CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

adding-project-secret-api-key-auth

How to gate a PostHog API endpoint with project secret API key (PSAK) auth — a project-scoped, user-less service credential. Use when adding PSAK support to a viewset action, allowing a new scope for PSAKs, handling synthetic users (ProjectSecretAPIKeyUser), or choosing PSAK-aware rate throttles. Trigger terms: PSAK, ProjectSecretAPIKey, project secret API key, phs_ token, service auth, programmatic endpoint auth.

78

Quality

98%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

—

The risk profile of this skill

SKILL.md
Quality
Evals
Security

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable guide that assumes Django knowledge and spends every token on PostHog-specific facts: exact file paths, class names, throttle cache keys, a four-step wiring checklist, and a concrete test matrix. The only gap is structural — no reference files at all, with a ~95-line body that slightly exceeds ideal single-file size.

Suggestions

Move the minimum test-matrix ('Cover at minimum: ...') into a references/testing.md file and reference it one level deep, keeping the checklist in SKILL.md lean.

Consider relocating the 'What you get for free' details (query tagging internals, last_used_at mechanics) to a short reference file, since they are context rather than wiring steps.

Trim the curl example's '-d '{...}'' placeholder to a concrete JSON body for the planned 'run' action consumer to make it fully copy-paste ready.

DimensionReasoningScore

Conciseness

Every section carries project-specific facts Claude cannot know (file paths, cache-key formats like 'psak:{key_id}', default-deny behavior, test file locations) and assumes Django competence; there is no explanation of general concepts and no padding. Not level 4: there are no sections that could be trimmed without losing information.

5 / 5

Actionability

Concrete, executable guidance throughout: the scope allowlist tuple, the viewset wiring snippet ('authentication_classes = [ProjectSecretAPIKeyAuthentication]', 'psak_allowed_actions = ["run"]'), named throttle classes, permission helpers, and a curl example. Placeholders like '<your_action_path>' are inherent variables, not pseudocode, so the top anchor fits.

5 / 5

Workflow Clarity

A numbered four-step 'all required' checklist with per-step failure modes ('key creation rejects the scope before auth is ever attempted') plus an explicit testing section enumerating expected outcomes (200 vs 403 cases), serving as the validation checkpoint. Not level 4: validation expectations are explicit and complete for each failure mode.

5 / 5

Progressive Disclosure

Sections are well-organized and navigation is easy, but the ~95-line body is above the under-50-line single-file exception and ships no bundle files; content like the test matrix and the 'What you get for free' details could live in one-level-deep references. Not level 5 because there are no well-signaled reference files to split content into; not level 3 because structure and organization are genuinely good.

4 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete capability list, explicit 'Use when' triggers, a dedicated trigger-term list covering synonyms and the token prefix, and a sharply defined niche. Third-person voice with no fluff or over-claims.

DimensionReasoningScore

Specificity

Quotes: 'gate a PostHog API endpoint', 'adding PSAK support to a viewset action', 'allowing a new scope for PSAKs', 'handling synthetic users (ProjectSecretAPIKeyUser)', 'choosing PSAK-aware rate throttles' — multiple specific concrete actions with comprehensive coverage of the skill's capabilities, matching the top anchor rather than the level-4 'minor gaps' anchor.

5 / 5

Completeness

Clearly answers both: what ('a project-scoped, user-less service credential' for gating endpoints) and when ('Use when adding PSAK support to a viewset action...') with concrete trigger phrases, exactly matching the top anchor; not level 4 since the 'when' clause is fully explicit.

5 / 5

Trigger Term Quality

Explicit trigger list 'PSAK, ProjectSecretAPIKey, project secret API key, phs_ token, service auth, programmatic endpoint auth' covers synonyms, the concrete model name, and the token prefix — comprehensive natural-term coverage analogous to the 'PDF files, PDFs, forms, .pdf' exemplar.

5 / 5

Distinctiveness Conflict Risk

A clear niche (PostHog project secret API key auth) with distinct trigger vocabulary like 'ProjectSecretAPIKey' and 'phs_ token' that no generic or neighboring skill would claim; minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

PostHog/posthog

Path

.agents/skills/adding-project-secret-api-key-auth/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.