cost-anomaly — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cost-anomaly (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Per-session outlier detection — the diagnostic counterpart to cost-burn's aggregate-trend signal.
| Question | Skill |
|---|---|
| "Is the AGGREGATE rate accelerating?" | cost-burn |
| "Which SPECIFIC sessions are anomalous outliers?" | `cost-anomaly` ← this |
| "Could we have spent less in aggregate?" | cost-counterfactual |
| "When will we hit budget?" | cost-projection |
Implementation: scripts/anomaly.mjs.
session-* records from cost-tracking namespace.--since window (default: all-time).median(total_cost_usd) and MAD = median(|x - median|).z = 0.6745 * (x - median) / MAD
|z| > --threshold (default 3.5).| Approach | What breaks | ||
|---|---|---|---|
mean + sigma | A single $50 session inflates BOTH mean and sigma so badly that subsequent outliers hide inside the new "normal" band. Catastrophic on small samples. | ||
median + MAD | Both estimators ignore up to 50% of the data — the outliers themselves can't shift them. Robust on n=10. The canonical cutoff `\ | z\ | > 3.5` is from Iglewicz-Hoaglin (1993). |
| Sessions considered | 5 |
| Threshold (|modified z|) | 3.5 |
| Median spend | $0.100000 |
| MAD | $0.010000 |
| Min / Max | $0.080000 / $5.000000 |
| **Outliers found** | **1** |
## Outlier sessions
| Session | Spend | Deviation | Modified z | Direction |
| outlier- | $5.000000 | +$4.900000 | 330.505 | high |$ cost anomaly --alert-on-outliers 1
⚠ ALERT: found 1 outlier session(s) (|modified z| > 3.5); threshold was ≥1
exit 1
$ cost anomaly --alert-on-outliers 5
✓ found 1 outlier session(s); under threshold ≥5 — OK
exit 0# Fail the build if any session this week is a >3.5σ outlier
cost anomaly --since 7d --alert-on-outliers 1 || investigate-bad-sessionMost useful when paired with cost-burn:
cost burn --alert-on-acceleration-pct 50 || page-oncall # rate-of-change alert
cost anomaly --alert-on-outliers 1 || investigate # point-anomaly alertTogether they cover "is the average shifting?" AND "is there a single rogue session?" — both can fire independently.
| Direction | Likely cause | Action |
|---|---|---|
high | Long session, stuck in expensive tier, or runaway loop | cost report + cost conversation to investigate |
low | Crash, dropped session, or unfinished work | Verify the session completed normally |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.