56 results available
Sign in
Skills directory

diagnosing-stacktrace-symbolication

posthog

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 3 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 3. Classified findings remaining: 3. Unclassified scanner findings remaining: 0. Review findings closed: 5. Review findings remaining: 15.


Open before hardening

4

Medium

2

Low
Open after hardening

3

Medium

Expand
File
Group
Subtype
Severity
Status
references/javascript.md

Prompt Injection

Direct prompt injection

Medium
Open
SKILL.md

Tool & MCP Manipulation

MCP over-permissioning

Medium
Open
SKILL.md

Supply Chain & Install-Time Trust

—

Medium
Closed
scripts/inspect_sourcemaps.py

Supply Chain & Install-Time Trust

—

Medium
Open
SKILL.md

Malicious Code & Command Execution

—

Low
Closed
SKILL.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Closed

6 findings


SKILL.md

Diagnosing stack-trace symbolication

Symbolication is the cross-platform name for what JavaScript source-map lookup, Hermes function-offset resolution, Proguard / R8 demangling, and dSYM address-to-line lookup all do — turn a minified or obfuscated frame back into a readable file, function, and line.

Work through the user's build and PostHog symbol sets as one pipeline: build config -> generated symbol artifacts (JavaScript source maps, Hermes maps, Proguard mappings, or dSYM bundles) -> uploaded symbol set in PostHog -> captured error frame. Most failures become obvious once those four pieces are checked in order.

Platforms

PlatformSymbol-data typeReference

JavaScript / TypeScript web

source-and-map

javascript.md

React Native (Hermes)

hermes

coming soon

Android (Proguard / R8)

proguard

coming soon

iOS / macOS (dSYM)

apple-dsym

coming soon

Step 3 of the workflow (symbol-set lookup in PostHog) is identical across platforms — posthog-cli symbol-sets extract handles all four container types. Steps 1, 2, and the platform-specific failure modes live in the per-platform reference.

Workflow

Step 1 - Find how symbol data is produced and uploaded

Look at the app repo's build scripts and PostHog upload config. Confirm which PostHog package handles the upload (@posthog/rollup-plugin, @posthog/webpack-plugin, @posthog/nextjs-config, @posthog/nuxt, or direct posthog-cli) and which directory or asset it processes. See the platform reference for build-tool-specific config inspection.

For debugging, prefer a build where symbol artifacts remain on disk after upload so you can compare local artifacts against what PostHog received. JavaScript example with the Vite plugin (the platform reference covers the equivalent setting for other build tools):

sourcemaps: {
  enabled: true,
  deleteAfterUpload: false,
}

Step 2 - Build and inspect local artifacts

Run the production build that uploads symbols, then inspect the emitted files locally. The exact files and helper invocation differ per platform — see the platform reference for the helper command, expected file shape, and common build-time pitfalls (notably empty-mappings false positives that look like upload bugs but are actually bundler config issues).

If local artifacts already look wrong, fix the build before debugging the PostHog upload.

Step 3 - Check symbol sets in PostHog

Look up the symbol set whose ref matches the captured frame's chunk_id using the dedicated MCP tools — they handle auth, project scoping, and pagination automatically:

  • posthog:error-tracking-symbol-sets-list with ref=<chunk_id> returns the matching row.
  • posthog:error-tracking-symbol-sets-retrieve with the ID returns the same shape (and confirms permissions).
  • posthog:error-tracking-symbol-sets-download-retrieve returns a one-hour presigned URL pointing at the uploaded symbol-data file. Download it immediately; do not echo the URL back.

If MCP access is not available, the same data is in Project settings > Error tracking > Symbol sets in the PostHog UI.

Interpret the row:

  • ref must match the captured frame chunk_id.
  • last_used updating means PostHog found and loaded that symbol set. It does not guarantee the frame resolved.
  • has_uploaded_file: false means the upload did not complete.
  • A non-null failure_reason means PostHog could not parse or load the uploaded symbol data.

The downloaded file is a PostHog symbol-data container (compressed Rust-encoded payload), not plain JSON. Extract it with posthog-cli:

posthog-cli symbol-sets extract symbolset.bin -o ./extracted

posthog-cli symbol-sets extract handles all four symbol-set types (source-and-map, hermes, proguard, dSYM) and writes the extracted files into the output directory. Once extracted, summarize using the platform reference's helper.

Step 4 - Compare local, uploaded, and served files

Use the failure location to decide what to compare:

  • Local artifact empty and uploaded artifact empty: build tool emitted unusable symbols.
  • Local artifact valid but uploaded artifact empty: upload processing selected or packed the wrong data.
  • Uploaded artifact valid but production stack stays minified or obfuscated: compare deployed binary bytes to the binary that was uploaded with the symbols.
  • Token not found: PostHog loaded the symbol data but the captured generated position did not match any token in the uploaded artifact. Usually points to a changed binary after upload, wrong line / column capture (JavaScript) or wrong frame offset (Hermes / dSYM), or a symbol-coverage bug.

Step 5 - Fix the most likely layer

Platform-neutral fixes:

  • Upload symbols after the final build output exists, not before a later step rewrites it.
  • Re-upload changed assets intentionally when the same ref was previously uploaded with different content.
  • Remove deployment-time transforms (CDN minify, edge rewrites, compression) that change the served binary after upload.

Platform-specific fixes live in the platform reference.

Captured frame checks

From an affected PostHog error event, collect one minified application frame:

  • filename
  • line or lineno
  • column or colno
  • function
  • chunk_id (or platform-equivalent symbol-set ref)
  • any resolve_failure, especially Token not found

The frame filename should match the deployed binary URL. The chunk_id should match the symbol set ref. The captured generated position should point into the same binary that was uploaded with the symbol data.

Failure matrix (cross-platform)

EvidenceLikely causeNext check

No chunk_id on frames

Chunk ID injection missing or SDK frame parser did not map the filename

Inspect deployed binary and raw frame filenames.

Symbol set row missing

Upload went to another PostHog project/host or skipped this asset

Compare plugin projectId, host, and ref.

has_uploaded_file: false

Upload did not finish

Check build logs; compare posthog-cli output to the symbol set row.

Non-null failure_reason

PostHog could not parse the uploaded symbol data

Download via Step 3 and inspect the extracted contents.

Uploaded artifact valid, deployed binary differs

Deployment/CDN/post-build transform changed the binary after upload

Compare deployed bytes to local build output.

Token not found

Captured position has no token in the uploaded symbol data

Verify captured position, deployed binary identity, and symbol-data coverage.

Platform-specific failure modes (empty mappings, missing sourcesContent, Hermes function-offset mismatch, Proguard class-name drift, dSYM UUID mismatch) live in the platform reference.

Install

Install with chainctl
chainctl skill install public/posthog/diagnosing-stacktrace-symbolication:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/posthog/skills
Upstream commit8853bde2f2e9cd50824532e53c900b90b2eb9af2
OCI reference

skills.cgr.dev/public/github.com/posthog/skills/omnibus/diagnosing-stacktrace-symbolication:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

references/javascript.md

scripts/inspect_sourcemaps.py


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.