[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-finding-deleted-feature-flags":3,"mdc-lx9iw7-key":34,"related-org-posthog-finding-deleted-feature-flags":736,"related-repo-posthog-finding-deleted-feature-flags":909},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"finding-deleted-feature-flags","find recently deleted feature flags","Find feature flags that were soft-deleted in the active project within a recent time window. Use when the user asks \"what flags were deleted in the last N days\", \"show me recently deleted feature flags\", \"who deleted flag X\", \"audit recent flag deletions\", or anything similar. Handles the non-obvious gotcha that system.feature_flags exposes the deleted boolean but does not expose a deletion timestamp — the actual deleted-at time lives in the per-flag activity log and must be cross-referenced.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Operations","operations","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Feature Flags","feature-flags",{"name":21,"slug":22,"type":15},"Product Management","product-management",56,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fskills","2026-05-27T07:15:31.02896",null,4,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"PostHog skills (under construction)","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fomnibus\u002Ffinding-deleted-feature-flags","---\nname: finding-deleted-feature-flags\ndescription: 'Find feature flags that were soft-deleted in the active project within a recent time window. Use when the user asks \"what flags were deleted in the last N days\", \"show me recently deleted feature flags\", \"who deleted flag X\", \"audit recent flag deletions\", or anything similar. Handles the non-obvious gotcha that system.feature_flags exposes the deleted boolean but does not expose a deletion timestamp — the actual deleted-at time lives in the per-flag activity log and must be cross-referenced.'\n---\n\n# Finding recently deleted feature flags\n\nThis skill produces a list of feature flags that were soft-deleted in the active project within a user-specified time window, along with who deleted each one and when.\n\n## When to use this skill\n\n- The user asks \"what flags got deleted last week \u002F in the last N days?\"\n- The user wants an audit of recent flag deletions (who, when, what was removed)\n- The user wants to find when a specific flag was deleted, or by whom\n- Any \"recently deleted feature flags\" framing\n\nDon't use this for **active** stale-flag cleanup — that's `cleaning-up-stale-feature-flags`. This skill is for flags that have already been removed.\n\n## The gotcha that makes this non-trivial\n\n`system.feature_flags` exposes `deleted` as a boolean but does **not** expose `deleted_at`, `updated_at`, or `last_modified_at`. There's no way to filter soft-deleted flags by deletion time in a single SQL query — trying to use those columns will return `Unable to resolve field`.\n\nThe actual deletion timestamp lives in the per-flag activity log, reachable only via `posthog:feature-flags-activity-retrieve` (one call per flag id). There is no bulk activity endpoint.\n\nSo the workflow is two-stage: SQL to enumerate candidates, then parallel activity-log lookups to find each deletion event.\n\n## Workflow\n\n### 1. Clarify the window if ambiguous\n\n\"Last week\" is ambiguous — it can mean rolling 7 days from now, or the previous calendar week (Mon–Sun). If the user wasn't explicit, ask, or surface both interpretations in the final report.\n\nAlways compute the cutoff in UTC and keep the user's local interpretation in your head separately.\n\n### 2. Enumerate soft-deleted flags via SQL\n\nQuery `system.feature_flags` for `deleted = true` in the active project, ordered by `created_at DESC`:\n\n```sql\nSELECT id, key, created_at\nFROM system.feature_flags\nWHERE team_id = \u003Cteam_id> AND deleted = true\nORDER BY created_at DESC\nLIMIT 100\n```\n\nOrder by `created_at DESC` because deletions empirically cluster near creation — most flags get deleted within a few days of being created — so walking the most-recently-created candidates first finds recent deletions fastest. **But** this is a heuristic, not a guarantee: an older flag deleted recently won't be at the top of this list. Be explicit about that limitation when you report.\n\n`team_id` defaults to the active project, but include it explicitly for clarity.\n\n### 3. Fan out activity-log lookups in parallel\n\nFor each candidate id, call `posthog:feature-flags-activity-retrieve` with `limit: 5, page: 1`. **Issue all calls in one message so they run concurrently** — sequential calls are dramatically slower.\n\n```text\ncall feature-flags-activity-retrieve {\"id\": \u003Cflag_id>, \"limit\": 5, \"page\": 1}\n```\n\nReasonable batch sizes:\n\n- \"last 7 days\" → top 20–25 candidates\n- \"last 30 days\" → top 50\n- \"last 90 days\" → walk the full ~100\n\nIf you sample fewer than the full set, say so in the report and offer to walk the rest as a follow-up.\n\n### 4. Extract the deletion event from each response\n\nIn each response, find the entry where `activity == \"deleted\"`. That entry's `created_at` is the actual deletion time, and `user.email` \u002F `user.first_name` identify the deleter.\n\nThe deletion event's `detail.changes` array typically contains:\n\n- `{field: \"deleted\", before: false, after: true}` — the actual delete\n- `{field: \"key\", before: \"\u003Coriginal>\", after: \"\u003Coriginal>:deleted:\u003Cid>\"}` — Django renames the key on delete to free up the unique constraint\n- `{field: \"name\", ...}` — the name sometimes gets reset\n\nFor most flags there's exactly one delete event. If a flag has been deleted-and-restored multiple times, take the most recent `activity: deleted` event within the window.\n\n### 5. Filter and report\n\nFilter the collected deletion events to those whose `created_at` falls inside the requested window. Present as a table:\n\n| Flag ID | Key | Deleted at (UTC) | Deleted by |\n\nState your methodology in the report (how many candidates you walked vs. how many soft-deleted flags exist total), so the user knows what was and wasn't checked.\n\n## Watch-outs\n\n- **Borderline cases**: if a deletion is within ~1 hour of the window cutoff, surface it as borderline rather than silently dropping it.\n- **Don't trust `created_at` as a proxy for deletion time**: a flag created in 2024 can still have been deleted last week. The activity log is the only authority.\n- **Renamed keys are normal**: a flag with key `foo:deleted:12345` was the flag originally keyed `foo`. The original key\u002Fname appears in the delete event's `detail.changes` array — surface that to the user, not the renamed form.\n- **Walking all candidates is possible but slow**: ~100 parallel activity-log calls is doable. Offer it as a follow-up rather than the default for short windows.\n\n## Example interaction\n\nUser: \"what flags got deleted in the last week?\"\n\n1. Clarify if needed, or note both interpretations: \"rolling 7 days ending now (UTC), in the active project\"\n2. Run the SQL enumeration to get up to 100 soft-deleted candidates ordered by `created_at DESC`\n3. Fan out activity-log lookups in parallel across the top ~25 candidates\n4. Extract `activity: deleted` entries; filter to those whose `created_at >= now - 7 days`\n5. Report:\n\n   ```text\n   Found 2 feature flags deleted in the last 7 days (rolling, ending 2026-05-22 19:04 UTC):\n\n   | Flag ID | Key                                       | Deleted at (UTC)     | Deleted by  |\n   |---------|-------------------------------------------|----------------------|-------------|\n   | 687432  | high_frequency_alerts                     | 2026-05-22 17:23     | Matt P.     |\n   | 676665  | tasks-sendblue-prewarmed-sandbox-pool     | 2026-05-15 13:45     | Alessandro  |\n\n   Methodology: walked the activity log for the 25 most-recently-created soft-deleted\n   flags. Team 2 has ~100 soft-deleted flags total; the remaining ~75 were created\n   before mid-March 2026 and were not checked. Want me to walk the rest?\n   ```\n\n## Related tools\n\n- `posthog:execute-sql`: Used in step 2 to enumerate soft-deleted candidates against `system.feature_flags`\n- `posthog:feature-flags-activity-retrieve`: Used in step 3 to find the actual deletion event for each candidate\n- `posthog:feature-flag-get-definition`: Useful if the user then wants to inspect what the deleted flag looked like\n",{"data":35,"body":36},{"name":4,"description":6},{"type":37,"children":38},"root",[39,48,54,61,86,108,114,172,185,190,196,203,208,213,219,247,304,323,334,340,367,377,382,400,405,411,448,461,497,510,516,528,533,538,544,617,623,628,684,690,730],{"type":40,"tag":41,"props":42,"children":44},"element","h1",{"id":43},"finding-recently-deleted-feature-flags",[45],{"type":46,"value":47},"text","Finding recently deleted feature flags",{"type":40,"tag":49,"props":50,"children":51},"p",{},[52],{"type":46,"value":53},"This skill produces a list of feature flags that were soft-deleted in the active project within a user-specified time window, along with who deleted each one and when.",{"type":40,"tag":55,"props":56,"children":58},"h2",{"id":57},"when-to-use-this-skill",[59],{"type":46,"value":60},"When to use this skill",{"type":40,"tag":62,"props":63,"children":64},"ul",{},[65,71,76,81],{"type":40,"tag":66,"props":67,"children":68},"li",{},[69],{"type":46,"value":70},"The user asks \"what flags got deleted last week \u002F in the last N days?\"",{"type":40,"tag":66,"props":72,"children":73},{},[74],{"type":46,"value":75},"The user wants an audit of recent flag deletions (who, when, what was removed)",{"type":40,"tag":66,"props":77,"children":78},{},[79],{"type":46,"value":80},"The user wants to find when a specific flag was deleted, or by whom",{"type":40,"tag":66,"props":82,"children":83},{},[84],{"type":46,"value":85},"Any \"recently deleted feature flags\" framing",{"type":40,"tag":49,"props":87,"children":88},{},[89,91,97,99,106],{"type":46,"value":90},"Don't use this for ",{"type":40,"tag":92,"props":93,"children":94},"strong",{},[95],{"type":46,"value":96},"active",{"type":46,"value":98}," stale-flag cleanup — that's ",{"type":40,"tag":100,"props":101,"children":103},"code",{"className":102},[],[104],{"type":46,"value":105},"cleaning-up-stale-feature-flags",{"type":46,"value":107},". This skill is for flags that have already been removed.",{"type":40,"tag":55,"props":109,"children":111},{"id":110},"the-gotcha-that-makes-this-non-trivial",[112],{"type":46,"value":113},"The gotcha that makes this non-trivial",{"type":40,"tag":49,"props":115,"children":116},{},[117,123,125,131,133,138,140,146,148,154,156,162,164,170],{"type":40,"tag":100,"props":118,"children":120},{"className":119},[],[121],{"type":46,"value":122},"system.feature_flags",{"type":46,"value":124}," exposes ",{"type":40,"tag":100,"props":126,"children":128},{"className":127},[],[129],{"type":46,"value":130},"deleted",{"type":46,"value":132}," as a boolean but does ",{"type":40,"tag":92,"props":134,"children":135},{},[136],{"type":46,"value":137},"not",{"type":46,"value":139}," expose ",{"type":40,"tag":100,"props":141,"children":143},{"className":142},[],[144],{"type":46,"value":145},"deleted_at",{"type":46,"value":147},", ",{"type":40,"tag":100,"props":149,"children":151},{"className":150},[],[152],{"type":46,"value":153},"updated_at",{"type":46,"value":155},", or ",{"type":40,"tag":100,"props":157,"children":159},{"className":158},[],[160],{"type":46,"value":161},"last_modified_at",{"type":46,"value":163},". There's no way to filter soft-deleted flags by deletion time in a single SQL query — trying to use those columns will return ",{"type":40,"tag":100,"props":165,"children":167},{"className":166},[],[168],{"type":46,"value":169},"Unable to resolve field",{"type":46,"value":171},".",{"type":40,"tag":49,"props":173,"children":174},{},[175,177,183],{"type":46,"value":176},"The actual deletion timestamp lives in the per-flag activity log, reachable only via ",{"type":40,"tag":100,"props":178,"children":180},{"className":179},[],[181],{"type":46,"value":182},"posthog:feature-flags-activity-retrieve",{"type":46,"value":184}," (one call per flag id). There is no bulk activity endpoint.",{"type":40,"tag":49,"props":186,"children":187},{},[188],{"type":46,"value":189},"So the workflow is two-stage: SQL to enumerate candidates, then parallel activity-log lookups to find each deletion event.",{"type":40,"tag":55,"props":191,"children":193},{"id":192},"workflow",[194],{"type":46,"value":195},"Workflow",{"type":40,"tag":197,"props":198,"children":200},"h3",{"id":199},"_1-clarify-the-window-if-ambiguous",[201],{"type":46,"value":202},"1. Clarify the window if ambiguous",{"type":40,"tag":49,"props":204,"children":205},{},[206],{"type":46,"value":207},"\"Last week\" is ambiguous — it can mean rolling 7 days from now, or the previous calendar week (Mon–Sun). If the user wasn't explicit, ask, or surface both interpretations in the final report.",{"type":40,"tag":49,"props":209,"children":210},{},[211],{"type":46,"value":212},"Always compute the cutoff in UTC and keep the user's local interpretation in your head separately.",{"type":40,"tag":197,"props":214,"children":216},{"id":215},"_2-enumerate-soft-deleted-flags-via-sql",[217],{"type":46,"value":218},"2. Enumerate soft-deleted flags via SQL",{"type":40,"tag":49,"props":220,"children":221},{},[222,224,229,231,237,239,245],{"type":46,"value":223},"Query ",{"type":40,"tag":100,"props":225,"children":227},{"className":226},[],[228],{"type":46,"value":122},{"type":46,"value":230}," for ",{"type":40,"tag":100,"props":232,"children":234},{"className":233},[],[235],{"type":46,"value":236},"deleted = true",{"type":46,"value":238}," in the active project, ordered by ",{"type":40,"tag":100,"props":240,"children":242},{"className":241},[],[243],{"type":46,"value":244},"created_at DESC",{"type":46,"value":246},":",{"type":40,"tag":248,"props":249,"children":254},"pre",{"className":250,"code":251,"language":252,"meta":253,"style":253},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT id, key, created_at\nFROM system.feature_flags\nWHERE team_id = \u003Cteam_id> AND deleted = true\nORDER BY created_at DESC\nLIMIT 100\n","sql","",[255],{"type":40,"tag":100,"props":256,"children":257},{"__ignoreMap":253},[258,269,278,287,295],{"type":40,"tag":259,"props":260,"children":263},"span",{"class":261,"line":262},"line",1,[264],{"type":40,"tag":259,"props":265,"children":266},{},[267],{"type":46,"value":268},"SELECT id, key, created_at\n",{"type":40,"tag":259,"props":270,"children":272},{"class":261,"line":271},2,[273],{"type":40,"tag":259,"props":274,"children":275},{},[276],{"type":46,"value":277},"FROM system.feature_flags\n",{"type":40,"tag":259,"props":279,"children":281},{"class":261,"line":280},3,[282],{"type":40,"tag":259,"props":283,"children":284},{},[285],{"type":46,"value":286},"WHERE team_id = \u003Cteam_id> AND deleted = true\n",{"type":40,"tag":259,"props":288,"children":289},{"class":261,"line":27},[290],{"type":40,"tag":259,"props":291,"children":292},{},[293],{"type":46,"value":294},"ORDER BY created_at DESC\n",{"type":40,"tag":259,"props":296,"children":298},{"class":261,"line":297},5,[299],{"type":40,"tag":259,"props":300,"children":301},{},[302],{"type":46,"value":303},"LIMIT 100\n",{"type":40,"tag":49,"props":305,"children":306},{},[307,309,314,316,321],{"type":46,"value":308},"Order by ",{"type":40,"tag":100,"props":310,"children":312},{"className":311},[],[313],{"type":46,"value":244},{"type":46,"value":315}," because deletions empirically cluster near creation — most flags get deleted within a few days of being created — so walking the most-recently-created candidates first finds recent deletions fastest. ",{"type":40,"tag":92,"props":317,"children":318},{},[319],{"type":46,"value":320},"But",{"type":46,"value":322}," this is a heuristic, not a guarantee: an older flag deleted recently won't be at the top of this list. Be explicit about that limitation when you report.",{"type":40,"tag":49,"props":324,"children":325},{},[326,332],{"type":40,"tag":100,"props":327,"children":329},{"className":328},[],[330],{"type":46,"value":331},"team_id",{"type":46,"value":333}," defaults to the active project, but include it explicitly for clarity.",{"type":40,"tag":197,"props":335,"children":337},{"id":336},"_3-fan-out-activity-log-lookups-in-parallel",[338],{"type":46,"value":339},"3. Fan out activity-log lookups in parallel",{"type":40,"tag":49,"props":341,"children":342},{},[343,345,350,352,358,360,365],{"type":46,"value":344},"For each candidate id, call ",{"type":40,"tag":100,"props":346,"children":348},{"className":347},[],[349],{"type":46,"value":182},{"type":46,"value":351}," with ",{"type":40,"tag":100,"props":353,"children":355},{"className":354},[],[356],{"type":46,"value":357},"limit: 5, page: 1",{"type":46,"value":359},". ",{"type":40,"tag":92,"props":361,"children":362},{},[363],{"type":46,"value":364},"Issue all calls in one message so they run concurrently",{"type":46,"value":366}," — sequential calls are dramatically slower.",{"type":40,"tag":248,"props":368,"children":372},{"className":369,"code":371,"language":46,"meta":253},[370],"language-text","call feature-flags-activity-retrieve {\"id\": \u003Cflag_id>, \"limit\": 5, \"page\": 1}\n",[373],{"type":40,"tag":100,"props":374,"children":375},{"__ignoreMap":253},[376],{"type":46,"value":371},{"type":40,"tag":49,"props":378,"children":379},{},[380],{"type":46,"value":381},"Reasonable batch sizes:",{"type":40,"tag":62,"props":383,"children":384},{},[385,390,395],{"type":40,"tag":66,"props":386,"children":387},{},[388],{"type":46,"value":389},"\"last 7 days\" → top 20–25 candidates",{"type":40,"tag":66,"props":391,"children":392},{},[393],{"type":46,"value":394},"\"last 30 days\" → top 50",{"type":40,"tag":66,"props":396,"children":397},{},[398],{"type":46,"value":399},"\"last 90 days\" → walk the full ~100",{"type":40,"tag":49,"props":401,"children":402},{},[403],{"type":46,"value":404},"If you sample fewer than the full set, say so in the report and offer to walk the rest as a follow-up.",{"type":40,"tag":197,"props":406,"children":408},{"id":407},"_4-extract-the-deletion-event-from-each-response",[409],{"type":46,"value":410},"4. Extract the deletion event from each response",{"type":40,"tag":49,"props":412,"children":413},{},[414,416,422,424,430,432,438,440,446],{"type":46,"value":415},"In each response, find the entry where ",{"type":40,"tag":100,"props":417,"children":419},{"className":418},[],[420],{"type":46,"value":421},"activity == \"deleted\"",{"type":46,"value":423},". That entry's ",{"type":40,"tag":100,"props":425,"children":427},{"className":426},[],[428],{"type":46,"value":429},"created_at",{"type":46,"value":431}," is the actual deletion time, and ",{"type":40,"tag":100,"props":433,"children":435},{"className":434},[],[436],{"type":46,"value":437},"user.email",{"type":46,"value":439}," \u002F ",{"type":40,"tag":100,"props":441,"children":443},{"className":442},[],[444],{"type":46,"value":445},"user.first_name",{"type":46,"value":447}," identify the deleter.",{"type":40,"tag":49,"props":449,"children":450},{},[451,453,459],{"type":46,"value":452},"The deletion event's ",{"type":40,"tag":100,"props":454,"children":456},{"className":455},[],[457],{"type":46,"value":458},"detail.changes",{"type":46,"value":460}," array typically contains:",{"type":40,"tag":62,"props":462,"children":463},{},[464,475,486],{"type":40,"tag":66,"props":465,"children":466},{},[467,473],{"type":40,"tag":100,"props":468,"children":470},{"className":469},[],[471],{"type":46,"value":472},"{field: \"deleted\", before: false, after: true}",{"type":46,"value":474}," — the actual delete",{"type":40,"tag":66,"props":476,"children":477},{},[478,484],{"type":40,"tag":100,"props":479,"children":481},{"className":480},[],[482],{"type":46,"value":483},"{field: \"key\", before: \"\u003Coriginal>\", after: \"\u003Coriginal>:deleted:\u003Cid>\"}",{"type":46,"value":485}," — Django renames the key on delete to free up the unique constraint",{"type":40,"tag":66,"props":487,"children":488},{},[489,495],{"type":40,"tag":100,"props":490,"children":492},{"className":491},[],[493],{"type":46,"value":494},"{field: \"name\", ...}",{"type":46,"value":496}," — the name sometimes gets reset",{"type":40,"tag":49,"props":498,"children":499},{},[500,502,508],{"type":46,"value":501},"For most flags there's exactly one delete event. If a flag has been deleted-and-restored multiple times, take the most recent ",{"type":40,"tag":100,"props":503,"children":505},{"className":504},[],[506],{"type":46,"value":507},"activity: deleted",{"type":46,"value":509}," event within the window.",{"type":40,"tag":197,"props":511,"children":513},{"id":512},"_5-filter-and-report",[514],{"type":46,"value":515},"5. Filter and report",{"type":40,"tag":49,"props":517,"children":518},{},[519,521,526],{"type":46,"value":520},"Filter the collected deletion events to those whose ",{"type":40,"tag":100,"props":522,"children":524},{"className":523},[],[525],{"type":46,"value":429},{"type":46,"value":527}," falls inside the requested window. Present as a table:",{"type":40,"tag":49,"props":529,"children":530},{},[531],{"type":46,"value":532},"| Flag ID | Key | Deleted at (UTC) | Deleted by |",{"type":40,"tag":49,"props":534,"children":535},{},[536],{"type":46,"value":537},"State your methodology in the report (how many candidates you walked vs. how many soft-deleted flags exist total), so the user knows what was and wasn't checked.",{"type":40,"tag":55,"props":539,"children":541},{"id":540},"watch-outs",[542],{"type":46,"value":543},"Watch-outs",{"type":40,"tag":62,"props":545,"children":546},{},[547,557,574,607],{"type":40,"tag":66,"props":548,"children":549},{},[550,555],{"type":40,"tag":92,"props":551,"children":552},{},[553],{"type":46,"value":554},"Borderline cases",{"type":46,"value":556},": if a deletion is within ~1 hour of the window cutoff, surface it as borderline rather than silently dropping it.",{"type":40,"tag":66,"props":558,"children":559},{},[560,572],{"type":40,"tag":92,"props":561,"children":562},{},[563,565,570],{"type":46,"value":564},"Don't trust ",{"type":40,"tag":100,"props":566,"children":568},{"className":567},[],[569],{"type":46,"value":429},{"type":46,"value":571}," as a proxy for deletion time",{"type":46,"value":573},": a flag created in 2024 can still have been deleted last week. The activity log is the only authority.",{"type":40,"tag":66,"props":575,"children":576},{},[577,582,584,590,592,598,600,605],{"type":40,"tag":92,"props":578,"children":579},{},[580],{"type":46,"value":581},"Renamed keys are normal",{"type":46,"value":583},": a flag with key ",{"type":40,"tag":100,"props":585,"children":587},{"className":586},[],[588],{"type":46,"value":589},"foo:deleted:12345",{"type":46,"value":591}," was the flag originally keyed ",{"type":40,"tag":100,"props":593,"children":595},{"className":594},[],[596],{"type":46,"value":597},"foo",{"type":46,"value":599},". The original key\u002Fname appears in the delete event's ",{"type":40,"tag":100,"props":601,"children":603},{"className":602},[],[604],{"type":46,"value":458},{"type":46,"value":606}," array — surface that to the user, not the renamed form.",{"type":40,"tag":66,"props":608,"children":609},{},[610,615],{"type":40,"tag":92,"props":611,"children":612},{},[613],{"type":46,"value":614},"Walking all candidates is possible but slow",{"type":46,"value":616},": ~100 parallel activity-log calls is doable. Offer it as a follow-up rather than the default for short windows.",{"type":40,"tag":55,"props":618,"children":620},{"id":619},"example-interaction",[621],{"type":46,"value":622},"Example interaction",{"type":40,"tag":49,"props":624,"children":625},{},[626],{"type":46,"value":627},"User: \"what flags got deleted in the last week?\"",{"type":40,"tag":629,"props":630,"children":631},"ol",{},[632,637,647,652,670],{"type":40,"tag":66,"props":633,"children":634},{},[635],{"type":46,"value":636},"Clarify if needed, or note both interpretations: \"rolling 7 days ending now (UTC), in the active project\"",{"type":40,"tag":66,"props":638,"children":639},{},[640,642],{"type":46,"value":641},"Run the SQL enumeration to get up to 100 soft-deleted candidates ordered by ",{"type":40,"tag":100,"props":643,"children":645},{"className":644},[],[646],{"type":46,"value":244},{"type":40,"tag":66,"props":648,"children":649},{},[650],{"type":46,"value":651},"Fan out activity-log lookups in parallel across the top ~25 candidates",{"type":40,"tag":66,"props":653,"children":654},{},[655,657,662,664],{"type":46,"value":656},"Extract ",{"type":40,"tag":100,"props":658,"children":660},{"className":659},[],[661],{"type":46,"value":507},{"type":46,"value":663}," entries; filter to those whose ",{"type":40,"tag":100,"props":665,"children":667},{"className":666},[],[668],{"type":46,"value":669},"created_at >= now - 7 days",{"type":40,"tag":66,"props":671,"children":672},{},[673,675],{"type":46,"value":674},"Report:",{"type":40,"tag":248,"props":676,"children":679},{"className":677,"code":678,"language":46,"meta":253},[370],"Found 2 feature flags deleted in the last 7 days (rolling, ending 2026-05-22 19:04 UTC):\n\n| Flag ID | Key                                       | Deleted at (UTC)     | Deleted by  |\n|---------|-------------------------------------------|----------------------|-------------|\n| 687432  | high_frequency_alerts                     | 2026-05-22 17:23     | Matt P.     |\n| 676665  | tasks-sendblue-prewarmed-sandbox-pool     | 2026-05-15 13:45     | Alessandro  |\n\nMethodology: walked the activity log for the 25 most-recently-created soft-deleted\nflags. Team 2 has ~100 soft-deleted flags total; the remaining ~75 were created\nbefore mid-March 2026 and were not checked. Want me to walk the rest?\n",[680],{"type":40,"tag":100,"props":681,"children":682},{"__ignoreMap":253},[683],{"type":46,"value":678},{"type":40,"tag":55,"props":685,"children":687},{"id":686},"related-tools",[688],{"type":46,"value":689},"Related tools",{"type":40,"tag":62,"props":691,"children":692},{},[693,709,719],{"type":40,"tag":66,"props":694,"children":695},{},[696,702,704],{"type":40,"tag":100,"props":697,"children":699},{"className":698},[],[700],{"type":46,"value":701},"posthog:execute-sql",{"type":46,"value":703},": Used in step 2 to enumerate soft-deleted candidates against ",{"type":40,"tag":100,"props":705,"children":707},{"className":706},[],[708],{"type":46,"value":122},{"type":40,"tag":66,"props":710,"children":711},{},[712,717],{"type":40,"tag":100,"props":713,"children":715},{"className":714},[],[716],{"type":46,"value":182},{"type":46,"value":718},": Used in step 3 to find the actual deletion event for each candidate",{"type":40,"tag":66,"props":720,"children":721},{},[722,728],{"type":40,"tag":100,"props":723,"children":725},{"className":724},[],[726],{"type":46,"value":727},"posthog:feature-flag-get-definition",{"type":46,"value":729},": Useful if the user then wants to inspect what the deleted flag looked like",{"type":40,"tag":731,"props":732,"children":733},"style",{},[734],{"type":46,"value":735},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":737,"total":908},[738,757,769,782,795,810,824,841,855,870,880,898],{"slug":739,"name":739,"fn":740,"description":741,"org":742,"tags":743,"stars":754,"repoUrl":755,"updatedAt":756},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[744,747,750,753],{"name":745,"slug":746,"type":15},"Analytics","analytics",{"name":748,"slug":749,"type":15},"Cost Optimization","cost-optimization",{"name":751,"slug":752,"type":15},"Observability","observability",{"name":9,"slug":8,"type":15},35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-07-28T05:34:11.117757",{"slug":758,"name":758,"fn":759,"description":760,"org":761,"tags":762,"stars":754,"repoUrl":755,"updatedAt":768},"auditing-endpoints","audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[763,764,767],{"name":745,"slug":746,"type":15},{"name":765,"slug":766,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":770,"name":770,"fn":771,"description":772,"org":773,"tags":774,"stars":754,"repoUrl":755,"updatedAt":781},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[775,776,779,780],{"name":765,"slug":766,"type":15},{"name":777,"slug":778,"type":15},"Data Warehouse","data-warehouse",{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":783,"name":783,"fn":784,"description":785,"org":786,"tags":787,"stars":754,"repoUrl":755,"updatedAt":794},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[788,789,790,793],{"name":765,"slug":766,"type":15},{"name":777,"slug":778,"type":15},{"name":791,"slug":792,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":796,"name":796,"fn":797,"description":798,"org":799,"tags":800,"stars":754,"repoUrl":755,"updatedAt":809},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[801,804,807,808],{"name":802,"slug":803,"type":15},"Alerting","alerting",{"name":805,"slug":806,"type":15},"Debugging","debugging",{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":811,"name":811,"fn":812,"description":813,"org":814,"tags":815,"stars":754,"repoUrl":755,"updatedAt":823},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[816,817,820,821,822],{"name":745,"slug":746,"type":15},{"name":818,"slug":819,"type":15},"Monitoring","monitoring",{"name":751,"slug":752,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-18T05:10:54.430898",{"slug":825,"name":825,"fn":826,"description":827,"org":828,"tags":829,"stars":754,"repoUrl":755,"updatedAt":840},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[830,833,836,837],{"name":831,"slug":832,"type":15},"Automation","automation",{"name":834,"slug":835,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},{"name":838,"slug":839,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":842,"name":842,"fn":843,"description":844,"org":845,"tags":846,"stars":754,"repoUrl":755,"updatedAt":854},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[847,848,849,852,853],{"name":745,"slug":746,"type":15},{"name":805,"slug":806,"type":15},{"name":850,"slug":851,"type":15},"Frontend","frontend",{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":856,"name":856,"fn":857,"description":858,"org":859,"tags":860,"stars":754,"repoUrl":755,"updatedAt":869},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[861,864,865,866],{"name":862,"slug":863,"type":15},"API Development","api-development",{"name":850,"slug":851,"type":15},{"name":9,"slug":8,"type":15},{"name":867,"slug":868,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":871,"name":871,"fn":872,"description":873,"org":874,"tags":875,"stars":754,"repoUrl":755,"updatedAt":879},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[876,877,878],{"name":862,"slug":863,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":881,"name":881,"fn":882,"description":883,"org":884,"tags":885,"stars":754,"repoUrl":755,"updatedAt":897},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[886,887,890,891,894],{"name":831,"slug":832,"type":15},{"name":888,"slug":889,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":892,"slug":893,"type":15},"Reporting","reporting",{"name":895,"slug":896,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":899,"name":899,"fn":900,"description":901,"org":902,"tags":903,"stars":754,"repoUrl":755,"updatedAt":907},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[904,905,906],{"name":745,"slug":746,"type":15},{"name":862,"slug":863,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231,{"items":910,"total":1011},[911,928,944,956,972,984,995],{"slug":912,"name":912,"fn":913,"description":914,"org":915,"tags":916,"stars":23,"repoUrl":24,"updatedAt":927},"account-handover","draft sales account handover notes","Draft structured handover notes for transitioning a PostHog account from one TAM or CSM to another. Use this skill when a TAM needs to hand over an account, prepare a transition briefing, write handover notes, create an account summary for a new owner, or any request involving account transitions between TAMs or CSMs. Triggers on \"hand over this account\", \"transition account to\", \"draft handover notes\", \"account briefing for new TAM\", \"prepare account transition\", or when a TAM names an account and says they're leaving or reassigning it.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[917,920,923,924],{"name":918,"slug":919,"type":15},"Communications","communications",{"name":921,"slug":922,"type":15},"CRM","crm",{"name":9,"slug":8,"type":15},{"name":925,"slug":926,"type":15},"Sales","sales","2026-04-16T05:13:00.172732",{"slug":929,"name":929,"fn":930,"description":931,"org":932,"tags":933,"stars":23,"repoUrl":24,"updatedAt":943},"auditing-warehouse-data-health","audit PostHog data warehouse health","Audit the health of a PostHog project's data warehouse — find every broken or degraded pipeline item across sources, sync schemas, materialized views, batch exports, and transformations. Use when the user asks \"what's broken in my warehouse?\", \"give me a health check\", \"audit my data pipeline\", \"why are some dashboards stale?\", or wants a one-shot triage summary before deciding where to spend time. Produces a prioritized report of issues grouped by severity and type, with recommended next steps.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[934,935,938,941,942],{"name":765,"slug":766,"type":15},{"name":936,"slug":937,"type":15},"Data Engineering","data-engineering",{"name":939,"slug":940,"type":15},"Data Quality","data-quality",{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-06-21T08:19:05.85849",{"slug":945,"name":945,"fn":946,"description":947,"org":948,"tags":949,"stars":23,"repoUrl":24,"updatedAt":955},"copying-flags-across-projects","copy feature flags across PostHog projects","Copy a feature flag from one PostHog project to one or more target projects in the same organization. Use when the user wants to duplicate a flag, promote a flag from staging to production, sync flags across projects, or replicate a flag configuration in a different workspace. Covers cohort remapping, scheduled-change handling, encrypted payloads, and the safe defaults (disabled in target, no scheduled changes).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[950,953,954],{"name":951,"slug":952,"type":15},"Deployment","deployment",{"name":18,"slug":19,"type":15},{"name":9,"slug":8,"type":15},"2026-05-04T05:56:44.484909",{"slug":957,"name":957,"fn":958,"description":959,"org":960,"tags":961,"stars":23,"repoUrl":24,"updatedAt":971},"diagnosing-experiment-results","diagnose PostHog experiment results and anomalies","Diagnoses bias, anomalies, and strange-looking results on a specific PostHog experiment. Covers empty \u002F 0-exposure experiments, sample ratio mismatch, identity fragmentation, multi-variant exposure, uneven-split exclusion bias, significance traps (peeking, A\u002FA, Bayesian vs Frequentist), PostHog-vs-SQL discrepancies, and surprises after mid-run edits. Symptom-driven dispatch to the right diagnostic.\nTRIGGER when: user asks 'is my experiment biased?' or 'why 0 exposures?', references the bias banner, says a variant looks strange \u002F wrong \u002F off, sees significance flipping, notices PostHog numbers disagreeing with their SQL, sees an A\u002FA test showing significance, or reports surprises after mid-run edits.\nDO NOT TRIGGER when: creating a new experiment (use creating-experiments), only configuring rollout (use configuring-experiment-rollout) or metrics (use configuring-experiment-analytics), or only asking lifecycle questions (use managing-experiment-lifecycle).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[962,965,966,969,970],{"name":963,"slug":964,"type":15},"A\u002FB Testing","a-b-testing",{"name":745,"slug":746,"type":15},{"name":967,"slug":968,"type":15},"Data Analysis","data-analysis",{"name":805,"slug":806,"type":15},{"name":9,"slug":8,"type":15},"2026-05-22T06:59:58.103867",{"slug":973,"name":973,"fn":974,"description":975,"org":976,"tags":977,"stars":23,"repoUrl":24,"updatedAt":983},"diagnosing-missing-recordings","diagnose missing PostHog session recordings","Diagnoses why a session recording is missing or was not captured. Use when a user asks why a session has no replay, why recordings aren't appearing, or wants to troubleshoot session replay capture issues for a specific session ID or across their project. Covers SDK diagnostic signals, project settings, sampling, triggers, ad blockers, and quota\u002Fbilling scenarios.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[978,979,980,981,982],{"name":745,"slug":746,"type":15},{"name":805,"slug":806,"type":15},{"name":850,"slug":851,"type":15},{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-04-22T05:06:51.989772",{"slug":985,"name":985,"fn":986,"description":987,"org":988,"tags":989,"stars":23,"repoUrl":24,"updatedAt":994},"diagnosing-sdk-health","diagnose PostHog SDK health","Diagnoses the health of a project's PostHog SDK integrations — which SDKs are out of date and how to fix them. Use when a user asks about PostHog SDK versions, outdated SDKs, upgrade recommendations, \"SDK health\", \"SDK doctor\" (the former name), or when events or features seem off and it might be due to an old SDK.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[990,991,992,993],{"name":745,"slug":746,"type":15},{"name":805,"slug":806,"type":15},{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-04-27T05:46:14.554016",{"slug":996,"name":996,"fn":997,"description":998,"org":999,"tags":1000,"stars":23,"repoUrl":24,"updatedAt":1010},"error-tracking-android","track Android errors with PostHog","PostHog error tracking for Android",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1001,1004,1005,1008,1009],{"name":1002,"slug":1003,"type":15},"Android","android",{"name":805,"slug":806,"type":15},{"name":1006,"slug":1007,"type":15},"Mobile","mobile",{"name":751,"slug":752,"type":15},{"name":9,"slug":8,"type":15},"2026-04-06T18:46:26.982494",110]