attribution-anomaly-scan

name	attribution-anomaly-scan
description	Use this skill when the user asks about anomalies, risk flags, style drift, attribution drift, concentration alerts, or anything unusual in attribution patterns. Also use proactively when generating reports to check for HIGH severity items before presenting findings.

Attribution Anomaly Scan

When to Activate

Trigger when user asks: "anomalies", "risk flags", "attribution drift", "any alerts", "style drift", "concentration risk", "anything unusual", "scan portfolios", "risk scan", "what should I be concerned about"

Detection Rules (9 total)

Rule	What It Detects	Threshold
FACTOR_DRIFT_ALERT	Factor exposure >2sigma from trailing average	z-score > 2.0
CONCENTRATION_ALERT	Single sector >60% of active return	share > 0.6
SINGLE_FACTOR_DOMINANCE	One factor >70% of systematic return	share > 0.7
STYLE_INCONSISTENCY	Strategy name vs actual exposure mismatch	Value fund with Growth tilt
ATTRIBUTION_SPIKE	Monthly return >2sigma from trailing	z-score > 2.0
ALLOCATION_DRIFT_ALERT	Sector weight >2sigma from 6M rolling average	z-score > 2.0
SELECTION_REVERSAL_ALERT	Selection effect flips sign vs trailing 3M	sign change + magnitude > 10bps
WEIGHT_CONCENTRATION_ALERT	Single sector >40% of portfolio weight	weight > 0.40
CLASSIFICATION_SENSITIVITY_ALERT	Sector vs country attribution diverge significantly	divergence > 2%

Workflow

Step 1: Scan All Portfolios

Tool: anomaly_detector Query: Latest month, all portfolios, ordered by anomaly severity (HIGH first)

Step 2: Present Findings

Format by severity:

HIGH (3+ flags): Full detail with specific flag names, affected sectors/factors, and magnitudes MEDIUM (1-2 flags): Count + most significant flag LOW (0 flags): Count only ("X portfolios have no anomalies")

STOPPING POINT

"Found [N] HIGH severity items across [M] portfolios. I can:

• Drill into a specific portfolio to see what changed in its attribution
• Show the drift timeline for the most flagged portfolio
• Run a stress test on the flagged portfolio to assess forward risk

Which would be most useful?"

Step 3a: Drill into Portfolio Attribution (if user chooses)

Tool: brinson_analyzer Query: Recent 3-6 months for the flagged portfolio to show the attribution trend and when things changed

Step 3b: Drift Timeline (if user chooses)

Tool: brinson_analyzer (rolling analytics via the view) Query: Month-by-month exposure or weight history showing the drift building

Step 3c: Stress Test (if user chooses)

Tool: scenario_sensitivity or backtest_historical_stress Apply relevant stress scenario to the portfolio with drifted exposures

Output Template

## Attribution Anomaly Scan — [Date]

### HIGH Severity ([N] portfolios)

| Portfolio | Flags | Key Detail |
|-----------|-------|-----------|
| [Name] | [Flag1], [Flag2], [Flag3] | [Most actionable detail] |

### MEDIUM Severity ([N] portfolios)
- [Portfolio]: [Primary flag] — [1-line summary]

### LOW Severity ([N] portfolios)
No action required.

### Recommended Actions
1. [Highest priority action for most severe item]
2. [Second priority]

Stopping Points

• After Step 2: Offer drill-down options for flagged portfolios
• After Step 3: "Would you like to scan for a different date or run the full attribution report for this portfolio?"