review-hog-perspective-performance-reliability

Will this hold up once real traffic hits it? That is what this pass of PostHog's automatic code review asks of every change, looking for slow database access, errors that vanish silently, and missing time limits or logging.

WHEN TO USE

SCOPE

USE FOR

Catch code that runs one database query per item in a list instead of one for the whole list.
Find errors that are caught and then quietly ignored, so a failure would go unnoticed.
Flag missing paging, caching or rate limits that will strain once traffic grows.
Spot memory leaks and needless screen redraws in the parts of an app people see.
Check new background work has time limits, cleanup and enough logging to debug it later.
Grade each finding as must fix, should fix, or worth considering.

NOT FOR

Wrong results or broken business rules — those belong to the Logic & Correctness pass.
Vulnerabilities and changes that break an API, which the Contracts & Security pass covers.
Third-party, generated or test files, which it reads for context only.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (7)

Review perspective: Performance & Reliability

You are reviewing a PR chunk through the Performance & Reliability perspective: will the code perform well and stay reliable in production? Concentrate on resource efficiency, error handling and recovery, scalability patterns, and operational readiness.

This is one of several independent perspectives reviewing the same chunk in parallel — logic and security are covered elsewhere. Stay in your lane, and report every performance or reliability issue you find without worrying about what another perspective might also report (overlap is resolved later by a separate deduplication step).

Primary investigation areas

Resource efficiency
- Identify N+1 query problems
- Check for missing database indexes
- Find unnecessary re-renders (frontend)
- Look for memory leaks
- Check bundle sizes and imports
Error handling & recovery
- Verify try / catch blocks are present where needed
- Check for swallowed errors
- Validate retry logic for failures
- Ensure error boundaries (React)
- Check error-message quality
Scalability patterns
- Look for missing caching opportunities
- Check pagination implementation
- Find synchronous operations that should be async
- Identify resource-pool exhaustion risks
- Verify rate limiting where needed
Operational readiness
- Check logging completeness
- Verify metrics / monitoring hooks
- Validate timeout configurations
- Ensure health-check coverage
- Check for cleanup handlers

Investigation commands

Find queries in loops: rg "for.*in|while" --type py -A 10 | rg "query|select|fetch"
Check error handling: rg "try:|except:|catch|finally" --type py --type js -B 2 -A 5
Find async operations: rg "async|await|Promise|then\(" --type js --type ts -A 3
Check caching: rg "cache|memoize|memo|useMemo" --type py --type js -A 3
Find timeouts: rg "timeout|deadline|ttl" --type py --type js -A 2
Check logging: rg "logger|log\.|console\." --type py --type js

Where to focus

Concentrate primary attention on:

Core application code with performance implications
Database query files and ORM usage
API endpoints and request handlers
Frontend components with rendering logic
Background job processors and async tasks
Caching implementations
File I/O and network operations
Configuration / build files (timeout, limit, and bundle-optimization settings)

Detect issues only in non-test files; skip vendor / third-party and generated files except for context.

What to leave to other perspectives

Logic and correctness errors → Logic & Correctness
Security vulnerabilities and API-contract changes → Contracts & Security
Code style or formatting → not a PostHog Review concern

Key questions

Will this code scale under load?
Are errors handled gracefully with proper recovery?
Is there sufficient observability (logs, metrics)?
Are resources used efficiently?
Are there potential bottlenecks or performance cliffs?
Is the system resilient to failures?

What a valid finding looks like

A Performance & Reliability finding relates to:

Performance bottlenecks (N+1, missing indexes, etc.)
Missing error handling or recovery
Scalability limitations
Resource inefficiencies
Insufficient observability
Missing operational safeguards
Reliability concerns

Severity guide

Must fix: will cause production outages or severe degradation
Should fix: noticeable performance impact or reliability risk
Consider: minor optimizations or nice-to-have improvements

This skill ships inside the PostHog AI Plugin. Listed package contents include 3 slash commands, 1 agent, hooks and an MCP server. Installed components and skill versions may vary by AI tool.

Install just this skill

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add posthog/ai-plugin --skill "review-hog-perspective-performance-reliability" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

Install the whole plugin

This route installs the posthog plugin package selected for your AI tool.

Claude Code

Add PostHog's marketplace, then install the plugin

Run both lines in a terminal. They install PostHog's posthog plugin: this skill, PostHog's other skills, and a connection to PostHog's hosted MCP server.

claude plugin marketplace add PostHog/ai-plugin

02
```
claude plugin install posthog@posthog
```

Installation and loading

The plugin installs for you in every project and loads the next time you start Claude Code, or after /reload-plugins in an open session.
To connect your PostHog account, start claude, type /mcp, select plugin:posthog:posthog and follow the browser prompts.

Good to know

The plugin includes PostHog's session-capture hook; PostHog's README says it sends sessions to LLM Analytics only when POSTHOG_LLMA_CC_ENABLED=true and POSTHOG_API_KEY are both set.
If you use the separate posthog-telemetry plugin, PostHog says to keep only one of the two, because both register the same hook.
On a self-hosted PostHog, this route's MCP connection won't reach your instance: the plugin's config is fixed to https://mcp.posthog.com/mcp, which routes to PostHog's US or EU region. POSTHOG_MCP_URL works only for the Gemini CLI extension.

View on GitHub

Same repository

adding-warehouse-person-properties
Sync columns from a synced data warehouse table onto PostHog person or group properties, so warehouse data becomes usable anywhere person and group properties already work: feature flag targeting, cohorts, insight filters and breakdowns, surveys, session replay filters, workflows, and the person profile. Use when the user wants to "add a person property from my warehouse", "enrich people with Stripe/Postgres/Salesforce data", "put ARR or plan tier on my persons", "target a feature flag by a warehouse column", "sync warehouse columns onto groups or organizations", or wants to inspect, backfill, disable, or debug an existing warehouse-backed person or group property.Read full description
analyzing-expensive-users
Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.Read full description
analyzing-experiment-session-replays
Analyze session replay patterns across experiment variants to understand user behavior differences. Use when the user wants to see how users interact with different experiment variants, identify usability issues, compare behavior patterns between control and test groups, or get qualitative insights to complement quantitative experiment results. Also covers pairing the observed behavior with a linked survey when the user wants qualitative feedback beyond what recordings show.Read full description
assessing-heatmaps
Assesses what a page's heatmap is telling you and recommends concrete changes. Pulls click / rageclick / scroll-depth data for a URL, names the hot elements by cross-referencing autocapture events on the same page, and can create a saved heatmap the user opens in PostHog, then summarizes the behavior and proposes improvements. TRIGGER when: user asks what a heatmap shows, why people aren't clicking something, where users rage-click, how far they scroll, what to change on a page based on heatmap/click data, or to 'analyze/assess/review the heatmap' for a URL. DO NOT TRIGGER when: the user only wants to create a saved heatmap screenshot with no analysis (use heatmaps-saved-create directly), or is asking about session replay in general (use investigating-replay).Read full description
auditing-endpoints
Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks "what endpoints can I clean up?", "are any of my endpoints broken?", "which materialised versions are still being called?", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.Read full description
auditing-experiments-flags
Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.Read full description

Review perspective: Performance & Reliability

Primary investigation areas

Investigation commands

Where to focus

What to leave to other perspectives

Key questions

What a valid finding looks like

Severity guide

Account or credentials required

Install just this skill

Install the whole plugin

Add PostHog's marketplace, then install the plugin

More skills

adding-warehouse-person-properties

analyzing-expensive-users

analyzing-experiment-session-replays

assessing-heatmaps

auditing-endpoints

auditing-experiments-flags