# Anomaly Alert

> >

- **Type:** Skill
- **Install:** `agentstack add skill-hoangsonww-claude-code-agent-monitor-anomaly-alert`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [hoangsonww](https://agentstack.voostack.com/s/hoangsonww)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [hoangsonww](https://github.com/hoangsonww)
- **Source:** https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-insights/skills/anomaly-alert
- **Website:** https://hoangsonww.github.io/Claude-Code-Agent-Monitor/

## Install

```sh
agentstack add skill-hoangsonww-claude-code-agent-monitor-anomaly-alert
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Anomaly Alert

Detect anomalous sessions in Claude Code Agent Monitor data.

## Input

The user provides: **$ARGUMENTS**

This may be:
- "all" or empty (default: check all anomaly types)
- "cost" for cost anomalies only
- "duration" for duration anomalies only
- "errors" for error rate anomalies only
- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)

## Procedure

1. **Fetch baseline data** from `http://localhost:4820`:
   - `GET /api/sessions?limit=500` — historical sessions for baseline
   - `GET /api/analytics` — aggregated metrics
   - `GET /api/pricing/cost` — cost data per session

2. **Compute baselines** for each metric:
   - Mean, median, standard deviation
   - P25, P75, P90, P95, P99 percentiles
   - Interquartile range (IQR) for robust outlier detection

3. **Detect anomalies** using statistical thresholds:

   ### Cost Anomalies
   - Sessions costing >2σ above mean
   - Single sessions exceeding daily average
   - Sudden cost spikes (session-over-session increase >200%)

   ### Duration Anomalies
   - Sessions lasting >2σ above mean duration
   - Extremely short sessions (2σ above baseline
   - New error types not seen in previous sessions
   - Sessions with >3 consecutive tool failures

   ### Behavioral Anomalies
   - Unusual tool combinations not seen before
   - Sessions with abnormally high compaction counts
   - Model switches mid-session (if unexpected)
   - Sessions with no tool usage (pure conversation)

   ### Token Anomalies
   - Input/output token ratio far from historical norm
   - Cache miss rate significantly higher than average
   - Token usage growing faster than session count

4. **Classify each anomaly**:
   - **🔴 Critical**: Likely indicates a real problem requiring attention
   - **🟡 Warning**: Unusual but may be expected for certain tasks
   - **🔵 Info**: Interesting deviation worth noting

## Output Format

Present as an **Anomaly Report**:

```
═══════════════════════════════════════════════
  ANOMALY DETECTION REPORT
  Analyzed: N sessions | Baseline: last 30 days
  Anomalies found: N (🔴 N critical, 🟡 N warn, 🔵 N info)
═══════════════════════════════════════════════
```

For each anomaly:
- Session ID and timestamp
- Anomaly type and severity
- Observed value vs expected range
- Possible explanation
- Recommended action (if any)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hoangsonww](https://github.com/hoangsonww)
- **Source:** [hoangsonww/Claude-Code-Agent-Monitor](https://github.com/hoangsonww/Claude-Code-Agent-Monitor)
- **License:** MIT
- **Homepage:** https://hoangsonww.github.io/Claude-Code-Agent-Monitor/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hoangsonww-claude-code-agent-monitor-anomaly-alert
- Seller: https://agentstack.voostack.com/s/hoangsonww
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.