Topic · Data & Analytics
Best anomaly detection skills for Claude Code, Codex and other agents.
- skills
- 107
- official
- 12
Anomaly detection skills, ranked
Ranked by score. Sort bymost stars,trending,newest,recently updated
| # | Skill | Repository | Stars | Used in | Tokens | Auto-check | Licence | Updated |
|---|---|---|---|---|---|---|---|---|
| 1 | Forecasts any univariate time series zero-shot with Google's TimesFM model, returning point forecasts and calibrated prediction intervals without training. | google-research/ | 34k | — | ~4.7k | Automated safety check: Pass | Apache-2.0 | 7 days ago |
| 2 | AI-powered financial analysis suite. An agent skill from ericosiu/ai-marketing-skills. | ericosiu/ | 3.6k | 1 repo | ~1.4k | Automated safety check: Pass | MIT | 14 days ago |
| 3 | Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK. | kubeshark/ | 12k | — | ~7.3k | Automated safety check: Notes | Apache-2.0 | 6 days ago |
| 4 | Adds a new anomaly-detection model to anomalib under src/anomalib/models/. | open-edge-platform/ | 6.2k | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | today |
| 5 | Runs and configures the anomalib tiled-ensemble pipeline, which trains/evaluates one model per image tile and merges results (with optional seam smoothing) for high-resolution anomaly detection. | open-edge-platform/ | 6.2k | — | ~1.4k | Automated safety check: Pass | Apache-2.0 | today |
| 6 | KQL language expertise for writing correct, efficient Kusto queries using the Fabric RTI MCP tools. | microsoft/ | 131 | — | ~6.2k | Automated safety check: Pass | MIT | 6 days ago |
| 7 | Build a new time-series analytics use case on top of the deployed Time Series Analytics microservice — bring it up with Docker Compose (from a repo clone, or by fetching the compose files from… | open-edge-platform/ | 168 | — | ~3.1k | Automated safety check: Pass | Apache-2.0 | today |
| 8 | Analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation. | Dynatrace/ | 161 | — | ~3.9k | Automated safety check: Pass | Apache-2.0 | 6 days ago |
| 9 | Guides time series machine learning with the aeon toolkit: classification, regression, clustering, forecasting, anomaly detection, segmentation and similarity search. | davila7/ | 32k | 14 repos | ~2.6k | Automated safety check: Pass | MIT | today |
| 10 | Automate repeated Kagi queries with batch search, watches, notifications, history, caching, and MCP. | Microck/ | 178 | — | ~690 | Automated safety check: Pass | MIT | today |
| 11 | Create and manage Elastic ML anomaly detection jobs via the API. | elastic/ | 592 | — | ~2.4k | Automated safety check: Pass | Apache-2.0 | 5 days ago |
| 12 | Analyzes insurance operating data such as premium, loss ratio, renewal rate and expense ratio by branch, product and channel, flags anomalies and builds an HTML dashboard. | zj-unicom-ai/ | 348 | — | ~646 | Automated safety check: Pass | MIT | 5 days ago |
| 13 | Explain Elasticsearch ML anomaly detection scores, model behavior, and result interpretation. | elastic/ | 592 | — | ~4.5k | Automated safety check: Pass | Apache-2.0 | 5 days ago |
| 14 | Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. | microsoft/ | 3.1k | 6 repos | ~2.3k | Automated safety check: Pass | MIT | today |
| 15 | 基于阈值检测时间序列中的显著异常波动点。当需要找出指标异常波动日期、识别数据异动时调用. An agent skill from agentscope-ai/QwenPaw-Data. | agentscope-ai/ | 112 | — | ~637 | Automated safety check: Pass | Apache-2.0 | 2 days ago |
| 16 | Codified expertise for returns authorisation, receipt and inspection, disposition decisions, refund processing, fraud detection, and warranty claims management. | sickn33/ | 47k | 8 repos | ~6.4k | Automated safety check: Pass | MIT | yesterday |
| 17 | 17.Angular A skill your agent uses when building or refactoring Angular applications — choosing between signals, RxJS, and NgRx for state, configuring routing with guards and lazy loading, optimizing change… | kid-sid/ | 189 | — | ~5k | Automated safety check: Pass | MIT | 2 mo ago |
| 18 | 18.Workos A skill your agent uses when the user asks for a WorkOS docs URL, term, or dashboard field (Sign-in endpoint, initiateloginuri, Redirect URI, WORKOS env vars), or is implementing, debugging, or… | usenotra/ | 255 | — | ~6.2k | Automated safety check: Pass | AGPL-3.0 | today |
| 19 | 19.Web2 Recon Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis… | awarexone/ | 5.3k | 2 repos | ~6.4k | Automated safety check: Warn | MIT | 2 days ago |
| 20 | 20.Risk Assess Uncommitted code risk assessment with breaking change detection, blast radius analysis, and scope metrics. | sd0xdev/ | 192 | — | ~834 | Automated safety check: Pass | MIT | yesterday |
| 21 | 21.Scholar Ling Design and analyze studies in sociolinguistics, language variation, acoustic phonetics, discourse analysis, language contact, and computational linguistics. | joshzyj/ | 167 | — | ~6.7k | Automated safety check: Pass | Unknown | 19 days ago |
| 22 | Monitor AI agent health, detect anomalies, set up alerting, and maintain observability dashboards for production multi-agent systems. | cosmicstack-labs/ | 476 | — | ~2.7k | Automated safety check: Pass | MIT | 1 mo ago |
| 23 | Safe Terraform provider upgrades with automatic resource migration, breaking change detection, and state management using moved blocks. | thomast1906/ | 202 | — | ~3.9k | Automated safety check: Pass | No licence | 2 mo ago |
| 24 | 24.Angular A skill your agent uses when building, refactoring, or debugging Angular (v20/21+): standalone components, signals, zoneless change detection, @if/@for/@defer control flow, inject() DI… | ericrisco/ | 156 | — | ~3.4k | Automated safety check: Pass | MIT | today |
| 25 | Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. | mukul975/ | 34k | — | ~2.1k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 26 | Catches unusual performance changes across your accounts — CPC spikes, CVR drops, spend surges, impression collapses, CTR shifts — and flags them with context about what likely changed. | irinabuht12-oss/ | 3.8k | — | ~658 | Automated safety check: Pass | No licence | 13 days ago |
| 27 | Identify anomalous sessions using Agent Monitor data — cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios… | hoangsonww/ | 1k | 1 repo | ~744 | Automated safety check: Pass | MIT | today |
| 28 | A skill your agent uses when migrating a Frappe app between major versions, detecting breaking API changes, or resolving post-migration errors. | Impertio-Studio/ | 187 | — | ~2.8k | Automated safety check: Notes | MIT | 20 days ago |
| 29 | Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. | mukul975/ | 34k | — | ~581 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 30 | Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and… | mukul975/ | 34k | — | ~599 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 31 | Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM… | mukul975/ | 34k | — | ~3.6k | Automated safety check: Notes | Apache-2.0 | 1 mo ago |
| 32 | Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC… | mukul975/ | 34k | — | ~3.8k | Automated safety check: Notes | Apache-2.0 | 1 mo ago |
| 33 | Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic… | mukul975/ | 34k | — | ~3.6k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 34 | Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and… | mukul975/ | 34k | — | ~4.2k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 35 | Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer… | mukul975/ | 34k | — | ~3.7k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 36 | Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring… | mukul975/ | 34k | — | ~4.9k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 37 | Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. | mukul975/ | 34k | — | ~578 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 38 | Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis, providing asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment… | mukul975/ | 34k | — | ~2.5k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 39 | Comprehensive REST API design review with automated linting, breaking-change detection, and design scorecards. | alirezarezvani/ | 28k | — | ~3.2k | Automated safety check: Pass | MIT | 1 mo ago |
| 40 | A skill your agent uses when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. | alirezarezvani/ | 28k | — | ~3.5k | Automated safety check: Pass | MIT | 1 mo ago |
| 41 | Graph database implementation for relationship-heavy data models. | ancoleman/ | 526 | — | ~3.2k | Automated safety check: Pass | MIT | 10 mo ago |
| 42 | Smart change detection, auto branch naming, and streamlined commit/PR workflow | sickn33/ | 47k | 1 repo | ~988 | Automated safety check: Pass | MIT | yesterday |
| 43 | Scans transactions for fraud and anomaly signals — duplicate charges within 48 hours, transactions more than 3 standard deviations above a merchant's historical average, first-ever transaction with… | lyndonkl/ | 164 | — | ~2k | Automated safety check: Pass | No licence | 1 mo ago |
| 44 | Elastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. | elastic/ | 592 | — | ~6k | Automated safety check: Pass | Apache-2.0 | 5 days ago |
| 45 | Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. | mukul975/ | 34k | — | ~626 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 46 | Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. | mukul975/ | 34k | — | ~2.5k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 47 | Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. | mukul975/ | 34k | — | ~644 | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 48 | Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and… | mukul975/ | 34k | — | ~642 | Automated safety check: Notes | Apache-2.0 | 1 mo ago |
Questions, answered from the data.
What is the best anomaly detection skill?
TimesFM Forecasting from google-research/timesfm ranks first of the 107 anomaly detection skills listed here, with the highest score: its repository has 34k GitHub stars, its SKILL.md loads about 4.7k tokens and it passes the automated safety check with no findings. Next come Finance Ops and Kubernetes Network Security Audit.
Which anomaly detection skills are official?
12 of the 107 anomaly detection skills are official, published by the vendor's own GitHub organization: Kql, Elasticsearch Anomaly Detection, Elasticsearch Anomaly Detection Explainer, Azure AI Anomalydetector Java, Kibana Anomaly Detection and 7 more.
How are these skills ranked?
By Skill Navigator score, which combines the GitHub stars of the skill's repository (shared across that repo's skills and discounted for large collections), how many other GitHub owners carry a copy of the skill, and automated SKILL.md quality checks, minus penalties for safety-check warnings and for each further skill from the same repository. Skills that fail the safety check are not listed.