TimesFM Forecasting
google-research/timesfm
Forecasts any univariate time series zero-shot with Google's TimesFM model, returning point forecasts and calibrated prediction intervals without training.
Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios…
Install Anomaly Alert
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor anomaly-alert --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ccam-insights/skills/anomaly-alert .claude/skills/anomaly-alert && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "anomaly-alert" agent skill from https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert into .claude/skills/anomaly-alert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "anomaly-alert", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alertType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor anomaly-alert --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/ccam-insights/skills/anomaly-alert .agents/skills/anomaly-alert && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "anomaly-alert" agent skill from https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert into .agents/skills/anomaly-alert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "anomaly-alert", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor anomaly-alert --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/ccam-insights/skills/anomaly-alert .cursor/skills/anomaly-alert && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "anomaly-alert" agent skill from https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert into .cursor/skills/anomaly-alert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "anomaly-alert", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git --path plugins/ccam-insights/skills/anomaly-alert--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor anomaly-alert --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/ccam-insights/skills/anomaly-alert .gemini/skills/anomaly-alert && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "anomaly-alert" agent skill from https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert into .gemini/skills/anomaly-alert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "anomaly-alert", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor anomaly-alertInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/ccam-insights/skills/anomaly-alert .github/skills/anomaly-alert && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "anomaly-alert" agent skill from https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert into .github/skills/anomaly-alert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "anomaly-alert", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor anomaly-alert --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/ccam-insights/skills/anomaly-alert .opencode/skills/anomaly-alert && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "anomaly-alert" agent skill from https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert into .opencode/skills/anomaly-alert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "anomaly-alert", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
anomaly-alert- GitHub stars
- 1.1k
- Token cost
- ~744 tokens
- SKILL.md length
- 272 words
- Files
- 2
- Skills in repo
- 78
- Repo updated
- First seen
- Licence
- MIT
At a glance
Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios…
- Works in 4 steps: Fetch baseline data from… → Compute baselines for each metric → Detect anomalies using statistical… → …
- Tasks that involve Anomaly detection
- SKILL.md covers Input, Procedure and Output Format
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Anomaly Alert is an agent skill from hoangsonww/Claude-Code-Agent-Monitor. Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turncount, high thinkingblocks, zero turnduration).
Its SKILL.md is about 740 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `agents/openai.yaml`).
It sits in Data & Analytics, covering Anomaly detection. The repository describes itself as: 🚀 A real-time monitoring dashboard for Claude Code & Codex, built with SQLite3, Node.js, Express, React, Vite, TailwindCSS, & WebSockets. It tracks sessions, agent activity… The licence is MIT.
When your agent uses it
- Tasks that involve Anomaly detection
Example prompts
- “/anomaly-alert”
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- Fetch baseline data from http://localhost:4820
- Compute baselines for each metric
- Detect anomalies using statistical thresholds
- Classify each anomaly
What it can do on your machine
Read from SKILL.md and the folder at commit a06db03. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Anomaly Alert loads about 744 tokens when it runs. Until then it costs about 114 tokens; SKILL.md has 272 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from hoangsonww/Claude-Code-Agent-Monitor at commit a06db03, republished under its MIT licence (© hoangsonww). 272 words, ~744 tokens.
Download SKILL.mdSave it as
.claude/skills/anomaly-alert/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- anomaly-alert
- description
- Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turn_count, high thinking_blocks, zero turn_duration).
Anomaly Alert
Detect anomalous sessions in Claude Code Agent Monitor data.
Input
The user provides: $ARGUMENTS
This may be:
- "all" or empty (default: check all anomaly types)
- "cost" for cost anomalies only
- "duration" for duration anomalies only
- "errors" for error rate anomalies only
- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)
Procedure
Fetch baseline data from
http://localhost:4820:GET /api/sessions?limit=500— historical sessions for baselineGET /api/analytics— aggregated metricsGET /api/pricing/cost— cost data per session
Compute baselines for each metric:
- Mean, median, standard deviation
- P25, P75, P90, P95, P99 percentiles
- Interquartile range (IQR) for robust outlier detection
Detect anomalies using statistical thresholds:
Cost Anomalies
- Sessions costing >2σ above mean
- Single sessions exceeding daily average
- Sudden cost spikes (session-over-session increase >200%)
Duration Anomalies
- Sessions lasting >2σ above mean duration
- Extremely short sessions (<1 minute) that still incur cost
- Sessions with unusual active-vs-idle ratios
Error Rate Anomalies
- Sessions with error rates >2σ above baseline
- New error types not seen in previous sessions
- Sessions with >3 consecutive tool failures
Behavioral Anomalies
- Unusual tool combinations not seen before
- Sessions with abnormally high compaction counts
- Model switches mid-session (if unexpected)
- Sessions with no tool usage (pure conversation)
Token Anomalies
- Input/output token ratio far from historical norm
- Cache miss rate significantly higher than average
- Token usage growing faster than session count
Classify each anomaly:
- 🔴 Critical: Likely indicates a real problem requiring attention
- 🟡 Warning: Unusual but may be expected for certain tasks
- 🔵 Info: Interesting deviation worth noting
Output Format
Present as an Anomaly Report:
═══════════════════════════════════════════════
ANOMALY DETECTION REPORT
Analyzed: N sessions | Baseline: last 30 days
Anomalies found: N (🔴 N critical, 🟡 N warn, 🔵 N info)
═══════════════════════════════════════════════For each anomaly:
- Session ID and timestamp
- Anomaly type and severity
- Observed value vs expected range
- Possible explanation
- Recommended action (if any)
© hoangsonww, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file in plugins/ccam-insights/skills/anomaly-alert of hoangsonww/Claude-Code-Agent-Monitor.
- SKILL.md
- agents/openai.yaml
Open the folder on GitHubat commit a06db03
Compare with similar skills
Anomaly Alert next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Anomaly Alert this skillhoangsonww/Claude-Code-Agent-Monitor | 1.1k | — | ~744 | Automated safety check: Pass | MIT | |
| TimesFM Forecastinggoogle-research/timesfm | 34k | — | ~4.7k | Automated safety check: Pass | Apache-2.0 | |
| Anomalib Adding A Modelopen-edge-platform/anomalib | 6.2k | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | |
| Anomalib Tiled Ensembleopen-edge-platform/anomalib | 6.2k | — | ~1.4k | Automated safety check: Pass | Apache-2.0 | |
| Kqlmicrosoft/fabric-rti-mcp | 131 | — | ~6.2k | Automated safety check: Pass | MIT | |
| Time Series Analytics Useropen-edge-platform/edge-ai-libraries | 171 | — | ~3.1k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Anomalib Adding A Model
open-edge-platform/anomalib
Adds a new anomaly-detection model to anomalib under src/anomalib/models/.
Anomalib Tiled Ensemble
open-edge-platform/anomalib
Runs and configures the anomalib tiled-ensemble pipeline, which trains/evaluates one model per image tile and merges results (with optional seam smoothing) for high-resolution anomaly detection.
- Official
Kql
microsoft/fabric-rti-mcp
KQL language expertise for writing correct, efficient Kusto queries using the Fabric RTI MCP tools.
Time Series Analytics User
open-edge-platform/edge-ai-libraries
Build a new time-series analytics use case on top of the deployed Time Series Analytics microservice — bring it up with Docker Compose (from a repo clone, or by fetching the compose files from…
Dt Obs Analytics
Dynatrace/dynatrace-for-ai
Analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation.
More from hoangsonww/Claude-Code-Agent-Monitor
All 78 skills in this repoVersion Release
hoangsonww/Claude-Code-Agent-Monitor
Choose and apply the correct semantic version bump for this repository.
Budget Set
hoangsonww/Claude-Code-Agent-Monitor
Define a spend budget for Claude Code and, optionally, create a cost alert rule that fires when usage crosses the limit, via POST /api/alerts/rules on the Agent Monitor dashboard.
Cache Efficiency
hoangsonww/Claude-Code-Agent-Monitor
Analyze prompt-cache effectiveness for Claude Code usage from the Agent Monitor dashboard — cache hit rate (totalcacheread / (totalcacheread + totalinput)), cachewrite vs cacheread reuse, cache-read…
Cost Breakdown
hoangsonww/Claude-Code-Agent-Monitor
Break down Claude Code costs using the Agent Monitor pricing engine.
Dag Map
hoangsonww/Claude-Code-Agent-Monitor
Render the multi-agent orchestration DAG for a session — parent→child subagent edges, tree depth, and fan-out — from the Agent Monitor workflow intelligence API.
Dashboard Status
hoangsonww/Claude-Code-Agent-Monitor
Quick dashboard health and status overview — checks the Agent Monitor API (port 4820), reports session/agent/event counts from /api/stats, confirms WebSocket connectivity, reads the redacted hook…
Related
Categories
Questions about Anomaly Alert
What does Anomaly Alert do?
Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios…. Anomaly Alert is an agent skill from hoangsonww/Claude-Code-Agent-Monitor. Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turncount, high thinkingblocks, zero turnduration).
When should I use Anomaly Alert?
Anomaly Alert fits situations like: tasks that involve Anomaly detection.
How do I install Anomaly Alert in Claude Code?
Run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a claude-code`. Or copy the skill folder (plugins/ccam-insights/skills/anomaly-alert in hoangsonww/Claude-Code-Agent-Monitor) into .claude/skills/anomaly-alert in your project. Claude Code loads it when a task matches its description.
How do I install Anomaly Alert in Codex?
Run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a codex`. Or copy the skill folder (plugins/ccam-insights/skills/anomaly-alert in hoangsonww/Claude-Code-Agent-Monitor) into .agents/skills/anomaly-alert in your project. Codex loads it when a task matches its description.
Can I use Anomaly Alert in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/anomaly-alert, .gemini/skills/anomaly-alert, .github/skills/anomaly-alert and .opencode/skills/anomaly-alert in your project.
What does Anomaly Alert need to run?
SKILL.md names no scripts, command-line tools or credentials: Anomaly Alert is instructions for the agent only.
Does Anomaly Alert access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Anomaly Alert safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Anomaly Alert use?
Anomaly Alert is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Anomaly Alert use?
About 744 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Anomaly Alert?
Skills that share tags, products or a category with Anomaly Alert: TimesFM Forecasting (google-research/timesfm, 34k stars), Anomalib Adding A Model (open-edge-platform/anomalib, 6.2k stars), Anomalib Tiled Ensemble (open-edge-platform/anomalib, 6.2k stars) and Kql (microsoft/fabric-rti-mcp, 131 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Anomaly Alert?
hoangsonww (a GitHub user) maintains it in hoangsonww/Claude-Code-Agent-Monitor, which has 1,058 GitHub stars. The repository holds 78 skills in this directory. The repository was last updated on October 10, 2026.
Source: hoangsonww/Claude-Code-Agent-Monitor on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.