
  • sensitivity: Optional threshold sensitivity.
  • min_events: Optional minimum baseline event count.

Bundled Files

  • main.py contains the executable anomaly detection logic.
  • README.md provides usage notes and examples.
  • skill.yaml captures the repo-native metadata for this skill.
  • sample_input may contain representative baseline and test logs.

Guidance

Treat anomaly detection as a triage aid rather than definitive proof of malicious behavior. Call out data quality limits and explain why each anomaly is notable.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.