[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-review-hog-perspective-contracts-security":3,"mdc--yys9ny-key":49,"related-org-posthog-review-hog-perspective-contracts-security":499,"related-repo-posthog-review-hog-perspective-contracts-security":668},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":44,"sourceUrl":47,"mdContent":48},"review-hog-perspective-contracts-security","perform security and contract reviews with ReviewHog","The Contracts & Security review perspective for ReviewHog. Verifies that changed code is safe and maintains compatibility — API contracts and breaking changes, injection \u002F authz \u002F data exposure, input validation, and schema \u002F interface alignment. Reports security and contract issues only.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Code Review","code-review",{"name":21,"slug":22,"type":15},"API Development","api-development",35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-07-15T05:30:16.788725",null,2977,[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ab-testing","ai-analytics","analytics","cdp","data-warehouse","experiments","feature-flags","javascript","product-analytics","python","react","session-replay","surveys","typescript","web-analytics",{"repoUrl":24,"stars":23,"forks":27,"topics":45,"description":46},[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"🦔 PostHog is an all-in-one developer platform for building successful products. We offer product analytics, web analytics, session replay, error tracking, feature flags, experimentation, surveys, data warehouse, a CDP, and an AI product assistant to help debug your code, ship features faster, and keep all your usage and customer data in one stack.","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog\u002Ftree\u002FHEAD\u002Fproducts\u002Freview_hog\u002Fskills\u002Freview-hog-perspective-contracts-security","---\nname: review-hog-perspective-contracts-security\ndescription: >\n  The Contracts & Security review perspective for ReviewHog. Verifies that changed code is safe and\n  maintains compatibility — API contracts and breaking changes, injection \u002F authz \u002F data exposure,\n  input validation, and schema \u002F interface alignment. Reports security and contract issues only.\nmetadata:\n  owner_team: review_hog\n  perspective: contracts_security\n---\n\n# Review perspective: Contracts & Security\n\nYou are reviewing a PR chunk through the **Contracts & Security** perspective: is the code safe, and\ndoes it preserve compatibility? Concentrate on API contracts and breaking changes, security\nvulnerabilities, input validation, and schema \u002F interface alignment.\n\nThis is one of several independent perspectives reviewing the same chunk in parallel — logic and\nperformance are covered elsewhere. Stay in your lane, and report every security or contract issue you\nfind without worrying about what another perspective might also report (overlap is resolved later by\na separate deduplication step).\n\n## Primary investigation areas\n\n1. **API contracts & breaking changes**\n   - Check for changed request \u002F response formats\n   - Identify removed or renamed fields\n   - Validate data-type changes\n   - Ensure version compatibility\n   - Check GraphQL \u002F REST contract compliance\n\n2. **Security vulnerabilities**\n   - Look for SQL injection vulnerabilities\n   - Check for XSS attack vectors\n   - Identify prompt-injection risks (for LLM code)\n   - Verify authentication \u002F authorization checks\n   - Ensure sensitive data is not exposed\n\n3. **Input validation & boundaries**\n   - Verify validation at all entry points\n   - Check input sanitization\n   - Validate type safety\n   - Ensure range and limit checks\n   - Check for buffer-overflow risks\n\n4. **Schema & interface alignment**\n   - Verify database schema matches code models\n   - Check frontend \u002F backend type consistency\n   - Validate API specifications\n   - Ensure migration compatibility\n\n## Investigation commands\n\n- Find API endpoints: `rg \"@action\\(|@api_view\\(|class \\w+(ViewSet|APIView)\" --type py -B 2 -A 5` (DRF endpoints; route wiring lives in `urls.py` \u002F `routes.py` files)\n- Check input validation: `rg \"validate|sanitize|clean.*input\" --type py -A 5`\n- Find SQL queries: `rg \"execute|query|raw.*sql\" --type py -B 2 -A 5`\n- Check auth: `rg \"authenticate|authorize|permission|@login_required\" --type py -B 2 -A 3`\n- Find schema definitions: `rg \"class.*Model|Schema|Interface\" --type py --type ts -A 10`\n\n## Where to focus\n\nConcentrate primary attention on:\n\n- API endpoints and controllers\n- Database models and migrations (critical for schema validation)\n- Type definitions and interfaces (`*.d.ts`, type annotations)\n- Authentication \u002F authorization modules\n- Input validation and sanitization code\n- Data serialization \u002F deserialization logic\n- External API integrations\n- API specification files (OpenAPI, GraphQL schemas) and security configuration files\n\nDetect issues only in non-test files; reference docs and frontend-only UI components without data\nhandling for context, but don't raise contract \u002F security findings on them.\n\n## What to leave to other perspectives\n\n- Logic and correctness errors → Logic & Correctness\n- Performance optimizations and error-handling completeness → Performance & Reliability\n- Code style or formatting → not a ReviewHog concern\n\n## Key questions\n\n- Are all inputs properly validated and sanitized?\n- Could this code introduce security vulnerabilities?\n- Are API contracts maintained or properly versioned?\n- Is sensitive data properly protected?\n- Are there any breaking changes for API consumers?\n- Do schemas and interfaces align across layers?\n\n## What a valid finding looks like\n\nA Contracts & Security finding relates to:\n\n- Security vulnerabilities (injection, XSS, etc.)\n- Breaking API changes\n- Missing input validation\n- Schema mismatches\n- Authentication \u002F authorization gaps\n- Data-exposure risks\n- Contract violations\n",{"data":50,"body":54},{"name":4,"description":6,"metadata":51},{"owner_team":52,"perspective":53},"review_hog","contracts_security",{"type":55,"children":56},"root",[57,66,80,85,92,237,243,320,326,331,382,387,393,411,417,450,456,461],{"type":58,"tag":59,"props":60,"children":62},"element","h1",{"id":61},"review-perspective-contracts-security",[63],{"type":64,"value":65},"text","Review perspective: Contracts & Security",{"type":58,"tag":67,"props":68,"children":69},"p",{},[70,72,78],{"type":64,"value":71},"You are reviewing a PR chunk through the ",{"type":58,"tag":73,"props":74,"children":75},"strong",{},[76],{"type":64,"value":77},"Contracts & Security",{"type":64,"value":79}," perspective: is the code safe, and\ndoes it preserve compatibility? Concentrate on API contracts and breaking changes, security\nvulnerabilities, input validation, and schema \u002F interface alignment.",{"type":58,"tag":67,"props":81,"children":82},{},[83],{"type":64,"value":84},"This is one of several independent perspectives reviewing the same chunk in parallel — logic and\nperformance are covered elsewhere. Stay in your lane, and report every security or contract issue you\nfind without worrying about what another perspective might also report (overlap is resolved later by\na separate deduplication step).",{"type":58,"tag":86,"props":87,"children":89},"h2",{"id":88},"primary-investigation-areas",[90],{"type":64,"value":91},"Primary investigation areas",{"type":58,"tag":93,"props":94,"children":95},"ol",{},[96,134,170,206],{"type":58,"tag":97,"props":98,"children":99},"li",{},[100,105],{"type":58,"tag":73,"props":101,"children":102},{},[103],{"type":64,"value":104},"API contracts & breaking changes",{"type":58,"tag":106,"props":107,"children":108},"ul",{},[109,114,119,124,129],{"type":58,"tag":97,"props":110,"children":111},{},[112],{"type":64,"value":113},"Check for changed request \u002F response formats",{"type":58,"tag":97,"props":115,"children":116},{},[117],{"type":64,"value":118},"Identify removed or renamed fields",{"type":58,"tag":97,"props":120,"children":121},{},[122],{"type":64,"value":123},"Validate data-type changes",{"type":58,"tag":97,"props":125,"children":126},{},[127],{"type":64,"value":128},"Ensure version compatibility",{"type":58,"tag":97,"props":130,"children":131},{},[132],{"type":64,"value":133},"Check GraphQL \u002F REST contract compliance",{"type":58,"tag":97,"props":135,"children":136},{},[137,142],{"type":58,"tag":73,"props":138,"children":139},{},[140],{"type":64,"value":141},"Security vulnerabilities",{"type":58,"tag":106,"props":143,"children":144},{},[145,150,155,160,165],{"type":58,"tag":97,"props":146,"children":147},{},[148],{"type":64,"value":149},"Look for SQL injection vulnerabilities",{"type":58,"tag":97,"props":151,"children":152},{},[153],{"type":64,"value":154},"Check for XSS attack vectors",{"type":58,"tag":97,"props":156,"children":157},{},[158],{"type":64,"value":159},"Identify prompt-injection risks (for LLM code)",{"type":58,"tag":97,"props":161,"children":162},{},[163],{"type":64,"value":164},"Verify authentication \u002F authorization checks",{"type":58,"tag":97,"props":166,"children":167},{},[168],{"type":64,"value":169},"Ensure sensitive data is not exposed",{"type":58,"tag":97,"props":171,"children":172},{},[173,178],{"type":58,"tag":73,"props":174,"children":175},{},[176],{"type":64,"value":177},"Input validation & boundaries",{"type":58,"tag":106,"props":179,"children":180},{},[181,186,191,196,201],{"type":58,"tag":97,"props":182,"children":183},{},[184],{"type":64,"value":185},"Verify validation at all entry points",{"type":58,"tag":97,"props":187,"children":188},{},[189],{"type":64,"value":190},"Check input sanitization",{"type":58,"tag":97,"props":192,"children":193},{},[194],{"type":64,"value":195},"Validate type safety",{"type":58,"tag":97,"props":197,"children":198},{},[199],{"type":64,"value":200},"Ensure range and limit checks",{"type":58,"tag":97,"props":202,"children":203},{},[204],{"type":64,"value":205},"Check for buffer-overflow risks",{"type":58,"tag":97,"props":207,"children":208},{},[209,214],{"type":58,"tag":73,"props":210,"children":211},{},[212],{"type":64,"value":213},"Schema & interface alignment",{"type":58,"tag":106,"props":215,"children":216},{},[217,222,227,232],{"type":58,"tag":97,"props":218,"children":219},{},[220],{"type":64,"value":221},"Verify database schema matches code models",{"type":58,"tag":97,"props":223,"children":224},{},[225],{"type":64,"value":226},"Check frontend \u002F backend type consistency",{"type":58,"tag":97,"props":228,"children":229},{},[230],{"type":64,"value":231},"Validate API specifications",{"type":58,"tag":97,"props":233,"children":234},{},[235],{"type":64,"value":236},"Ensure migration compatibility",{"type":58,"tag":86,"props":238,"children":240},{"id":239},"investigation-commands",[241],{"type":64,"value":242},"Investigation commands",{"type":58,"tag":106,"props":244,"children":245},{},[246,276,287,298,309],{"type":58,"tag":97,"props":247,"children":248},{},[249,251,258,260,266,268,274],{"type":64,"value":250},"Find API endpoints: ",{"type":58,"tag":252,"props":253,"children":255},"code",{"className":254},[],[256],{"type":64,"value":257},"rg \"@action\\(|@api_view\\(|class \\w+(ViewSet|APIView)\" --type py -B 2 -A 5",{"type":64,"value":259}," (DRF endpoints; route wiring lives in ",{"type":58,"tag":252,"props":261,"children":263},{"className":262},[],[264],{"type":64,"value":265},"urls.py",{"type":64,"value":267}," \u002F ",{"type":58,"tag":252,"props":269,"children":271},{"className":270},[],[272],{"type":64,"value":273},"routes.py",{"type":64,"value":275}," files)",{"type":58,"tag":97,"props":277,"children":278},{},[279,281],{"type":64,"value":280},"Check input validation: ",{"type":58,"tag":252,"props":282,"children":284},{"className":283},[],[285],{"type":64,"value":286},"rg \"validate|sanitize|clean.*input\" --type py -A 5",{"type":58,"tag":97,"props":288,"children":289},{},[290,292],{"type":64,"value":291},"Find SQL queries: ",{"type":58,"tag":252,"props":293,"children":295},{"className":294},[],[296],{"type":64,"value":297},"rg \"execute|query|raw.*sql\" --type py -B 2 -A 5",{"type":58,"tag":97,"props":299,"children":300},{},[301,303],{"type":64,"value":302},"Check auth: ",{"type":58,"tag":252,"props":304,"children":306},{"className":305},[],[307],{"type":64,"value":308},"rg \"authenticate|authorize|permission|@login_required\" --type py -B 2 -A 3",{"type":58,"tag":97,"props":310,"children":311},{},[312,314],{"type":64,"value":313},"Find schema definitions: ",{"type":58,"tag":252,"props":315,"children":317},{"className":316},[],[318],{"type":64,"value":319},"rg \"class.*Model|Schema|Interface\" --type py --type ts -A 10",{"type":58,"tag":86,"props":321,"children":323},{"id":322},"where-to-focus",[324],{"type":64,"value":325},"Where to focus",{"type":58,"tag":67,"props":327,"children":328},{},[329],{"type":64,"value":330},"Concentrate primary attention on:",{"type":58,"tag":106,"props":332,"children":333},{},[334,339,344,357,362,367,372,377],{"type":58,"tag":97,"props":335,"children":336},{},[337],{"type":64,"value":338},"API endpoints and controllers",{"type":58,"tag":97,"props":340,"children":341},{},[342],{"type":64,"value":343},"Database models and migrations (critical for schema validation)",{"type":58,"tag":97,"props":345,"children":346},{},[347,349,355],{"type":64,"value":348},"Type definitions and interfaces (",{"type":58,"tag":252,"props":350,"children":352},{"className":351},[],[353],{"type":64,"value":354},"*.d.ts",{"type":64,"value":356},", type annotations)",{"type":58,"tag":97,"props":358,"children":359},{},[360],{"type":64,"value":361},"Authentication \u002F authorization modules",{"type":58,"tag":97,"props":363,"children":364},{},[365],{"type":64,"value":366},"Input validation and sanitization code",{"type":58,"tag":97,"props":368,"children":369},{},[370],{"type":64,"value":371},"Data serialization \u002F deserialization logic",{"type":58,"tag":97,"props":373,"children":374},{},[375],{"type":64,"value":376},"External API integrations",{"type":58,"tag":97,"props":378,"children":379},{},[380],{"type":64,"value":381},"API specification files (OpenAPI, GraphQL schemas) and security configuration files",{"type":58,"tag":67,"props":383,"children":384},{},[385],{"type":64,"value":386},"Detect issues only in non-test files; reference docs and frontend-only UI components without data\nhandling for context, but don't raise contract \u002F security findings on them.",{"type":58,"tag":86,"props":388,"children":390},{"id":389},"what-to-leave-to-other-perspectives",[391],{"type":64,"value":392},"What to leave to other perspectives",{"type":58,"tag":106,"props":394,"children":395},{},[396,401,406],{"type":58,"tag":97,"props":397,"children":398},{},[399],{"type":64,"value":400},"Logic and correctness errors → Logic & Correctness",{"type":58,"tag":97,"props":402,"children":403},{},[404],{"type":64,"value":405},"Performance optimizations and error-handling completeness → Performance & Reliability",{"type":58,"tag":97,"props":407,"children":408},{},[409],{"type":64,"value":410},"Code style or formatting → not a ReviewHog concern",{"type":58,"tag":86,"props":412,"children":414},{"id":413},"key-questions",[415],{"type":64,"value":416},"Key questions",{"type":58,"tag":106,"props":418,"children":419},{},[420,425,430,435,440,445],{"type":58,"tag":97,"props":421,"children":422},{},[423],{"type":64,"value":424},"Are all inputs properly validated and sanitized?",{"type":58,"tag":97,"props":426,"children":427},{},[428],{"type":64,"value":429},"Could this code introduce security vulnerabilities?",{"type":58,"tag":97,"props":431,"children":432},{},[433],{"type":64,"value":434},"Are API contracts maintained or properly versioned?",{"type":58,"tag":97,"props":436,"children":437},{},[438],{"type":64,"value":439},"Is sensitive data properly protected?",{"type":58,"tag":97,"props":441,"children":442},{},[443],{"type":64,"value":444},"Are there any breaking changes for API consumers?",{"type":58,"tag":97,"props":446,"children":447},{},[448],{"type":64,"value":449},"Do schemas and interfaces align across layers?",{"type":58,"tag":86,"props":451,"children":453},{"id":452},"what-a-valid-finding-looks-like",[454],{"type":64,"value":455},"What a valid finding looks like",{"type":58,"tag":67,"props":457,"children":458},{},[459],{"type":64,"value":460},"A Contracts & Security finding relates to:",{"type":58,"tag":106,"props":462,"children":463},{},[464,469,474,479,484,489,494],{"type":58,"tag":97,"props":465,"children":466},{},[467],{"type":64,"value":468},"Security vulnerabilities (injection, XSS, etc.)",{"type":58,"tag":97,"props":470,"children":471},{},[472],{"type":64,"value":473},"Breaking API changes",{"type":58,"tag":97,"props":475,"children":476},{},[477],{"type":64,"value":478},"Missing input validation",{"type":58,"tag":97,"props":480,"children":481},{},[482],{"type":64,"value":483},"Schema mismatches",{"type":58,"tag":97,"props":485,"children":486},{},[487],{"type":64,"value":488},"Authentication \u002F authorization gaps",{"type":58,"tag":97,"props":490,"children":491},{},[492],{"type":64,"value":493},"Data-exposure risks",{"type":58,"tag":97,"props":495,"children":496},{},[497],{"type":64,"value":498},"Contract violations",{"items":500,"total":667},[501,517,529,541,554,569,585,602,616,629,639,657],{"slug":502,"name":502,"fn":503,"description":504,"org":505,"tags":506,"stars":23,"repoUrl":24,"updatedAt":516},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[507,509,512,515],{"name":508,"slug":31,"type":15},"Analytics",{"name":510,"slug":511,"type":15},"Cost Optimization","cost-optimization",{"name":513,"slug":514,"type":15},"Observability","observability",{"name":9,"slug":8,"type":15},"2026-07-28T05:34:11.117757",{"slug":518,"name":518,"fn":519,"description":520,"org":521,"tags":522,"stars":23,"repoUrl":24,"updatedAt":528},"auditing-endpoints","audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[523,524,527],{"name":508,"slug":31,"type":15},{"name":525,"slug":526,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":530,"name":530,"fn":531,"description":532,"org":533,"tags":534,"stars":23,"repoUrl":24,"updatedAt":540},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[535,536,538,539],{"name":525,"slug":526,"type":15},{"name":537,"slug":33,"type":15},"Data Warehouse",{"name":513,"slug":514,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":542,"name":542,"fn":543,"description":544,"org":545,"tags":546,"stars":23,"repoUrl":24,"updatedAt":553},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[547,548,549,552],{"name":525,"slug":526,"type":15},{"name":537,"slug":33,"type":15},{"name":550,"slug":551,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":555,"name":555,"fn":556,"description":557,"org":558,"tags":559,"stars":23,"repoUrl":24,"updatedAt":568},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[560,563,566,567],{"name":561,"slug":562,"type":15},"Alerting","alerting",{"name":564,"slug":565,"type":15},"Debugging","debugging",{"name":513,"slug":514,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":570,"name":570,"fn":571,"description":572,"org":573,"tags":574,"stars":23,"repoUrl":24,"updatedAt":584},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[575,576,579,580,583],{"name":508,"slug":31,"type":15},{"name":577,"slug":578,"type":15},"Monitoring","monitoring",{"name":513,"slug":514,"type":15},{"name":581,"slug":582,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},"2026-07-18T05:10:54.430898",{"slug":586,"name":586,"fn":587,"description":588,"org":589,"tags":590,"stars":23,"repoUrl":24,"updatedAt":601},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[591,594,597,598],{"name":592,"slug":593,"type":15},"Automation","automation",{"name":595,"slug":596,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},{"name":599,"slug":600,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":603,"name":603,"fn":604,"description":605,"org":606,"tags":607,"stars":23,"repoUrl":24,"updatedAt":615},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[608,609,610,613,614],{"name":508,"slug":31,"type":15},{"name":564,"slug":565,"type":15},{"name":611,"slug":612,"type":15},"Frontend","frontend",{"name":513,"slug":514,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":617,"name":617,"fn":618,"description":619,"org":620,"tags":621,"stars":23,"repoUrl":24,"updatedAt":628},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[622,623,624,625],{"name":21,"slug":22,"type":15},{"name":611,"slug":612,"type":15},{"name":9,"slug":8,"type":15},{"name":626,"slug":627,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":630,"name":630,"fn":631,"description":632,"org":633,"tags":634,"stars":23,"repoUrl":24,"updatedAt":638},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[635,636,637],{"name":21,"slug":22,"type":15},{"name":581,"slug":582,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":640,"name":640,"fn":641,"description":642,"org":643,"tags":644,"stars":23,"repoUrl":24,"updatedAt":656},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[645,646,649,650,653],{"name":592,"slug":593,"type":15},{"name":647,"slug":648,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":651,"slug":652,"type":15},"Reporting","reporting",{"name":654,"slug":655,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":658,"name":658,"fn":659,"description":660,"org":661,"tags":662,"stars":23,"repoUrl":24,"updatedAt":666},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[663,664,665],{"name":508,"slug":31,"type":15},{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231,{"items":669,"total":719},[670,677,683,690,697,704,712],{"slug":502,"name":502,"fn":503,"description":504,"org":671,"tags":672,"stars":23,"repoUrl":24,"updatedAt":516},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[673,674,675,676],{"name":508,"slug":31,"type":15},{"name":510,"slug":511,"type":15},{"name":513,"slug":514,"type":15},{"name":9,"slug":8,"type":15},{"slug":518,"name":518,"fn":519,"description":520,"org":678,"tags":679,"stars":23,"repoUrl":24,"updatedAt":528},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[680,681,682],{"name":508,"slug":31,"type":15},{"name":525,"slug":526,"type":15},{"name":9,"slug":8,"type":15},{"slug":530,"name":530,"fn":531,"description":532,"org":684,"tags":685,"stars":23,"repoUrl":24,"updatedAt":540},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[686,687,688,689],{"name":525,"slug":526,"type":15},{"name":537,"slug":33,"type":15},{"name":513,"slug":514,"type":15},{"name":9,"slug":8,"type":15},{"slug":542,"name":542,"fn":543,"description":544,"org":691,"tags":692,"stars":23,"repoUrl":24,"updatedAt":553},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[693,694,695,696],{"name":525,"slug":526,"type":15},{"name":537,"slug":33,"type":15},{"name":550,"slug":551,"type":15},{"name":9,"slug":8,"type":15},{"slug":555,"name":555,"fn":556,"description":557,"org":698,"tags":699,"stars":23,"repoUrl":24,"updatedAt":568},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[700,701,702,703],{"name":561,"slug":562,"type":15},{"name":564,"slug":565,"type":15},{"name":513,"slug":514,"type":15},{"name":9,"slug":8,"type":15},{"slug":570,"name":570,"fn":571,"description":572,"org":705,"tags":706,"stars":23,"repoUrl":24,"updatedAt":584},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[707,708,709,710,711],{"name":508,"slug":31,"type":15},{"name":577,"slug":578,"type":15},{"name":513,"slug":514,"type":15},{"name":581,"slug":582,"type":15},{"name":9,"slug":8,"type":15},{"slug":586,"name":586,"fn":587,"description":588,"org":713,"tags":714,"stars":23,"repoUrl":24,"updatedAt":601},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[715,716,717,718],{"name":592,"slug":593,"type":15},{"name":595,"slug":596,"type":15},{"name":9,"slug":8,"type":15},{"name":599,"slug":600,"type":15},61]