Pattern Detection

When to use this skill

• The main job is finding repeated shapes or suspicious irregularities, not fully explaining or fixing them yet.
• The user needs a reusable scan, shortlist, grouped candidate set, or anomaly triage across code, logs/events, telemetry, or metric tables.
• The prompt is really asking "what patterns keep showing up?", "what looks off?", or "what should we inspect first?" even if it never says "pattern detection".
• The user needs confidence notes, false-positive risks, or the fastest validation step, not a raw wall of hits.
• The request mentions patterns, anomalies, outliers, repeated failures, suspicious spikes, odd cohorts, rule packs, signatures, code smells, anti-patterns, fraud signals, or recurring issue families.

Do not use this skill as the main workflow when:

• The real job is root-cause incident reconstruction from logs or traces → log-analysis
• The real job is decision-ready KPI explanation, experiment analysis, or stakeholder reporting → data-analysis
• The real job is repo tracing, ownership lookup, or metric-definition search → codebase-search
• The real job is security remediation, policy design, or vulnerability hardening → security-best-practices or code-review
• The real job is alert tuning, telemetry coverage, or incident operations → monitoring-observability

Core idea

pattern-detection should behave like a detection packet router, not a giant bag of regexes.