Install Anti-Slop Oxlint Rules
dmmulroy/anti-slop
Installs, updates or migrates the vendored anti-slop Oxlint plugin in a repository, keeping local rule changes and the plugin's license and provenance files.
Cross-reference a posthog-js or rrweb change against past incident patterns before writing, reviewing, or merging it.
OfficialCustom licenceAuto-check passed
Install Replay Incident Risk
$ npx skills add PostHog/posthog-js --skill replay-incident-risk -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install PostHog/posthog-js replay-incident-risk --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/PostHog/posthog-js.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/replay-incident-risk .claude/skills/replay-incident-risk && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "replay-incident-risk" agent skill from https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-risk into .claude/skills/replay-incident-risk/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "replay-incident-risk", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-riskType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add PostHog/posthog-js --skill replay-incident-risk -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install PostHog/posthog-js replay-incident-risk --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PostHog/posthog-js.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/replay-incident-risk .agents/skills/replay-incident-risk && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "replay-incident-risk" agent skill from https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-risk into .agents/skills/replay-incident-risk/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "replay-incident-risk", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add PostHog/posthog-js --skill replay-incident-risk -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install PostHog/posthog-js replay-incident-risk --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PostHog/posthog-js.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/replay-incident-risk .cursor/skills/replay-incident-risk && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "replay-incident-risk" agent skill from https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-risk into .cursor/skills/replay-incident-risk/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "replay-incident-risk", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/PostHog/posthog-js.git --path .agents/skills/replay-incident-risk--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add PostHog/posthog-js --skill replay-incident-risk -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install PostHog/posthog-js replay-incident-risk --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PostHog/posthog-js.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/replay-incident-risk .gemini/skills/replay-incident-risk && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "replay-incident-risk" agent skill from https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-risk into .gemini/skills/replay-incident-risk/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "replay-incident-risk", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install PostHog/posthog-js replay-incident-riskInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add PostHog/posthog-js --skill replay-incident-risk -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/PostHog/posthog-js.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/replay-incident-risk .github/skills/replay-incident-risk && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "replay-incident-risk" agent skill from https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-risk into .github/skills/replay-incident-risk/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "replay-incident-risk", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add PostHog/posthog-js --skill replay-incident-risk -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install PostHog/posthog-js replay-incident-risk --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PostHog/posthog-js.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/replay-incident-risk .opencode/skills/replay-incident-risk && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "replay-incident-risk" agent skill from https://github.com/PostHog/posthog-js/tree/main/.agents/skills/replay-incident-risk into .opencode/skills/replay-incident-risk/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "replay-incident-risk", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
replay-incident-risk- GitHub stars
- 634
- Token cost
- ~1.1k tokens
- SKILL.md length
- 522 words
- Files
- 4
- Skills in repo
- 3
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Cross-reference a posthog-js or rrweb change against past incident patterns before writing, reviewing, or merging it.
- Works in 5 steps: Run the mechanical matcher from the repo… → For every matched class, open the class… → A path match is not a verdict. Judge… → …
- A diff touches session recording
- SKILL.md covers Workflow and When writing (not just…
- Runs JavaScript scripts from its folder
What it does
Replay Incident Risk is an agent skill from PostHog/posthog-js, published by the product's own GitHub organization. Cross-reference a posthog-js or rrweb change against past incident patterns before writing, reviewing, or merging it. Use when a diff touches session recording, the recorder or any lazy-loaded extension bundle (entrypoints/), session rotation or idle handling, fetch/XHR wrappers, rrweb record or replay code, recording triggers or remote config, or release workflows. Also use when asked "is this change risky", "could this repeat an incident", or "will this affect recording volume".
Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files (for example `INCIDENTS.md` and `risk-map.json`). Compatibility notes: Requires a posthog-js checkout with git history (origin/main reachable).
It works with PostHog, npm, JavaScript and TypeScript. The repository describes itself as: Send usage data from your web app or site to PostHog, with autocapture.
When your agent uses it
- A diff touches session recording
- Any lazy-loaded extension bundle (entrypoints/)
- Session rotation
- Fetch/XHR wrappers
Example prompts
- “is this change risky”
- “could this repeat an incident”
- “will this affect recording volume”
- “/replay-incident-risk”
Requirements
- Node.js
- Compatibility (from SKILL.md): Requires a posthog-js checkout with git history (origin/main reachable).
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Run the mechanical matcher from the repo root
- For every matched class, open the class section in INCIDENTS.md and answer its review questions against the diff. Answer them concretely…
- A path match is not a verdict. Judge whether the change actually has the failure mode
- Report findings in this shape, per matched class: the incident it resembles, whether this diff has the same failure mode (yes / no / can't…
- If the change plausibly moves recording volume fleet-wide, say so explicitly in the PR description and note that the recordings…
What it can do on your machine
Read from SKILL.md and the folder at commit ddaaf68. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships script files (JavaScript), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Requires a posthog-js checkout with git history (origin/main reachable).
From compatibility in the SKILL.md frontmatter.
Context cost
Replay Incident Risk loads about 1.1k tokens when it runs. Until then it costs about 127 tokens; SKILL.md has 522 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 522 words (~1,051 tokens).
“Changes to posthog-js and the rrweb fork have repeatedly caused severe incidents: fleet-wide recording loss, over-recording that inflated bills, broken customer sites, silent replay corruption, and a stored XSS. Most repeated through a small set of code-level patterns. This skill…”
- name
- replay-incident-risk
- compatibility
- Requires a posthog-js checkout with git history (origin/main reachable).
Files
SKILL.md and 3 other files in .agents/skills/replay-incident-risk of PostHog/posthog-js.
- SKILL.md
- INCIDENTS.md
- check.mjs
- risk-map.json
Open the folder on GitHubat commit ddaaf68
Compare with similar skills
Replay Incident Risk next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Replay Incident Risk this skillPostHog/posthog-js | 634 | — | ~1.1k | Automated safety check: Pass | Custom licence | |
| Install Anti-Slop Oxlint Rulesdmmulroy/anti-slop | 5.4k | — | ~2.2k | Automated safety check: Pass | MIT | |
| Logseq Plugin SDKlogseq/logseq | 45k | — | ~2.3k | Automated safety check: Pass | AGPL-3.0 | |
| Release Roundethereumjs/ethereumjs-monorepo | 2.8k | — | ~2k | Automated safety check: Pass | None | |
| Update Est Fixturesethereumjs/ethereumjs-monorepo | 2.8k | — | ~3.3k | Automated safety check: Pass | None | |
| Linea Dependency MaintenanceConsensys-Incorporated/linea-attestation-registry | 177 | 1 repos | ~3.7k | Automated safety check: Warn | MIT |
Similar skills
Logseq Plugin SDK
logseq/logseq
Build, debug, or review Logseq plugins with the @logseq/libs SDK (TypeScript/JavaScript, iframe/shadow sandboxed).
Release Round
ethereumjs/ethereumjs-monorepo
Runs a coordinated EthereumJS npm release round in six human-gated phases — intent and readiness, CHANGELOG, version bump, publish (human executes), post-publish verification, and announcements.
Update Est Fixtures
ethereumjs/ethereumjs-monorepo
Updates EthereumJS execution-spec test fixtures from an ethereum/execution-specs release, then (after a human merge) points the monorepo submodule, updates VM npm scripts, reports a first test run…
Linea Dependency Maintenance
Consensys-Incorporated/linea-attestation-registry
Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…
Markbind Typescript Migration
MarkBind/markbind
Complete guide for migrating JavaScript files to TypeScript in the MarkBind project, including the two-commit strategy, import/export syntax conversion, and best practices.
More from PostHog/posthog-js
- Official
Compare Array Bundle Size
PostHog/posthog-js
Quickly compare the posthog-js array.js bundle size in the current working tree against a git baseline using the repository's esbuild proxy.
- Official
Develop Extension
PostHog/posthog-js
Author a new PostHog browser extension, or port a posthog-js v1 extension, against the @posthog/browser-common Client/Extension contract.
Related
Works with
Questions about Replay Incident Risk
What does Replay Incident Risk do?
Cross-reference a posthog-js or rrweb change against past incident patterns before writing, reviewing, or merging it. Replay Incident Risk is an agent skill from PostHog/posthog-js, published by the product's own GitHub organization. Cross-reference a posthog-js or rrweb change against past incident patterns before writing, reviewing, or merging it.
When should I use Replay Incident Risk?
Replay Incident Risk fits situations like: A diff touches session recording; any lazy-loaded extension bundle (entrypoints/); session rotation; fetch/XHR wrappers.
How do I install Replay Incident Risk in Claude Code?
Run `npx skills add PostHog/posthog-js --skill replay-incident-risk -a claude-code`. Or copy the skill folder (.agents/skills/replay-incident-risk in PostHog/posthog-js) into .claude/skills/replay-incident-risk in your project. Claude Code loads it when a task matches its description.
How do I install Replay Incident Risk in Codex?
Run `npx skills add PostHog/posthog-js --skill replay-incident-risk -a codex`. Or copy the skill folder (.agents/skills/replay-incident-risk in PostHog/posthog-js) into .agents/skills/replay-incident-risk in your project. Codex loads it when a task matches its description.
Can I use Replay Incident Risk in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add PostHog/posthog-js --skill replay-incident-risk -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/replay-incident-risk, .gemini/skills/replay-incident-risk, .github/skills/replay-incident-risk and .opencode/skills/replay-incident-risk in your project.
What does Replay Incident Risk need to run?
Going by SKILL.md and its folder, Replay Incident Risk needs JavaScript for the scripts in its folder. Our summary lists: Node.js. Compatibility (from SKILL.md): Requires a posthog-js checkout with git history (origin/main reachable)..
Does Replay Incident Risk access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Replay Incident Risk safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Replay Incident Risk use?
Replay Incident Risk has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Replay Incident Risk use?
About 1.1k tokens (SKILL.md is roughly 4.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Replay Incident Risk?
Skills that share tags, products or a category with Replay Incident Risk: Install Anti-Slop Oxlint Rules (dmmulroy/anti-slop, 5.4k stars), Logseq Plugin SDK (logseq/logseq, 45k stars), Release Round (ethereumjs/ethereumjs-monorepo, 2.8k stars) and Update Est Fixtures (ethereumjs/ethereumjs-monorepo, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Replay Incident Risk?
PostHog (a GitHub organization, an official publisher) maintains it in PostHog/posthog-js, which has 634 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on October 10, 2026.
Source: PostHog/posthog-js on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.