# Anomaly Alert

Identify anomalous sessions using Agent Monitor data, cost outliers from the pricing...

- Repository: https://github.com/hoangsonww/Claude-Code-Agent-Monitor (1136 stars)
- Category: AI and agents
- License: MIT
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -g -a claude-code -y`
Codex: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -g -a codex -y`
Cursor: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -g -a cursor -y`
Gemini CLI: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add hoangsonww/Claude-Code-Agent-Monitor`

## Description

Identify anomalous sessions using Agent Monitor data, cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turn_count, high thinking_blocks, zero turn_duration).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Anomaly Alert

Detect anomalous sessions in Claude Code Agent Monitor data.

## Input

The user provides: **$ARGUMENTS**

This may be:
- "all" or empty (default: check all anomaly types)
- "cost" for cost anomalies only
- "duration" for duration anomalies only
- "errors" for error rate anomalies only
- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)

## Procedure

1. **Fetch baseline data** from `http://localhost:4820`:
   - `GET /api/sessions?limit=500`, historical sessions for baseline
   - `GET /api/analytics`, aggregated metrics
   - `GET /api/pricing/cost`, cost data per session

2. **Compute baselines** for each metric:
   - Mean, median, standard deviation
   - P25, P75, P90, P95, P99 percentiles
   - Interquartile range (IQR) for robust outlier detection

3. **Detect anomalies** using statistical thresholds:

   ### Cost Anomalies
   - Sessions costing >2σ above mean
   - Single sessions exceeding daily average
   - Sudden cost spikes (session-over-session increase >200%)

   ### Duration Anomalies
   - Sessions lasting >2σ above mean duration
   - Extremely short sessions (<1 minute) that still incur cost
   - Sessions with unusual active-vs-idle ratios

   ### Error Rate Anomalies
   - Sessions with error rates >2σ above baseline
   - New error types not seen in previous sessions
   - Sessions with >3 consecutive tool failures

   ### Behavioral Anomalies
   - Unusual tool combinations not seen before
   - Sessions with abnormally high compaction counts
   - Model switches mid-session (if unexpected)
   - Sessions with no tool usage (pure conversation)

   ### Token Anomalies
   - Input/output token ratio far from historical norm
   - Cache miss rate significantly higher than average
   - Token usage growing faster than session count

The rest: https://github.com/hoangsonww/Claude-Code-Agent-Monitor/blob/HEAD/plugins/ccam-insights/skills/anomaly-alert/SKILL.md