Lean and information-dense throughout — token tables, tool tables, filter syntax, and an executable SQL snippet — with every section adding PostHog-specific knowledge (log_entries store, log_source_id UUID, ~90-day TTL) rather than generic concepts Claude already knows; not the padded/concept-explaining anchor (1) or the slightly-over-explained anchor (2).

Provides concrete tools (endpoint-logs, endpoint-get, execute-sql), exact filter syntax (level=ERROR, search=cache=miss, limit 1–500), and a copy-paste-ready SQL aggregation query with the correct log_source/log_source_id predicates; not vague direction (1) or pseudocode (2).

Five clearly sequenced steps (identify → start broad → narrow by symptom with branches → aggregate via SQL → summarize/handoff) where the broad-to-narrow narrowing acts as the feedback loop; the destructive/batch validation cap does not apply because this is read-only log diagnosis, so it clears the 3 bar despite lacking hard validate-gate checkpoints.

No bundle files exist, and the single self-contained file is well-sectioned (When to use, entry anatomy, tools, filtering, workflow, example, notes) with no nested references; the inline tables and SQL are core reference material that belongs in SKILL.md, not a monolithic wall (1) or misplaced-inline bulk (2).

Lists multiple concrete capabilities/symptoms — "error messages, failed runs, cache misses, slow runs, or unexpected row counts during endpoint invocations" — matching the multiple-specific-actions anchor; not vague like "Helps with documents" (1) and more comprehensive than naming only a domain (2).

Explicitly answers what ("Explore and diagnose a PostHog endpoint's execution logs …") and when ("Use when the user says …" with many triggers), plus a scope boundary, satisfying the what-AND-when-with-explicit-triggers anchor; not merely the what-only example that caps at 2.

Quotes natural phrases users would say — "my endpoint is failing", "show me the logs for endpoint X", "why did endpoint Z return no rows", "is this endpoint hitting cache", "check the last N runs" — giving broad, realistic coverage rather than jargon (1) or a single variation (2).

Carves a clear niche — "Focused on a single named endpoint's runtime log entries, not project-wide auditing or query performance profiling" — with negative boundaries against sibling skills, making wrong-skill triggering unlikely; far more specific than the generic conflict-prone anchor (1).