anomaly-investigation

Provide the dataset and a precise description of the anomaly, including the metric, time window, and deviation size. The loop forms candidate causes, tests each against the data with Python snippets, and confirms the one cause that survives refutation and a positive test.

Anomaly investigation is reactive diagnosis of one specific, already-observed anomaly, narrowing candidates until a single cause is confirmed. Exploratory data analysis is open-ended discovery over a dataset with no particular anomaly in hand, which this Skill explicitly does not cover.

No. The dataset is treated as read-only ground truth that every test is checked against. All analysis snippets, outputs, and logs are written to a self-contained sandbox directory with no escapes outside it.

Snippets are stdlib-first, using csv and statistics by default. If pandas or numpy would help, the snippet probes with a try/except ImportError and degrades to a stdlib path, or asks consent before installing anything.

When two mechanistically different candidates make identical predictions in the available data, they are reported as a single confirmed cause at that data resolution. The report names the additional data, such as finer-grained logs or raw event records, that would distinguish them.

Avoid it when you have no specific anomaly in hand and want open-ended dataset exploration, or when you need to verify an external claim against sources. It is designed for reactive diagnosis of one known anomaly, with a default budget of 8 iterations.