New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Iot Anomalies

by ruvnet in ruvnet/ruflo

Detect and classify telemetry anomalies on Cognitum Seed devices.

MITAuto-check passedData & Analytics

Install Iot Anomalies

skills CLI
$ npx skills add ruvnet/ruflo --skill iot-anomalies -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ruvnet/ruflo iot-anomalies --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ruvnet/ruflo.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ruflo-iot-cognitum/skills/iot-anomalies .claude/skills/iot-anomalies && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
iot-anomalies
GitHub stars
74k
Token cost
~210 tokens
SKILL.md length
50 words
Files
1
Skills in repo
265
Repo updated
First seen
Licence
MIT

At a glance

Detect and classify telemetry anomalies on Cognitum Seed devices.

  • Works in 4 steps: npx -y -p… → Review detected anomaly types (spike,… → If score > 0.9, recommend quarantine → …
  • Investigating a device thats reporting odd metrics
  • Calls npx
  • Before approving a firmware canary advancement

What it does

Iot Anomalies is an agent skill from ruvnet/ruflo. Detect and classify telemetry anomalies on Cognitum Seed devices. Use when investigating a device that's reporting odd metrics, before approving a firmware canary advancement, or when triaging fleet-wide health alerts.

Its SKILL.md is about 210 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Data & Analytics, covering Anomaly detection and Deployment. The repository describes itself as: 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory…. The licence is MIT.

When your agent uses it

  • Investigating a device thats reporting odd metrics
  • Before approving a firmware canary advancement
  • Triaging fleet-wide health alerts

Example prompts

  • “/iot-anomalies”

Requirements

  • Node.js
  • Pre-approved tools (allowed-tools): Bash(npx *), mcp__plugin_ruflo-core_ruflo__memory_store, Read

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. npx -y -p @claude-flow/plugin-iot-cognitum@latest cognitum-iot anomalies DEVICE_ID
  2. Review detected anomaly types (spike, flatline, drift, oscillation, pattern-break, cluster-outlier)
  3. If score > 0.9, recommend quarantine
  4. Store anomaly pattern for learning

What it can do on your machine

Read from SKILL.md and the folder at commit 6c04654. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash(npx *)
    • mcp__plugin_ruflo-core_ruflo__memory_store
    • Read

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npx, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Iot Anomalies loads about 210 tokens when it runs. Until then it costs about 58 tokens; SKILL.md has 50 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~58
When it runs · the whole SKILL.md, loaded when a task matches
~210

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ruvnet/ruflo at commit 6c04654, republished under its MIT licence (© ruvnet). 50 words, ~210 tokens.

Download SKILL.mdSave it as .claude/skills/iot-anomalies/SKILL.md (or your agent's skills folder).
name
iot-anomalies
description
Detect and classify telemetry anomalies on Cognitum Seed devices. Use when investigating a device that's reporting odd metrics, before approving a firmware canary advancement, or when triaging fleet-wide health alerts.
allowed-tools
Bash(npx *), mcp__plugin_ruflo-core_ruflo__memory_store, Read
argument-hint
<device-id>

Run Z-score anomaly detection on a device's recent telemetry.

Steps:

  1. npx -y -p @claude-flow/plugin-iot-cognitum@latest cognitum-iot anomalies DEVICE_ID
  2. Review detected anomaly types (spike, flatline, drift, oscillation, pattern-break, cluster-outlier)
  3. If score > 0.9, recommend quarantine
  4. Store anomaly pattern for learning: mcp__plugin_ruflo-core_ruflo__memory_store({ key: "iot-anomaly-DEVICEID", value: "TYPE at SCORE", namespace: "iot-anomalies" })

© ruvnet, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in plugins/ruflo-iot-cognitum/skills/iot-anomalies of ruvnet/ruflo.

Open the folder on GitHubat commit 6c04654

Compare with similar skills

Iot Anomalies next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Iot Anomalies compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Iot Anomalies this skillruvnet/ruflo74k—~210Automated safety check: PassMIT
AWS Cloudformation Cloudwatchgiuseppe-trisciuoglio/developer-kit357—~3.7kAutomated safety check: NotesMIT
Matlab Use Visual Inspectionmatlab/matlab-agentic-toolkit1.1k—~3.1kAutomated safety check: PassCustom licence
Mle Workflowaffaan-m/ECC276k1 repos~5.6kAutomated safety check: PassMIT
Detecting DNS Exfiltration With DNS Query Analysismukul975/Anthropic-Cybersecurity-Skills34k—~4.2kAutomated safety check: PassApache-2.0
Apex Azure Kustojonathan-vella/apex217—~984Automated safety check: PassMIT

Similar skills

  • AWS Cloudformation Cloudwatch

    giuseppe-trisciuoglio/developer-kit

    Provides AWS CloudFormation patterns for CloudWatch monitoring, metrics, alarms, dashboards, logs, and observability.

    357 GitHub stars~3.7k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check: notes

  • Matlab Use Visual Inspection

    matlab/matlab-agentic-toolkit

    Build machine vision inspection systems with MATLAB Visual Inspection Toolbox.

    1.1k GitHub stars~3.1k tokensUpdated 2 days ago
    AI & LLM EngineeringAuto-check passed

  • Mle Workflow

    affaan-m/ECC

    Production machine-learning engineering workflow for data contracts, reproducible training, model evaluation, deployment, monitoring, and rollback.

    276k GitHub starsUsed in 1 repo~5.6k tokens
    Data & AnalyticsAuto-check passed

  • Detecting DNS Exfiltration With DNS Query Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and…

    34k GitHub stars~4.2k tokensUpdated 1 mo ago
    Data & AnalyticsAuto-check passed

  • Apex Azure Kusto

    jonathan-vella/apex

    ANALYSIS SKILL — Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL.

    217 GitHub stars~984 tokensUpdated today
    Data & AnalyticsAuto-check passed

  • Upgrading Mwaa Environments

    aws/agent-toolkit-for-aws

    Official

    Upgrades an MWAA environment to a newer Airflow version — within 2.x, within 3.x, or across the 2.x-to-3.x boundary.

    2.8k GitHub stars~7.3k tokensUpdated today
    Data & AnalyticsAuto-check passed

More from ruvnet/ruflo

All 265 skills in this repo

  • AgentDB Pattern Memory

    ruvnet/ruflo

    Stores, searches, and retrieves successful patterns with HNSW-indexed semantic search so agents can reuse past solutions instead of relearning them.

    74k GitHub starsUsed in 2 repos~830 tokens
    Auto-check passed

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    Auto-check passed

  • SPARC Development Methodology

    ruvnet/ruflo

    Applies the SPARC method (specification, pseudocode, architecture, refinement, completion) with 17 specialized modes and multi-agent orchestration, from research to deployment.

    74k GitHub starsUsed in 2 repos~829 tokens
    Auto-check passed

  • Swarm Orchestration

    ruvnet/ruflo

    Coordinates a hierarchical swarm of specialized agents through the claude-flow CLI for work that spans several files or modules at once.

    74k GitHub starsUsed in 2 repos~779 tokens
    Auto-check passed

  • Ruflo Multi-Agent Orchestration

    ruvnet/ruflo

    Sets up and drives Ruflo, an npm-installed orchestration layer for multi-agent swarms, persistent memory, routing, hooks and its MCP tool catalog.

    74k GitHub starsUsed in 1 repo~975 tokens
    Auto-check passed

  • Agent Coordination

    ruvnet/ruflo

    Reference for spawning, listing, monitoring and stopping agents with claude-flow commands, with agent type families, routing codes and coordination tips.

    74k GitHub starsUsed in 2 repos~519 tokens
    Auto-check passed

Categories

Questions about Iot Anomalies

What does Iot Anomalies do?

Detect and classify telemetry anomalies on Cognitum Seed devices. Iot Anomalies is an agent skill from ruvnet/ruflo. Detect and classify telemetry anomalies on Cognitum Seed devices.

When should I use Iot Anomalies?

Iot Anomalies fits situations like: investigating a device thats reporting odd metrics; before approving a firmware canary advancement; triaging fleet-wide health alerts.

How do I install Iot Anomalies in Claude Code?

Run `npx skills add ruvnet/ruflo --skill iot-anomalies -a claude-code`. Or copy the skill folder (plugins/ruflo-iot-cognitum/skills/iot-anomalies in ruvnet/ruflo) into .claude/skills/iot-anomalies in your project. Claude Code loads it when a task matches its description.

How do I install Iot Anomalies in Codex?

Run `npx skills add ruvnet/ruflo --skill iot-anomalies -a codex`. Or copy the skill folder (plugins/ruflo-iot-cognitum/skills/iot-anomalies in ruvnet/ruflo) into .agents/skills/iot-anomalies in your project. Codex loads it when a task matches its description.

Can I use Iot Anomalies in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ruvnet/ruflo --skill iot-anomalies -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/iot-anomalies, .gemini/skills/iot-anomalies, .github/skills/iot-anomalies and .opencode/skills/iot-anomalies in your project.

What does Iot Anomalies need to run?

Going by SKILL.md and its folder, Iot Anomalies needs the command-line tools its instructions call (npx). Our summary lists: Node.js. Its frontmatter pre-approves these tools: Bash(npx *), mcp__plugin_ruflo-core_ruflo__memory_store, Read.

Does Iot Anomalies access the network?

SKILL.md contains no URLs. Its commands use npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Iot Anomalies safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Iot Anomalies use?

Iot Anomalies is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Iot Anomalies use?

About 210 tokens (SKILL.md is roughly 840 characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Iot Anomalies?

Skills that share tags, products or a category with Iot Anomalies: AWS Cloudformation Cloudwatch (giuseppe-trisciuoglio/developer-kit, 357 stars), Matlab Use Visual Inspection (matlab/matlab-agentic-toolkit, 1.1k stars), Mle Workflow (affaan-m/ECC, 276k stars) and Detecting DNS Exfiltration With DNS Query Analysis (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Iot Anomalies?

ruvnet (a GitHub user) maintains it in ruvnet/ruflo, which has 74,222 GitHub stars. The repository holds 265 skills in this directory. The repository was last updated on October 10, 2026.

Source: ruvnet/ruflo on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.