signals-scout-csp-violations

Signals scout for Content Security Policy violation reports. Watches `$csp_violation` events for blocked-URL clusters, per-directive bursts, post-deploy regressions, and suspicious third-party domains, and files each validated cluster as a report in the inbox.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./products/signals/skills/signals-scout-csp-violations/SKILL.md

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable SQL, explicit thresholds, and a well-sequenced workflow including validation checkpoints and stopping conditions. Its main weakness is redundancy — the push-path and edit-on-material-change points are restated across several sections — which hurts token efficiency.

Suggestions

Consolidate the push-path/dedupe-partner explanation into a single section (it currently recurs in the intro, Decide, MCP tools, and the closing section) and back-reference it instead of restating.

State the 'edit only on material change' rule once in Decide and reference it from the memory examples and close-out rather than repeating the full rationale each time.

Consider extracting the large SQL queries and the scratchpad key catalog into a local reference file to tighten the body further, which would also strengthen progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is dense and high-signal (no generic concept explanations, assumes Claude knows CSP), but several points are restated multiple times — the push-path/dedupe-partner guidance appears in the intro, Decide, MCP tools, and a closing section, and "edit only on material change" is repeated ~4 times — which is noticeable redundancy rather than minor.	3 / 5
Actionability	Provides two complete copy-paste-ready SQL queries, concrete scratchpad key formats with worked examples, explicit numeric thresholds (≥10 distinct pageviews, ≥3× baseline, distinct_users ≥ 100), and a precise priority mapping (P1–P2 / P2–P3), covering the common cases fully.	5 / 5
Workflow Clarity	The run is clearly sequenced (orient → profile → explore → save memory → decide → close out) with explicit validation gates (close-out requires the standing-enforced check first; Decide has edit/author/remember/skip rules), a Disqualifiers checklist, and a 'When to stop' section with concrete stopping conditions.	5 / 5
Progressive Disclosure	Structure is well organized with clear section headers, and generic report mechanics are deferred to a one-level-deep, clearly signaled reference (authoring-scouts → references/report-contract.md) so the body holds only CSP-specific framing; the reference points to a sibling skill's bundle rather than a local file, a minor organization gap keeping it just below 5.	4 / 5
	Total	17 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly conveys a specific niche and concrete capabilities, but it omits any explicit "when to use" trigger guidance, which limits completeness and trigger-term quality. Adding a "Use when..." clause with natural trigger phrases would lift the weaker dimensions.

Suggestions

Add an explicit 'Use when...' clause naming natural trigger phrases (e.g., 'Use when investigating CSP violations, blocked-URL clusters, or post-deploy Content Security Policy regressions').

Include common synonyms/variations users might say ("CSP reports", "Content Security Policy errors", "blocked script violations") to broaden trigger-term coverage.

Optionally surface the distinct action verbs more prominently (watch/cluster/file) to push specificity toward comprehensive coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete watch-actions ("blocked-URL clusters, per-directive bursts, post-deploy regressions, and suspicious third-party domains") plus a filing action, giving broad coverage, though only two verb types (watches, files) are used rather than many distinct operations.	4 / 5
Completeness	The "what" is clear (watches $csp_violation events for clusters and files reports), but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Contains relevant domain keywords a CSP-focused user would say ("Content Security Policy violation reports", "$csp_violation", "CSP violation"), but leans on technical jargon and lacks common variations, synonyms, or an explicit trigger phrase.	3 / 5
Distinctiveness Conflict Risk	Targets a highly specific niche (CSP violation report scouting with $csp_violation event analysis) with distinct triggers and minimal risk of firing for an unrelated skill.	5 / 5
	Total	15 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 3 missing	Warning

	Total	13 / 16 Passed

Repository: PostHog/posthog
Path: products/signals/skills/signals-scout-csp-violations/SKILL.md
Commit: 31f2a90

Reviewed: about 22 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.