CtrlK
BlogDocsLog inGet started
Tessl Logo

review-hog-perspective-contracts-security

The Contracts & Security review perspective for PostHog Review. Verifies that changed code is safe and maintains compatibility: API contracts and breaking changes, injection / authz / data exposure, input validation, and schema / interface alignment. Reports security and contract issues only.

61

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./products/review_hog/skills/review-hog-perspective-contracts-security/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable with concrete search commands and well-organized sections, but it presents parallel investigation areas rather than an explicitly sequenced workflow with validation checkpoints.

Suggestions

Add a short sequenced workflow with a validation checkpoint (e.g., 'confirm each candidate issue reproduces before reporting it').

Trim the redundant restating of categories in 'Key questions' and 'What a valid finding looks like' to reduce token cost.

DimensionReasoningScore

Conciseness

The body is mostly lean and directive, though sections like 'Key questions' and 'What a valid finding looks like' partially restate the investigation areas and could be tightened.

4 / 5

Actionability

Provides concrete, copy-paste-ready `rg` commands for finding API endpoints, input validation, SQL queries, auth checks, and schema definitions that cover the common review cases.

5 / 5

Workflow Clarity

Investigation areas and commands are listed, but there is no explicit sequenced workflow or validation checkpoint (e.g., confirm a finding is real before reporting), leaving checkpoints implicit.

3 / 5

Progressive Disclosure

No bundle files exist and the content is appropriately self-contained in SKILL.md with clear section headers and easy navigation, though it runs slightly over the 50-line simple-skill threshold.

4 / 5

Total

16

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly niched, naming concrete security/contract review areas with good trigger keywords. Its main weakness is the missing explicit 'Use when...' guidance, which caps completeness at 3.

Suggestions

Add an explicit trigger clause such as 'Use when reviewing PRs or diffs for security, contract, or compatibility risks.'

Include a couple of natural user-facing synonyms (e.g., 'vulnerabilities', 'permissions') to broaden trigger coverage.

DimensionReasoningScore

Specificity

Verifies code safety/compatibility and enumerates four concrete areas (API contracts & breaking changes, injection/authz/data exposure, input validation, schema/interface alignment) with comprehensive coverage, though the verbs stay high-level rather than granular.

4 / 5

Completeness

Clearly states what the perspective does, but there is no explicit 'Use when...' trigger clause, so 'when' is only weakly implied — capping completeness at 3 per the guidelines.

3 / 5

Trigger Term Quality

Good keyword coverage including 'contracts', 'security', 'breaking changes', 'injection', 'authz', 'data exposure', 'input validation', and 'schema/interface alignment'; a few natural terms like 'vulnerabilities' or 'permissions' are absent.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (Contracts & Security review only) with distinct triggers and explicit scoping ('Reports security and contract issues only'), minimizing overlap with sibling perspectives.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PostHog/posthog
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.