signals-scout-csp-violations

Signals scout for Content Security Policy violations. Watches `$csp_violation` events for blocked-URL clusters, per-directive bursts, post-deploy regressions, and suspicious third- party domains.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./products/signals/skills/signals-scout-csp-violations/SKILL.md

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced scout skill with executable SQL and explicit validation gates; its main weakness is verbosity from restating the same trusted-source and header-corroboration rules across sections.

Suggestions

Consolidate the trusted-source / corroborated-header rules into one canonical block in Decide and reference it from Explore and Reconstruct policy instead of restating each time.

Trim editorializing ('Internalize that shape', 'This is the scout's biggest blind spot') and fold redundant push-path explanations into the single 'How this relates to the push-based CSP source' section.

Consider extracting the four detection SQL queries into a `references/queries.md` (own bundle) so the main SKILL.md reads as an overview, strengthening progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Mostly specialized CSP-specific knowledge Claude would not already know (count/users shape table, nonce-normalization rationale, standing-block blind spot), but the Decide section restates the trusted-source / corroborated-header requirement several times and editorializing like 'Internalize that shape' could be trimmed.	3 / 5
Actionability	Provides four copy-paste-ready ClickHouse SQL queries (JSONExtractString, domain(), uniq(), argMax(), groupArray) plus executable `gh search code` / `gh api ... \| base64 -d` commands and concrete scratchpad key formats, covering the main detection cases.	5 / 5
Workflow Clarity	Clear run sequence (Get oriented -> Profile shape -> Explore -> Save memory -> Decide -> Close out -> When to stop) with explicit validation gates (corroborate header against code, check in-flight PRs, own-surface check, push-path dedupe) and feedback loops (the code-vs-reports reconcile table).	5 / 5
Progressive Disclosure	Well-signaled one-level-deep deferral to `authoring-scouts` -> `references/report-contract.md` and code paths (`posthog/api/csp.py`, `posthog/tasks/csp_signal.py`) with clear section navigation, but no own bundle files exist and the lengthy SQL/Decide content is fully inlined rather than split into this skill's own references.	4 / 5
	Total	17 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A domain-specific, well-targeted description that names concrete CSP detection targets and uses good synonym coverage, but it lacks an explicit 'Use when...' trigger clause, which caps its completeness.

Suggestions

Add an explicit trigger clause, e.g. 'Use when scouting a team's $csp_violation event stream for blocked-URL clusters, directive bursts, or deploy-correlated regressions.'

Surface one or two more natural user terms (e.g. 'CSP header', 'report-only vs enforce', 'policy allowlist') alongside 'CSP violations'.

Tighten 'suspicious third-party domains' to a more concrete signal (e.g. 'fresh unrecognized script-src domains') to lift specificity.

Dimension	Reasoning	Score
Specificity	Names the CSP domain and four concrete detection targets ("blocked-URL clusters, per-directive bursts, post-deploy regressions, and suspicious third-party domains"), but uses a single verb ("Watches") with multiple objects rather than multiple distinct actions, and "suspicious third-party domains" is mildly generic.	4 / 5
Completeness	Has a clear "what" (scouts CSP violations, watches for four cluster types) but no explicit "Use when..." trigger clause; per the rubric a missing explicit trigger guidance caps completeness at 3, and the "when" is only weakly implied.	3 / 5
Trigger Term Quality	Good synonym coverage with the full form ("Content Security Policy violations"), abbreviation ("CSP violations"), and event token ("`$csp_violation`") akin to a file extension, but misses natural terms like "CSP header", "report-only/enforce", or "allowlist".	4 / 5
Distinctiveness Conflict Risk	The CSP niche and the `$csp_violation` event give it a distinct trigger, but it belongs to a family of sibling signals-scouts that share report mechanics, so there is minor overlap risk with closely related scout skills.	4 / 5
	Total	15 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 3 missing	Warning

	Total	13 / 16 Passed

Repository: PostHog/posthog
Path: products/signals/skills/signals-scout-csp-violations/SKILL.md
Commit: b0fece0

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.