Agent skill

Anomaly Fraud Scanner

by lyndonkl in lyndonkl/claude

Scans transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3 standard deviations above a merchant's historical average, first-ever transaction with…

No licenceAuto-check passedData & Analytics

Install Anomaly Fraud Scanner

skills CLI
$ npx skills add lyndonkl/claude --skill anomaly-fraud-scanner -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install lyndonkl/claude anomaly-fraud-scanner --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/lyndonkl/claude.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/anomaly-fraud-scanner .claude/skills/anomaly-fraud-scanner && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
anomaly-fraud-scanner
GitHub stars
164
Token cost
~2k tokens
SKILL.md length
650 words
Files
1
Skills in repo
12
Repo updated
First seen
Licence
None found

At a glance

Scans transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3 standard deviations above a merchant's historical average, first-ever transaction with…

  • Vigilance scans on every drop
  • SKILL.md covers Table of Contents, Overview, Input contract and Detection rules, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • After any large unexplained outflow

What it does

Anomaly Fraud Scanner is an agent skill from lyndonkl/claude. Scans transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3 standard deviations above a merchant's historical average, first-ever transaction with a new merchant above a high-dollar threshold, and unusual geography or time. Produces severity-tagged alerts with the transaction id, evidence, and a recommended action (call bank, freeze card, dispute, monitor). Use for vigilance scans on every drop, after any large unexplained outflow, or when user mentions fraud…

Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Data & Analytics, covering Anomaly detection. The repository describes itself as: Agents, skills and anything else to use with claude.

When your agent uses it

  • Vigilance scans on every drop
  • After any large unexplained outflow
  • User mentions fraud check
  • Suspicious charge

Example prompts

  • “Use the anomaly-fraud-scanner skill to scan transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3…”
  • “/anomaly-fraud-scanner”

What it can do on your machine

Read from SKILL.md and the folder at commit 4acc337. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are json).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Anomaly Fraud Scanner loads about 2k tokens when it runs. Until then it costs about 151 tokens; SKILL.md has 650 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~151
When it runs · the whole SKILL.md, loaded when a task matches
~2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 650 words (~2,020 tokens).

“Fraud detection on a household budget is a different problem from fraud detection at a bank. The bank already runs sophisticated rules; this skill exists to catch what the bank misses — small recurring fraud below their threshold, unfamiliar merchant…”

— opening of SKILL.md by lyndonkl
name
anomaly-fraud-scanner

Read the full SKILL.md on GitHub

Files

Just SKILL.md in skills/anomaly-fraud-scanner of lyndonkl/claude.

Open the folder on GitHubat commit 4acc337

Compare with similar skills

Anomaly Fraud Scanner next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Anomaly Fraud Scanner compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Anomaly Fraud Scanner this skilllyndonkl/claude164—~2kAutomated safety check: PassNone
TimesFM Forecastinggoogle-research/timesfm34k—~4.7kAutomated safety check: PassApache-2.0
Anomalib Adding A Modelopen-edge-platform/anomalib6.2k—~1.9kAutomated safety check: PassApache-2.0
Anomalib Tiled Ensembleopen-edge-platform/anomalib6.2k—~1.4kAutomated safety check: PassApache-2.0
Kqlmicrosoft/fabric-rti-mcp131—~6.2kAutomated safety check: PassMIT
Time Series Analytics Useropen-edge-platform/edge-ai-libraries171—~3.1kAutomated safety check: PassApache-2.0

Similar skills

  • TimesFM Forecasting

    google-research/timesfm

    Forecasts any univariate time series zero-shot with Google's TimesFM model, returning point forecasts and calibrated prediction intervals without training.

    34k GitHub stars~4.7k tokensUpdated 11 days ago
    Data & AnalyticsAuto-check passed
  • Anomalib Adding A Model

    open-edge-platform/anomalib

    Adds a new anomaly-detection model to anomalib under src/anomalib/models/.

    6.2k GitHub stars~1.9k tokensUpdated yesterday
    Data & AnalyticsAuto-check passed
  • Anomalib Tiled Ensemble

    open-edge-platform/anomalib

    Runs and configures the anomalib tiled-ensemble pipeline, which trains/evaluates one model per image tile and merges results (with optional seam smoothing) for high-resolution anomaly detection.

    6.2k GitHub stars~1.4k tokensUpdated yesterday
    Data & AnalyticsAuto-check passed
  • Kql

    microsoft/fabric-rti-mcp

    Official

    KQL language expertise for writing correct, efficient Kusto queries using the Fabric RTI MCP tools.

    131 GitHub stars~6.2k tokensUpdated 10 days ago
    Data & AnalyticsAuto-check passed
  • Time Series Analytics User

    open-edge-platform/edge-ai-libraries

    Build a new time-series analytics use case on top of the deployed Time Series Analytics microservice — bring it up with Docker Compose (from a repo clone, or by fetching the compose files from…

    171 GitHub stars~3.1k tokensUpdated yesterday
    Data & AnalyticsAuto-check passed
  • Dt Obs Analytics

    Dynatrace/dynatrace-for-ai

    Analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation.

    163 GitHub stars~3.9k tokensUpdated 10 days ago
    Data & AnalyticsAuto-check passed

More from lyndonkl/claude

All 12 skills in this repo
  • Builds structured abstraction ladders that translate high-level principles into concrete, actionable examples across 3-5 levels.

    164 GitHub stars~1.1k tokensUpdated 1 mo ago
    Auto-check passed
  • Guides the creation of evidence-based academic recommendation letters, reference letters, and award nominations that combine concrete examples, meaningful comparisons, and genuine enthusiasm.

    164 GitHub stars~2.5k tokensUpdated 1 mo ago
    Auto-check passed
  • Adr Architecture

    lyndonkl/claude

    Documents significant architectural and technical decisions with full context, alternatives considered, trade-offs analyzed, and consequences understood.

    164 GitHub stars~1.5k tokensUpdated 1 mo ago
    Auto-check passed
  • Produces a Bayesian prior probability that an offered transaction is +EV for the recipient, given that the counterparty chose to propose it.

    164 GitHub stars~4.6k tokensUpdated 1 mo ago
    Auto-check passed
  • Creates actionable alignment frameworks that give teams a shared North Star (direction), values (guardrails), and decision tenets (behavioral standards).

    164 GitHub stars~1.6k tokensUpdated 1 mo ago
    Auto-check passed
  • Analogy Weight Check

    lyndonkl/claude

    For every analogy in a substacker draft, verifies it carries mechanical weight — the analogy does real work explaining the mechanism, not merely decorates it.

    164 GitHub stars~1.1k tokensUpdated 1 mo ago
    Auto-check passed

Questions about Anomaly Fraud Scanner

What does Anomaly Fraud Scanner do?

Scans transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3 standard deviations above a merchant's historical average, first-ever transaction with…. Anomaly Fraud Scanner is an agent skill from lyndonkl/claude. Scans transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3 standard deviations above a merchant's historical average, first-ever transaction with a new merchant above a high-dollar threshold, and unusual geography or time.

When should I use Anomaly Fraud Scanner?

Anomaly Fraud Scanner fits situations like: vigilance scans on every drop; after any large unexplained outflow; user mentions fraud check; suspicious charge.

How do I install Anomaly Fraud Scanner in Claude Code?

Run `npx skills add lyndonkl/claude --skill anomaly-fraud-scanner -a claude-code`. Or copy the skill folder (skills/anomaly-fraud-scanner in lyndonkl/claude) into .claude/skills/anomaly-fraud-scanner in your project. Claude Code loads it when a task matches its description.

How do I install Anomaly Fraud Scanner in Codex?

Run `npx skills add lyndonkl/claude --skill anomaly-fraud-scanner -a codex`. Or copy the skill folder (skills/anomaly-fraud-scanner in lyndonkl/claude) into .agents/skills/anomaly-fraud-scanner in your project. Codex loads it when a task matches its description.

Can I use Anomaly Fraud Scanner in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add lyndonkl/claude --skill anomaly-fraud-scanner -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/anomaly-fraud-scanner, .gemini/skills/anomaly-fraud-scanner, .github/skills/anomaly-fraud-scanner and .opencode/skills/anomaly-fraud-scanner in your project.

What does Anomaly Fraud Scanner need to run?

SKILL.md names no scripts, command-line tools or credentials: Anomaly Fraud Scanner is instructions for the agent only.

Does Anomaly Fraud Scanner access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Anomaly Fraud Scanner safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Anomaly Fraud Scanner use?

No licence was found for Anomaly Fraud Scanner or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does Anomaly Fraud Scanner use?

About 2k tokens (SKILL.md is roughly 8.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Anomaly Fraud Scanner?

Skills that share tags, products or a category with Anomaly Fraud Scanner: TimesFM Forecasting (google-research/timesfm, 34k stars), Anomalib Adding A Model (open-edge-platform/anomalib, 6.2k stars), Anomalib Tiled Ensemble (open-edge-platform/anomalib, 6.2k stars) and Kql (microsoft/fabric-rti-mcp, 131 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Anomaly Fraud Scanner?

lyndonkl (a GitHub user) maintains it in lyndonkl/claude, which has 164 GitHub stars. The repository holds 12 skills in this directory. The repository was last updated on September 1, 2026.

Source: lyndonkl/claude on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.