# Attribution Anomaly Scan

> Use this skill when the user asks about anomalies, risk flags, style drift, attribution drift, concentration alerts, or anything unusual in attribution patterns. Also use proactively when generating reports to check for HIGH severity items before presenting findings.

- Skill: `snowflake-labs/attribution-anomaly-scan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add snowflake-labs/attribution-anomaly-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/snowflake-labs/attribution-anomaly-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: snowflake-labs (https://skillmd.com/u/snowflake-labs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/snowflake-labs/attribution-anomaly-scan

---


# Attribution Anomaly Scan

## When to Activate

Trigger when user asks: "anomalies", "risk flags", "attribution drift", "any alerts", "style drift", "concentration risk", "anything unusual", "scan portfolios", "risk scan", "what should I be concerned about"

## Detection Rules (9 total)

| Rule | What It Detects | Threshold |
|------|----------------|-----------|
| FACTOR_DRIFT_ALERT | Factor exposure >2sigma from trailing average | z-score > 2.0 |
| CONCENTRATION_ALERT | Single sector >60% of active return | share > 0.6 |
| SINGLE_FACTOR_DOMINANCE | One factor >70% of systematic return | share > 0.7 |
| STYLE_INCONSISTENCY | Strategy name vs actual exposure mismatch | Value fund with Growth tilt |
| ATTRIBUTION_SPIKE | Monthly return >2sigma from trailing | z-score > 2.0 |
| ALLOCATION_DRIFT_ALERT | Sector weight >2sigma from 6M rolling average | z-score > 2.0 |
| SELECTION_REVERSAL_ALERT | Selection effect flips sign vs trailing 3M | sign change + magnitude > 10bps |
| WEIGHT_CONCENTRATION_ALERT | Single sector >40% of portfolio weight | weight > 0.40 |
| CLASSIFICATION_SENSITIVITY_ALERT | Sector vs country attribution diverge significantly | divergence > 2% |

## Workflow

### Step 1: Scan All Portfolios

Tool: `anomaly_detector`
Query: Latest month, all portfolios, ordered by anomaly severity (HIGH first)

### Step 2: Present Findings

Format by severity:

**HIGH** (3+ flags): Full detail with specific flag names, affected sectors/factors, and magnitudes
**MEDIUM** (1-2 flags): Count + most significant flag
**LOW** (0 flags): Count only ("X portfolios have no anomalies")

### STOPPING POINT

"Found [N] HIGH severity items across [M] portfolios. I can:
- **Drill into a specific portfolio** to see what changed in its attribution
- **Show the drift timeline** for the most flagged portfolio
- **Run a stress test** on the flagged portfolio to assess forward risk

Which would be most useful?"

### Step 3a: Drill into Portfolio Attribution (if user chooses)

Tool: `brinson_analyzer`
Query: Recent 3-6 months for the flagged portfolio to show the attribution trend and when things changed

### Step 3b: Drift Timeline (if user chooses)

Tool: `brinson_analyzer` (rolling analytics via the view)
Query: Month-by-month exposure or weight history showing the drift building

### Step 3c: Stress Test (if user chooses)

Tool: `scenario_sensitivity` or `backtest_historical_stress`
Apply relevant stress scenario to the portfolio with drifted exposures

## Output Template

```
## Attribution Anomaly Scan — [Date]

### HIGH Severity ([N] portfolios)

| Portfolio | Flags | Key Detail |
|-----------|-------|-----------|
| [Name] | [Flag1], [Flag2], [Flag3] | [Most actionable detail] |

### MEDIUM Severity ([N] portfolios)
- [Portfolio]: [Primary flag] — [1-line summary]

### LOW Severity ([N] portfolios)
No action required.

### Recommended Actions
1. [Highest priority action for most severe item]
2. [Second priority]
```

## Stopping Points

- After Step 2: Offer drill-down options for flagged portfolios
- After Step 3: "Would you like to scan for a different date or run the full attribution report for this portfolio?"