Finops Anomaly Intelligence

    2

    Turn AWS billing mysteries into 10-minute root cause reports by correlating cost spikes with engineering events.

    Free

    13 uses5.0 (1 review)

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    finops-anomaly-intelligence

    Example session with this skill installed

    Investigate why my AWS NAT Gateway costs spiked last week and link it to any recent infrastructure deployments or GitHub PRs.

    • Read your context and instructions
    • Compiled the finops-anomaly-intelligence

    HYPOTHESIS #1 [Confidence: HIGH | 87%]
    Root Cause: PR #4821 (@platform-team) removed S3 VPC Endpoint.
    Evidence: NatGatewayBytesOut +340% at 14:22 UTC matches PR merge time.
    Cost Delta: +$2,403 over 5 days.
    Monthly Projection: $18,240.
    Remediation: Re-add aws_vpc_endpoint.s3 to Terraform config.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    What it does

    FinOps Anomaly Intelligence is a root-cause analysis engine designed to investigate and resolve AWS cost spikes. It moves beyond simple alerts by cross-correlating AWS billing data (CUR/Cost Explorer) with engineering activities across GitHub, Jira, CloudWatch, and PagerDuty. At a high level, it detects the anomaly window, identifies impacted services, ranks root-cause hypotheses with confidence scores, and quantifies the "cost of inaction."

    Why use this skill

    Standard AWS alerts tell you that you spent too much, but they don't tell you why. Manually tracing a $10k spike through CloudTrail logs and PR history can take hours. This skill reduces that to 10 minutes. It is better than simple prompting because it uses a structured sequence of data extraction and correlation scripts to provide proof-based answers, not just hallucinations. It ensures developers see the financial impact of their code changes in real-time.

    Supported tools

    • Cloud: AWS (Cost Explorer, CUR, CloudWatch)
    • VCS/Task Management: GitHub Enterprise, Jira REST API
    • Observability/Ops: PagerDuty, Slack API
    • Frameworks: Boto3, Pandas, Python 3.10+

    What the output looks like

    The skill produces structured JSON data for workflows and human-readable Markdown reports. This includes a ranked Hypothesis Report linking specific PRs to dollar amounts, a Cost of Inaction table for executive reporting, and a pre-formatted Jira ticket ready for assignment to the responsible engineering team.

    • AWS Cost Explorer granularity: Cost Explorer data is available at daily granularity minimum. Sub-daily (hourly) anomaly detection requires direct CUR + Athena setup, which needs additional configuration per references/aws-cur-guide.md.

    • Hypothesis accuracy depends on integration coverage: Without GitHub and Jira credentials configured, hypotheses are generated from CloudWatch alone and will be marked LOW confidence. Manual validation is required.

    • Tag attribution requires tagging discipline: Resources without the required tags (team, env, service) cannot be team-attributed. The skill includes a tag coverage audit to surface gaps, but retroactive attribution is not possible.

    • No real-time streaming: The skill operates on batch data (pulled on-demand). It does not run as a persistent daemon or streaming pipeline. For continuous monitoring, pair with AWS Cost Anomaly Detection + SNS to trigger the skill on alerts.

    • Multi-account requires payer access: For AWS Organizations, credentials for the management (payer) account are needed to aggregate across linked accounts. Linked account-only credentials limit scope to a single account.

    • Jira/GitHub rate limits: High-volume repositories or dense Jira projects may hit API rate limits on large correlation windows (>90 days). Use smaller windows or paginate manually.

    • Historical data window: Cost Explorer API supports up to 12 months of historical data. CUR via Athena supports the full CUR retention period (configurable, typically 12–36 months).

    • Not a billing replacement: This skill does not replace AWS Cost Explorer, Kubecost, CloudHealth, or other dedicated FinOps platforms. It augments them with automated root-cause correlation.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    5.0
    1 review
    5
    1
    4
    0
    3
    0
    2
    0
    1
    0

    This skill has been used 13 times.

    Trust & safety

    Security scan

    Security scan passed 6 months ago

    • Free with an Agensi account

    Requires

    GitHub
    PagerDuty

    Permissions

    Terminal / Shell
    Network Access
    Environment Variables

    Allowed Hosts

    api.github.com
    api.pagerduty.com

    ### AWS IAM Permissions Attach the FinOps read-only policy defined in `references/integration-patterns.md` to your AWS IAM user or role. Minimum required: `ce:GetCostAndUsage`, `cloudwatch:DescribeAlarmHistory`. ## Security Notes - Never log or emit AWS account IDs, IAM ARNs, or API keys in output files. - CUR S3 bucket access requires IAM role with `cur:DescribeReportDefinitions` and `s3:GetObject` on the CUR bucket — least-privilege only. - Jira/GitHub tokens: read via env vars (`JIRA_TOKEN`, `GITHUB_TOKEN`) — never hardcode. - Slack webhook URLs: store in AWS Secrets Manager or `.env` (gitignored).

    Listed6 months ago

    What's inside

    Frequently Asked Questions

    Unlike standard budget alerts, this skill correlates cost spikes with engineering metadata from GitHub and Jira to pinpoint the exact code change or deployment that triggered the expense.

    The skill requires read-only access to AWS (Cost Explorer and CUR) and API integrations for GitHub, Jira, and Slack to perform its cross-correlation analysis.

    Current support is optimized for AWS environments; however, the data processing logic is designed to be extensible for multi-cloud FinOps workflows in future updates.

    Every purchase includes the core logic engine, pre-configured data extraction scripts, documentation for secure API setup, and access to all minor version updates and bug fixes for 12 months.

    The skill identifies the 'anomaly window' using your billing data and then scans your engineering tools for high-confidence matches, such as PR merges, infrastructure-as-code updates, or incident resolution periods.

    New in DevOps & Cloud