CtrlK
BlogDocsLog inGet started
Tessl Logo

managing-github-actions-secrets

Creates and updates GitHub Actions secrets for PostHog workflows. Use when adding a new CI secret, rotating an existing secret, wiring a workflow to an API token, package registry credential, deploy key, or any value referenced via `${{ secrets.* }}` in `.github/workflows/`.

75

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

93%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, executable guide for a focused task with strong actionability and clean structure. Its only gap is the lack of an explicit validate/fix/retry feedback loop for failed secret creation or verification.

Suggestions

Add a short error-recovery step after 'Verify', e.g. if `gh secret list` doesn't show the secret, check `--org posthog` and `--visibility` flags and re-run, to add a validate/fix/retry loop.

Note a quick sanity check that the secret name matches the `${{ secrets.* }}` reference used in the workflow, so a typo in the key doesn't silently fail CI.

DimensionReasoningScore

Conciseness

Lean and efficient; assumes Claude's competence, skips explaining what GitHub Actions or secrets are, and every section earns its place with executable commands rather than prose padding.

5 / 5

Actionability

Fully executable, copy-paste ready `gh secret set` commands cover the common cases (stdin, file, visibility selection, repo updates, list verification) plus a concrete numbered UI walkthrough.

5 / 5

Workflow Clarity

Clear sequence with a verification step ('gh secret list ... | grep') and a numbered UI path, but no explicit error-recovery feedback loop for when the verify step or secret creation fails, leaving a minor validation gap.

4 / 5

Progressive Disclosure

Well-organized single-purpose skill under 50 lines with clear section headers and no external references needed; the body is appropriately self-contained and easy to navigate.

5 / 5

Total

19

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and well-scoped to a clear niche with both concrete actions and explicit 'Use when' trigger guidance. It is one of the strongest description forms, with only minor room for additional synonym triggers.

DimensionReasoningScore

Specificity

Lists concrete actions ('Creates and updates GitHub Actions secrets', 'wiring a workflow to an API token, package registry credential, deploy key') with comprehensive coverage of secret-related operations.

5 / 5

Completeness

Explicitly answers both what ('Creates and updates GitHub Actions secrets for PostHog workflows') and when ('Use when adding a new CI secret, rotating...') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural triggers ('adding a new CI secret', 'rotating an existing secret', '${{ secrets.* }}', '.github/workflows/') but lacks a few common variations a user might say like 'CI tokens' or 'deploy tokens'.

4 / 5

Distinctiveness Conflict Risk

Scoped tightly to GitHub Actions org-level secrets for PostHog with distinct triggers like '${{ secrets.* }}' and '.github/workflows/', giving minimal conflict risk with unrelated skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
PostHog/posthog
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.