·
Last changedVersion:
This version passed the hardening gate. Hardening applied 4 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 10.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Safety Bypass & Harmful Content | — | High | Closed |
1 finding
This skill guides you through duplicating a feature flag from a source project into one or more target projects within the same PostHog organization.
cleaning-up-stale-feature-flags skill instead.You need the flag's key and the source project's id.
posthog:feature-flag-get-all in the source project to find the matching flag and read its key.Targets must be in the same organization as the source. Call posthog:projects-get to list available projects and confirm membership before issuing the copy.
For a multi-target copy, the tool accepts up to 50 target project ids in a single call. Successes and failures are reported per target, so a partial failure does not block the rest.
Call posthog:feature-flag-get-definition on the source flag. Then always call posthog:feature-flags-copy-dependencies-check with feature_flag_key, from_project, and target_project_ids, rather than trying to detect dependencies first — it copies nothing, and returns an empty result when the flag has none, so running it on every copy is cheap and never skips a real dependency.
A false can_copy_dependencies does not always mean the copy is blocked. It is also false when there is nothing to copy. Report a problem only when warnings is non-empty.
Present a concise summary to the user before copying:
filters.groups[].properties[] — these will be remapped server-side, but the user should know whether the target project already has matching cohortshas_encrypted_payloads) or is remote configuration (is_remote_configuration)copied_dependency_keys (dependencies a copy would create in a target), reused_dependency_keys (dependencies a target already satisfies), and any warningsOne confirmation covers all three options. Default to the safest combination and ask the user to override only if they explicitly want different behavior:
disable_copied_flag: true — the copied flag lands disabled in the target. Recommended by default; turning a flag on in a new project should be a deliberate, observed action.copy_schedule: false — scheduled changes do not come along. Recommended by default; schedules are usually project-specific.copy_dependencies: false — dependency flags do not come along. Set it to true only when the user approves copying the keys step 3's check reported.Call posthog:feature-flags-copy-flags-create with:
feature_flag_key: the source flag's keyfrom_project: the source project idtarget_project_ids: the resolved list of target project idsdisable_copied_flag: from step 4 (default true)copy_schedule: from step 4 (default false)copy_dependencies: from step 4 (default false). Omitting it silently skips dependency copying, even when the user approved it.The response includes a success array (one entry per copied flag) and a failed array (per-target errors). Surface both:
active state in the target.If any targets failed, ask the user whether to retry the failed ones, skip them, or fix the underlying issue (e.g. grant access, then retry).
copy_schedule: true, any scheduled cohort references are remapped just like the live filter conditions.feature_flag:write (or feature_flag:*) scope. A *-only key will be rejected — this endpoint is gated by an INTERNAL viewset and * consent does not satisfy it. Team-scoped keys cannot reach this endpoint either; an org-scoped or unscoped key is required.failed array with a permission error.posthog:feature-flags-copy-flags-create — performs the copy. Required fields: feature_flag_key, from_project, target_project_ids. Optional: disable_copied_flag, copy_schedule, copy_dependencies.posthog:feature-flags-copy-dependencies-check — previews what a copy would do to the flag's transitive flag dependencies. Copies nothing. Call it before every copy; it returns an empty result when the flag has no dependencies.posthog:feature-flag-get-all — find a flag by key/name in a given project when the user only gave a friendly name.posthog:feature-flag-get-definition — fetch the full source flag (filters, variants, cohort references, encryption flags) so you can preview before copying.posthog:projects-get — list projects in the active organization, used to resolve and validate target project ids.Get started with chainctlchainctl skill install public/posthog/copying-flags-across-projects:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/posthog/skills/omnibus/copying-flags-across-projects:latest
MIT
HARDENING.md
LICENSE
SKILL.md