by PromptSpace
Turn AWS billing mysteries into 10-minute root cause reports by correlating cost spikes with engineering events.
Free
One-time purchase
HYPOTHESIS #1 [Confidence: HIGH | 87%] Root Cause: PR #4821 (@platform-team) removed S3 VPC Endpoint. Evidence: NatGatewayBytesOut +340% at 14:22 UTC matches PR merge time. Cost Delta: +$2,403 over 5 days. Monthly Projection: $18,240. Remediation: Re-add aws_vpc_endpoint.s3 to Terraform config.
by PromptSpace
Turn AWS billing mysteries into 10-minute root cause reports by correlating cost spikes with engineering events.
Free
One-time purchase
⚡ Skill ready to install in Claude Code, Gemini CLI, or any MCP-compatible client. Read the install guides →
HYPOTHESIS #1 [Confidence: HIGH | 87%] Root Cause: PR #4821 (@platform-team) removed S3 VPC Endpoint. Evidence: NatGatewayBytesOut +340% at 14:22 UTC matches PR merge time. Cost Delta: +$2,403 over 5 days. Monthly Projection: $18,240. Remediation: Re-add aws_vpc_endpoint.s3 to Terraform config.
FinOps Anomaly Intelligence is a root-cause analysis engine designed to investigate and resolve AWS cost spikes. It moves beyond simple alerts by cross-correlating AWS billing data (CUR/Cost Explorer) with engineering activities across GitHub, Jira, CloudWatch, and PagerDuty. At a high level, it detects the anomaly window, identifies impacted services, ranks root-cause hypotheses with confidence scores, and quantifies the "cost of inaction."
Standard AWS alerts tell you that you spent too much, but they don't tell you why. Manually tracing a $10k spike through CloudTrail logs and PR history can take hours. This skill reduces that to 10 minutes. It is better than simple prompting because it uses a structured sequence of data extraction and correlation scripts to provide proof-based answers, not just hallucinations. It ensures developers see the financial impact of their code changes in real-time.
The skill produces structured JSON data for workflows and human-readable Markdown reports. This includes a ranked Hypothesis Report linking specific PRs to dollar amounts, a Cost of Inaction table for executive reporting, and a pre-formatted Jira ticket ready for assignment to the responsible engineering team.
AWS Cost Explorer granularity: Cost Explorer data is available at daily granularity minimum. Sub-daily (hourly) anomaly detection requires direct CUR + Athena setup, which needs additional configuration per references/aws-cur-guide.md.
Hypothesis accuracy depends on integration coverage: Without GitHub and Jira credentials configured, hypotheses are generated from CloudWatch alone and will be marked LOW confidence. Manual validation is required.
Tag attribution requires tagging discipline: Resources without the required tags (team, env, service) cannot be team-attributed. The skill includes a tag coverage audit to surface gaps, but retroactive attribution is not possible.
No real-time streaming: The skill operates on batch data (pulled on-demand). It does not run as a persistent daemon or streaming pipeline. For continuous monitoring, pair with AWS Cost Anomaly Detection + SNS to trigger the skill on alerts.
Multi-account requires payer access: For AWS Organizations, credentials for the management (payer) account are needed to aggregate across linked accounts. Linked account-only credentials limit scope to a single account.
Jira/GitHub rate limits: High-volume repositories or dense Jira projects may hit API rate limits on large correlation windows (>90 days). Use smaller windows or paginate manually.
Historical data window: Cost Explorer API supports up to 12 months of historical data. CUR via Athena supports the full CUR retention period (configurable, typically 12–36 months).
Not a billing replacement: This skill does not replace AWS Cost Explorer, Kubecost, CloudHealth, or other dedicated FinOps platforms. It augments them with automated root-cause correlation.
mkdir -p ~/.claude/skills/finops-anomaly-intelligence && curl -s -X POST 'https://api.promptspace.in/api/skills/finops-anomaly-intelligence/install' | python3 -c "import sys,json; sys.stdout.write(json.load(sys.stdin).get('installInstructions') or '')" > ~/.claude/skills/finops-anomaly-intelligence/SKILL.mdFree skills install directly. Paid skills require purchase - use the download button above after buying.
Security Scanned
Passed automated security review
No special permissions declared or detected
OpenClaw, Cursor, Claude Code, Codex CLI
PromptSpace
We build AI agent skill packages for content creators. Specializing in Chinese social media automation.