56 results available
Sign in
Skills directory

hogql

posthog

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 6 targeted changes and preserved all other text. Classified findings before hardening: 5. Classified findings closed: 3. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 8.


Open before hardening

3

Medium

2

Low
Open after hardening

2

Medium

Expand
File
Group
Subtype
Severity
Status
references/sessions.md

Sensitive Data & Secret Exposure

Data exfiltration

Medium
Open
references/sessions.md

Excessive Agency & Rogue Autonomy

—

Medium
Open
references/useful-functions.md

Tool & MCP Manipulation

MCP configuration abuse

Medium
Closed
references/clickhouse-functions.md

Prompt Injection

Third-party content as instructions

Low
Closed
references/useful-functions.md

Prompt Injection

Third-party content as instructions

Low
Closed

5 findings


SKILL.md

HogQL queries for PostHog

This skill helps you write HogQL queries for PostHog analytics. HogQL is PostHog's SQL dialect, a wrapper around ClickHouse SQL with simplified property access and PostHog-specific functions.

Reference files

  • references/expressions.md - Sql expressions - docs
  • references/aggregations.md - Supported aggregations - docs
  • references/clickhouse-functions.md - Supported clickhouse functions - docs
  • references/data-access.md - Accessing data using sql - docs
  • references/variables.md - Sql variables - docs
  • references/useful-functions.md - Useful sql functions - docs
  • references/posthog.md - PostHog table schemas (events, persons, groups, sessions)
  • references/sessions.md - Sessions - docs

Consult the documentation for SQL syntax, available functions, and query patterns.

Key principles

  • Property access: Use properties.$property_name for event properties and person.properties.$property_name for person properties
  • Null handling: HogQL has simplified null handling compared to raw ClickHouse SQL
  • Filters placeholder: Use {filters} in queries to allow UI-based filtering in PostHog dashboards
  • Aggregations: Prefer ClickHouse aggregation functions like count(), uniq(), avg(), sum()

Common patterns

Event queries

SELECT event, count()
FROM events
WHERE {filters}
GROUP BY event
ORDER BY count() DESC

Property breakdowns

SELECT properties.$browser AS browser, count()
FROM events
WHERE event = '$pageview' AND {filters}
GROUP BY browser

Framework guidelines

  • Use properties.$name syntax for event properties, person.properties.$name for person properties
  • Use bracket notation for special characters like properties['$feature/cool-flag']
  • For cohorts, filter with person_id IN COHORT 'cohort-name'
  • For actions, use matchesAction('action-name') in WHERE clauses
  • Include {filters} placeholder in WHERE clauses to enable UI-based filtering in dashboards
  • Use {variables.name} for reusable SQL variables across dashboards
  • Access dashboard date range with {filters.dateRange.from} and {filters.dateRange.to}
  • ALWAYS include a time range filter - shorter is faster (e.g., timestamp >= now() - INTERVAL 7 DAY)
  • Prefer uniq() over count(distinct) for counting unique values - it's more efficient
  • Use timestamp-based pagination instead of OFFSET for large datasets
  • Name queries descriptively for easier debugging in query_log
  • Use dateTrunc() for time-based grouping (e.g., dateTrunc('day', timestamp))
  • For funnel queries, use windowFunnel() or sequenceMatch() functions
  • Test queries in the PostHog SQL editor before using them in insights or the API

Install

Install with chainctl
chainctl skill install public/posthog/hogql:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/posthog/skills
Upstream commitf322cbb89771c2cf5d3c2eafa973371633bef064
OCI reference

skills.cgr.dev/public/github.com/posthog/skills/posthog/tools-and-features/skills/hogql:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

references/aggregations.md

references/clickhouse-functions.md

references/data-access.md

references/expressions.md

references/posthog.md

references/sessions.md

references/useful-functions.md

references/variables.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.