Skills Overview

Skills are included in the Cost Analyst plugin and are automatically invoked by Claude based on your prompt. You can also invoke them directly using the /skill-name slash command syntax in Claude Code.

understand-cloudzero-organization

Purpose

This foundational skill retrieves organization-specific context from CloudZero that is essential for accurate cost analysis. It should run once at the beginning of any analysis session.

When to use

• Required: At the start of any cost analysis conversation
• Before any other cost analysis skill
• When switching to analyze a different organization
• When you need to understand available custom dimensions

What it provides

• Custom dimensions: Your User:Defined dimensions (teams, products, features)
• Dimension meanings: Business context for each dimension
• Workflows: Organization-specific analysis patterns
• Naming conventions: How things are named in your organization
• Cost allocation policies: How shared costs are distributed

Example prompts

Load my CloudZero organization context

What custom dimensions are available in my organization?

Help me understand my organization's cost structure

Key behaviors

• Caches results within a conversation (doesn't re-fetch)
• Other skills automatically reference the cached context
• Should only run once per session unless switching organizations

tag-coverage-analysis

Purpose

Evaluates cloud resource tagging quality and coverage to identify untagged or poorly tagged resources, calculate coverage percentages, and improve cost allocation for showback/chargeback.

When to use

• Setting up showback/chargeback
• Improving cost allocation accuracy
• Governance and compliance reviews
• Identifying unattributed costs
• Measuring tagging policy effectiveness

Trigger keywords

tag, tagging, untagged, coverage, attribution, showback, chargeback, governance

Example prompts

What's my tag coverage?

How many resources are untagged?

Show me untagged costs by account

Which Environment tag values are being used?

Analyze tagging quality for showback accuracy

Output includes

• Executive summary: Overall coverage percentage
• Tag scorecard: Coverage for each critical tag
• Untagged cost breakdown: By service, account, region
• Tag value distribution: What values are used
• Multi-tag analysis: Resources with partial tagging
• Tag quality issues: Inconsistent values, typos
• Coverage trends: Is tagging improving over time?
• Recommendations: Prioritized tagging actions

Critical tags typically analyzed

• Environment (production, staging, development)
• Team or Owner
• Application
• CostCenter
• Project

cost-anomaly-detection

Purpose

Proactively scans for cost anomalies, unusual spending patterns, unexpected changes, or irregularities that may indicate waste, misconfiguration, security issues, or optimization opportunities.

When to use

• Proactive cost monitoring
• Weekly/monthly cost reviews
• Security incident detection
• Waste identification
• Before presenting cost reports

Trigger keywords

anomaly, unusual, abnormal, irregular, unexpected, odd, suspicious, detect issues

Example prompts

Are there any cost anomalies?

Scan for unusual spending patterns

Find any cost issues I should know about

Check for abnormal costs this week

Detect any suspicious cloud spending

Output includes

• Anomaly count: Total detected by severity
• Severity classification: High, medium, low priorities
• Detailed analysis: Each anomaly with impact and cause
• Anomaly dashboard: Summary by category and dimension
• Time-series visualization: When anomalies occurred
• New resources detected: Recently created high-cost items
• Security concerns: Patterns that may indicate issues
• Waste identification: Idle or unnecessary resources
• Action plan: Prioritized remediation steps

Anomaly types detected

• Spikes: Sudden increases then return to normal
• Step changes: Sudden persistent increases
• Gradual drift: Slow increases over time
• New appearances: Resources that didn't exist before
• Disappearances: Resources that suddenly stopped
• Pattern breaks: Usage patterns that changed

Detection approaches

• Statistical (standard deviation from mean)
• Percentage-based (>50% increase thresholds)
• Rate-of-change (unusual acceleration)
• Pattern matching (deviation from historical patterns)

cost-spike-investigation

Purpose

Investigates sudden cost increases by comparing recent spending to baseline periods and identifying which services, accounts, or resources are responsible for unexpected changes.

When to use

• Unexpected cost increases reported
• Monthly bills show significant jumps
• Alerts indicate spending anomalies
• Need to explain "why did costs go up?"
• Investigating budget overruns

Trigger keywords

spike, increase, jump, surge, anomaly, unexpected, sudden change, why did costs go up

Example prompts

My AWS costs spiked last week. Can you investigate what happened?

Why did my costs increase by 30% this month?

Something caused a cost jump on Tuesday. Find out what it was.

Investigate the cost anomaly in my production account

Output includes

• Executive summary: Total increase and primary cause
• Spike metrics: Baseline vs. spike period comparison
• Root cause analysis: Services/accounts driving the increase
• Time-series analysis: When the spike started and if it's ongoing
• Recommendations: Actions to address or prevent

Analysis approach

1. Establishes baseline (previous comparable period)
2. Compares total costs
3. Drills down by cloud provider, service, account
4. Identifies multi-dimensional contributors
5. Checks for new resources
6. Provides root cause and recommendations

top-cost-drivers

Purpose

Identifies and ranks the highest cloud cost contributors across services, accounts, teams, regions, or custom dimensions to help prioritize optimization efforts.

When to use

• Monthly cost reviews
• Budget planning and allocation
• Identifying optimization priorities
• Understanding spending distribution
• Answering "where is my money going?"

Trigger keywords

top, biggest, largest, highest, most expensive, cost drivers, where is money going, prioritize

Example prompts

What are my top 10 cost drivers this month?

Show me the biggest costs by service

Which accounts are spending the most?

What should I optimize first to reduce costs?

Rank my cloud spending by team

Output includes

• Executive summary: Total spend and top 3 drivers
• Ranked breakdown: Top items by selected dimension
• Percentage contribution: Each item's share of total
• Cumulative analysis: 80/20 rule identification
• Multi-dimensional breakdown: Services within accounts, and so on
• Optimization priorities: Where to focus efforts

Analysis patterns

• Service-first: Start with services, break down by accounts
• Organization-first: Start with teams/products, break down to services
• Account-first: Start with accounts, break down by services
• Environment-first: Start with prod/staging/dev, then drill down

cost-trend-analysis

Purpose

Analyzes cloud cost trends over time to identify spending patterns, growth rates, seasonality, and forecast future spending for budget planning.

When to use

• Understanding cost growth trajectory
• Budget planning and forecasting
• Quarterly or annual reviews
• Identifying acceleration or deceleration
• Predicting future spending

Trigger keywords

trend, growth, trajectory, pattern, forecast, over time, month over month, increasing, decreasing, velocity

Example prompts

How are my costs trending over the last 90 days?

Forecast next month's spending based on current trends

What's my month-over-month cost growth rate?

Are my EC2 costs accelerating or stabilizing?

Show me the cost trend by team over the last quarter

Output includes

• Trend direction: Growing, stable, or declining
• Growth rates: WoW, MoM, QoQ metrics
• Pattern analysis: Type of trend (linear, exponential, seasonal)
• Dimensional breakdown: Which services/accounts drive the trend
• Forecast: Projected future costs with confidence ranges
• Recommendations: Actions based on trend analysis

Granularity guidelines

• 1-3 months: Use daily granularity
• 3-6 months: Use weekly granularity
• 6+ months: Use monthly granularity

cost-comparison

Purpose

Compares cloud costs across different time periods, environments, accounts, regions, teams, or other dimensions to understand variations and benchmark efficiency.

When to use

• Comparing periods (this month vs. last month)
• Benchmarking environments (prod vs. staging)
• Evaluating team efficiency
• Understanding regional cost differences
• Measuring before/after optimization impact

Trigger keywords

compare, comparison, versus, vs, difference, between, benchmark, relative

Example prompts

Compare this month's costs to last month

How do production costs compare to staging and development?

Which region is more expensive for EC2?

Compare Team A's cloud spending to Team B

Show me the cost difference before and after my optimization effort

Output includes

• Executive summary: What's being compared and key difference
• High-level comparison: Total costs for each group
• Detailed breakdown: Service-by-service comparison
• Items unique to each group: Resources in one but not the other
• Normalized comparison: Per-unit metrics when scale differs
• Efficiency analysis: What efficient groups do differently
• Recommendations: How to improve higher-cost groups

Comparison types

• Time-based: Period vs. period
• Dimension-based: Environment vs. environment, team vs. team
• Multi-dimensional: Same service across different accounts

service-cost-deep-dive

Purpose

Performs detailed analysis of specific cloud service costs, breaking down by usage types, resources, regions, and accounts while identifying service-specific optimization opportunities.

When to use

• Targeted optimization for a specific service
• Understanding service cost composition
• Finding rightsizing opportunities
• Analyzing RI/Savings Plan coverage
• Investigating service-specific issues

Trigger keywords

deep dive, analyze, breakdown, detailed, specific service, EC2, RDS, S3, Lambda

Example prompts

Do a deep dive on my EC2 costs

Analyze my RDS spending in detail

Break down S3 costs by storage class and bucket

Why is Lambda so expensive? Analyze it for me.

Show me optimization opportunities for my compute services

Output includes

• Service overview: Total cost, trend, share of total spend
• Geographic distribution: Costs by region
• Account distribution: Costs by account
• Usage breakdown: By usage type or resource type
• Tag analysis: Environment, team, application breakdown
• Usage patterns: Time-based patterns
• Service-specific optimizations: Tailored recommendations
• Savings analysis: Current savings and additional potential

Service-specific analysis

The skill provides different analyses based on service type:

• Compute (EC2, Lambda): Instance types, utilization, spot eligibility
• Storage (S3, EBS): Storage classes, lifecycle policies, snapshots
• Database (RDS, DynamoDB): Instance sizing, Multi-AZ, backups
• Networking: Data transfer paths, NAT Gateway usage

custom-dimension-analysis

Purpose

Analyzes costs using organization-specific custom dimensions (User:Defined:*) like teams, products, features, or business units for business-aligned cost visibility and showback/chargeback.

When to use

• Showback and chargeback reporting
• Business-aligned cost discussions
• Product P&L analysis
• Team budget tracking
• Feature cost attribution

Trigger keywords

team, product, feature, business unit, application, custom, showback, chargeback, by custom dimension name, and so on

Example prompts

Show me costs by team for the last month

What's each product's cloud spending?

Break down costs by business unit

Which feature costs the most?

Generate a showback report by team

Output includes

• Cost distribution: Breakdown by dimension values
• Growth analysis: Trends for each dimension value
• Service mix: What services each team/product uses
• Infrastructure distribution: By account and region
• Comparative analysis: Efficiency across dimension values
• Unallocated costs: What can't be attributed
• Hierarchical analysis: If multiple custom dimensions exist
• Showback report: Ready for finance/business teams

Common analysis patterns

• Team-based: Rank teams by spending
• Product P&L: Full cost breakdown per product
• Environment management: Prod vs. non-prod ratios
• Business unit showback: Hierarchical breakdown
• Feature cost tracking: Per-feature economics

diff-cost-projection

Purpose

Analyzes code diffs for infrastructure cost impact. Detects changes to Terraform, CDK, CloudFormation, SAM, Kubernetes, scaling configurations, and application code that affect cloud spending. Queries CloudZero for current spend baselines on affected services and synthesizes cost impact estimates with confidence levels.

When to use

• Before merging infrastructure or application code changes
• During code review to flag cost implications
• Estimating the cost impact of a PR or branch
• Investigating whether a set of changes will increase cloud spend

Trigger keywords

cost impact, diff, PR cost, branch cost, infrastructure changes, will this increase costs

Invocation

/diff-cost-projection [target]

Where [target] is one of:

• (empty) — analyze all changes on the current branch vs. its base (default)
• feature/my-branch — analyze branch diff against base
• abc123..def456 — analyze a commit range

Example prompts

What's the cost impact of my changes?

Will this branch increase our cloud spend?

/diff-cost-projection 456

Check if my changes affect infrastructure costs

Output includes

• Verdict banner: Cost increase, decrease, mixed impact, or no impact
• Summary table: One row per change with service, current spend, estimated impact, and confidence
• Net estimated impact: Monthly and annualized figures with ranges for low-confidence items
• Detailed analysis: Per-change breakdown with file/line references, before/after values, baseline data, and reasoning
• Unchanged files: Brief list of files with no cost impact

Analysis approach

1. Retrieves the diff (branch, commit range, or workspace changes)
2. Classifies changed files into cost-relevance buckets (IaC, K8s, serverless, app code, skip)
3. Analyzes diff hunks for cost impact signals across four classes: direct resource changes, scaling changes, indirect application changes, and removals
4. Maps affected services to CloudZero dimensions
5. Queries CloudZero for current spend baselines
6. Synthesizes cost estimates with confidence levels (HIGH, MEDIUM, LOW)

Confidence levels

• HIGH: Direct resource change with clear before/after values and solid baseline data
• MEDIUM: Scaling changes with predictable multipliers, or direct changes without baseline
• LOW: Indirect application changes, complex interactions, or estimates dependent on runtime behavior

cost-projection

Purpose

Reads infrastructure-as-code definitions and projects what they will cost to run. Enumerates every resource, maps each to CloudZero dimensions, queries actual spend for existing resources, estimates costs for new ones, and produces a line-item breakdown with monthly totals.

When to use

• Before deploying new infrastructure
• When evaluating architecture options by cost
• During design reviews to compare cost of alternatives
• Estimating the monthly cost of a Terraform module, CDK stack, or CloudFormation template

Trigger keywords

project cost, how much will this cost, estimate deployment, monthly cost, infrastructure cost, stack cost

Invocation

/cost-projection [target]

Where [target] is one of:

• A file path — main.tf, lib/my-stack.ts, template.yaml
• A directory — terraform/, cdk/lib/ (analyzes all IaC files within)
• (empty) — auto-discovers all infrastructure in the codebase

Example prompts

How much will this stack cost?

What's the monthly cost of this Terraform module?

/cost-projection terraform/production/

Estimate cost for this CloudFormation template

Supported frameworks

• Terraform / OpenTofu
• AWS CDK (TypeScript, Python)
• CloudFormation
• SAM
• Serverless Framework
• Pulumi

Output includes

• Cost summary table: Grouped by category (compute, database, storage, messaging, networking) with monthly estimates and confidence levels
• Line items: Per-resource breakdown with type, configuration, monthly estimate, data source, and confidence
• Detailed analysis: Per-resource cost reasoning, configuration that drives cost, and data source (CloudZero actual spend vs. pricing estimate)
• Assumptions and caveats: Region, pricing model, and unresolved variable notes
• Optimization opportunities: RI/SP recommendations, rightsizing suggestions, or architecture alternatives

Analysis approach

1. Discovers IaC files (explicit path, directory scan, or full codebase auto-discovery)
2. Parses and enumerates all cloud resources with cost-relevant configuration
3. Maps resources to CloudZero dimensions
4. Queries CloudZero for actual spend on existing resources
5. Estimates costs for new resources using pricing lookups and similar-resource comparisons
6. Compiles a line-item projection with confidence levels

Confidence levels

• HIGH: Fixed-cost resources with specific configuration and pricing verified via lookup or CloudZero data
• MEDIUM: Fixed-cost resources using fallback formulas, or resources with some usage-dependent component
• LOW: Fully usage-dependent resources (S3, DynamoDB on-demand, SQS, data transfer) where cost scales with unknown traffic

optimize-triage

Purpose

Fetches top unaddressed recommendations from CloudZero Optimize, dispatches parallel research agents to enrich each one, applies SRE-level critique, and surfaces only the recommendations that are genuinely actionable. This skill is read-only and does not make any changes to resources or infrastructure.

When to use

• During weekly or monthly cost reviews
• When looking for the highest-impact optimization opportunities
• Prioritizing which recommendations to act on first
• Getting deeper context on CloudZero Optimize recommendations

Trigger keywords

optimize, recommendations, savings, cost optimization, waste, triage, what should I optimize

Example prompts

What are the top optimization opportunities?

Triage my CloudZero Optimize recommendations

Find the biggest cost savings I should act on

Review unaddressed recommendations over $1,000/month

Output includes

• Qualifying recommendations table: Ranked by savings with resource, account, impact, effort level, and confidence verdict
• Progressive results: Each recommendation is surfaced as its research agent completes
• Rollup table: Final summary with claimed vs. realistic savings, confidence verdicts, effort, suggested contacts, and next steps
• Per-recommendation report files: Detailed investigation reports written to ./optimize-triage-reports/

Research performed per recommendation

Each recommendation is investigated in parallel across multiple dimensions:

• IaC search: Checks if the resource is managed by Terraform, CDK, or other IaC
• Git history: Searches for recent changes, related PRs, and commit authors
• Signal sweep: Searches Jira, Slack, and CloudZero cost trends for context
• Cloud provider state: Queries current resource configuration and utilization (read-only)
• Category-specific checks: Tailored analysis based on recommendation type (idle resources, rightsizing, reservations, storage tiering, and so on)

Confidence verdicts

• HIGH: Multiple corroborating signals, no contradictions, clear owner
• MEDIUM: Mostly corroborated with one or more open questions
• LOW: Significant contradictions or missing context (suppressed from output)
• SKIP: Clear "do not act" signal found (excluded from output)

Skill Dependencies

All analysis skills depend on organization context. The diff-cost-projection and cost-projection skills also require a Git repository with infrastructure-as-code files.

understand-cloudzero-organization (run first)
       ↓
All other skills reference cached context