aws-anomaly-explainer

What This Skill Does

The aws-anomaly-explainer is a specialized diagnostic agent designed to mitigate financial risk within AWS environments. It functions as an automated cost-incident responder that bridges the gap between raw billing alerts and actionable engineering tasks. By ingesting billing data or anomaly notifications, the skill correlates specific cost spikes with architectural behaviors, such as unexpected Lambda retry loops, runaway EC2 Auto Scaling groups, or inefficient NAT Gateway routing. It translates complex Cost Explorer data into a structured format containing clear root causes, impact analysis, and ready-to-use Jira tickets, significantly reducing the Mean Time To Detection (MTTD) for cost-related incidents.

Installation

To integrate this skill into your environment, run the following command in your terminal or via the OpenClaw management console:

clawhub install openclaw/skills/skills/anmolnagpal/anomaly-explainer

Ensure that your environment has the necessary read-only permissions for your AWS billing console and CloudTrail logs to allow the agent to perform its diagnostic analysis effectively.

Use Cases

• End-of-Month Billing Audits: Quickly identifying which microservices contributed to an unexpected monthly increase.
• Real-time Alert Triage: During a high-severity billing alert, use this skill to instantly determine if the spike is a benign configuration drift or a malicious resource hijacking event.
• Cost Governance: Providing DevOps teams with concrete evidence-based recommendations for architecture changes, such as implementing VPC Endpoints to avoid NAT Gateway data transfer fees.

Example Prompts

1. "Here is the Cost Explorer report for last 24 hours showing a 300% spike in Data Transfer; please diagnose the root cause and provide a containment plan."
2. "My Lambda costs tripled overnight. Analyze the CloudTrail events during that window and tell me if this is a code-level regression or an external trigger issue."
3. "Review this billing diff and create a Jira ticket with all evidence, estimated impact, and prevention steps for our infrastructure team."

Tips & Limitations

To maximize the effectiveness of the agent, always provide the most granular time-window possible when uploading your logs. The agent's confidence level is directly tied to the quality of the data provided; sharing relevant CloudTrail logs alongside billing exports will always result in a higher 'Confidence' rating. Please note that this skill is read-only and does not automatically apply infrastructure changes; it provides the specific command or configuration change necessary for your team to safely implement the fix. Ensure you are following the Principle of Least Privilege when sharing your logs.