tune-anomaly-detection — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tune-anomaly-detection (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Threshold | Detection Rate | False Positive Rate | Use Case |
|---|---|---|---|
| 1.5σ | ~95% recall | ~25% FP | Extremely sensitive (security) |
| 2.0σ | ~90% recall | ~15% FP | High sensitivity (SLA metrics) |
| 2.5σ | ~85% recall | ~8% FP | Balanced (general operations) |
| 3.0σ | ~75% recall | ~3% FP | Low noise (cost metrics) |
| 4.0σ | ~60% recall | ~1% FP | Only major anomalies |
Per-metric threshold tuning:
| Metric | Recommended σ | Why |
|---|---|---|
| Error rate | 2.0σ | Sensitive — errors impact users directly |
| CPU usage | 2.5σ | Normal fluctuation is expected |
| Latency p99 | 2.0σ | User experience critical |
| Cost per hour | 3.0σ | Spikes may be legitimate (batch jobs) |
| Request count | 3.0σ | Traffic varies naturally |
| Memory usage | 2.5σ | Gradual leaks need detection |
| Window | Detection Latency | False Positives | Best For |
|---|---|---|---|
| 1 minute | Very fast | High (noisy) | Real-time trading, security |
| 5 minutes | Fast | Medium | API error rates, availability |
| 15 minutes | Moderate | Low | Infrastructure metrics |
| 1 hour | Slow | Very low | Cost metrics, batch jobs |
| 1 day | Very slow | Minimal | Trend detection, capacity |
Rule: Shorter window = faster detection but noisier. Use 5-min for SLA metrics, 15-min for infra, 1-hour for cost.
| Rule | Implementation | Reduces |
|---|---|---|
| Dedup window | Suppress duplicate alerts for same metric within 30 min | 50-70% volume |
| Maintenance window | Skip detection during known maintenance | Eliminates planned spikes |
| Auto-scaling filter | Ignore anomalies during scale events | Eliminates scaling noise |
| Dependency cascade | Group correlated alerts into single incident | 60-80% volume |
| Severity escalation | Start Sev 3, escalate if persists 15 min | Reduces Sev 1 noise |
| Pattern | Detection Method | Configuration |
|---|---|---|
| Daily (9-5 traffic) | Time-of-day baseline | Track hourly avg over 7 days |
| Weekly (Mon-Fri) | Day-of-week baseline | Track daily avg over 4 weeks |
| Monthly (billing cycle) | Monthly pattern | Track monthly avg over 3 months |
| Event-driven (sales) | Event calendar | Exclude known event periods |
// Seasonal baseline KQL
let hourly_baseline = metrics
| where timestamp between(ago(7d)..ago(1d))
| summarize avg_value=avg(value), std_value=stdev(value)
by hour_of_day=hourofday(timestamp), metric_name;
metrics
| where timestamp > ago(1h)
| extend hour_of_day = hourofday(timestamp)
| join kind=leftouter hourly_baseline on hour_of_day, metric_name
| extend z_score = abs(value - avg_value) / std_value
| where z_score > 2.5| Parameter | Default | Optimized | Impact |
|---|---|---|---|
| Context window | 1 hour | 4 hours | More history = better analysis |
| Correlated metrics | Top 3 | Top 5 | More correlated data = better diagnosis |
| Deployment history | None | Last 24h | Deployment correlation = most common cause |
| LLM model | gpt-4o | gpt-4o | Keep full model for reasoning |
| Max tokens | 500 | 800 | Allow longer analysis for complex anomalies |
After tuning, compare:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.