- Installs
- 395
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/posthog/ai-plugin --skill auditing-experiments-flags- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads auditing-experiments-flags automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Auditing experiments and feature flags
This skill teaches you how to run configuration audits on experiments and feature flags.
All checks use the experiment and feature flag read tools (experiment-get, experiment-list, feature-flag-get-definition, feature-flag-get-all) — no SQL queries are needed for Phase 1 checks.
Usage modes
Quick check (single entity)
When the user asks about a specific experiment or flag:
- Fetch the entity via
experiment-get(experiment ID) orfeature-flag-get-definition(numeric flag ID). - Apply the relevant checks from experiment checks or flag checks.
- Report findings inline as markdown, grouped by severity (CRITICAL first, then WARNING, then INFO).
- Include entity links as
[Experiment: name](/experiments/id)or[Flag: key](/feature_flags/id).
Scoped audit (one domain)
When the user asks to audit all experiments or all flags:
- Bulk-fetch via
experiment-listorfeature-flag-get-all. - Run all checks for that domain against each entity.
- Group findings by severity, then by entity.
- Report as inline markdown.
Full audit (comprehensive)
When the user asks for a comprehensive audit of both experiments and flags:
- Fetch all experiments via
experiment-listand all flags viafeature-flag-get-all. - Run all experiment checks and all flag checks.
- Apply recurring patterns to identify patterns across multiple findings.
- If there are more than 5 entities with findings, write them to a notebook for easier navigation. Otherwise report inline. Create the notebook from the project's own notebook tools. Run
search notebooks?-to load them and read the titles.
Output format
For each finding, include:
- Severity badge:
🔴 CRITICAL,🟡 WARNING, or🔵 INFO - Check name: Which check produced this finding
- Entity link: Markdown link to the entity
- What's wrong: One-sentence description
- Action: What to do about it (see remediation actions)
Example:
🟡 WARNING — Flag integration · Experiment: checkout-redesign The linked feature flag is inactive (paused). Traffic is not being split. Action: Re-enable the flag or end the experiment.
Handling unavailable data
Some checks require activity logs (feature-flags-activity-retrieve for flags), which may not be available in every session.
If activity log data is unavailable:
- Skip
checkActivityHistory(experiment check) entirely. - Skip the "toggle instability" and "never activated" sub-checks in flag lifecycle checks.
- In your report, note which checks were skipped and why:
Skipped: Activity history checks (activity logs not available via current tools)
Partial failures
If a fetch call fails for some entities:
- Continue with the entities you could fetch.
- Report which entities could not be assessed and why.
- Do not silently omit entities from the audit.
Reference files
- Experiment checks — experiment configuration checks
- Flag checks — feature flag checks
- Finding types — severity and category definitions
- Recurring patterns — patterns across multiple findings
- Remediation actions — what to do about each finding
FAQ
What does the auditing-experiments-flags skill do?
Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.
How do I install auditing-experiments-flags?
Run npx skills add https://github.com/posthog/ai-plugin --skill auditing-experiments-flags in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/auditing-experiments-flags/ (personal) or .claude/skills/auditing-experiments-flags/ (project).
Which AI agents can use auditing-experiments-flags?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is auditing-experiments-flags safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains auditing-experiments-flags?
It is published by posthog in posthog/ai-plugin, and it is an official skill from the maker of the technology it covers. It has 395 recorded installs.
More from posthog/ai-plugin
instrument-product-analytics
posthog/ai-plugin
Add PostHog product analytics events to track user behavior. Use after implementing new features or reviewing PRs to ensure meaningful user actions are captured. Also handles initial PostHog SDK setup if not yet installed.
instrument-feature-flags
posthog/ai-plugin
Open the skill to read its SKILL.md instructions.
cleaning-up-stale-feature-flags
posthog/ai-plugin
Open the skill to read its SKILL.md instructions.
querying-posthog-data
posthog/ai-plugin
Explains how to query PostHog data, defaulting to typed runners for supported product analytics. Read it before you write HogQL/SQL. Also read it before you call execute-sql against PostHog. Use it to find or aggregate PostHog entities. These entities include insights, dashboards, cohorts, feature flags, experiments, surveys, hog flows, warehouse data, and persons. Use it for trends, funnels, retention, lifecycle, paths, stickiness, web analytics, error tracking, logs, sessions, and LLM traces. Before you calculate a governed business or telemetry measure, check system.informationschema.metrics for an approved definition. Examples include MRR, activation, billable usage, active organizations, and failure rates. Use the approved definition before you derive a measure from raw events or use a typed domain tool. It also covers HogQL differences, system table schemas, functions, query examples, and schema discovery.
creating-experiments
posthog/ai-plugin
Open the skill to read its SKILL.md instructions.
configuring-experiment-analytics
posthog/ai-plugin
Open the skill to read its SKILL.md instructions.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.