best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practice…
What it does
- [ ] HTTPS enabled, no mixed content
- [ ] No vulnerable dependencies (npm audit)
- [ ] CSP headers configured (with frame-ancestors, base-uri, form-action)
- [ ] require-trusted-types-for 'script' enforced (or report-only during rollout)
- [ ] Third-party <script>/<link rel="stylesheet"> pinned with SRI hashes
- [ ] Security headers present (HSTS, X-Content-Type-Options, Referrer-Policy)
- [ ] No exposed source maps (and sourcesContent stripped from uploaded ones)
Requirements & configuration
- Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default;
- // ✅ If you need preventDefault, be explicit
- // Explain why you need it
- [ ] require-trusted-types-for 'script' enforced (or report-only during rollout)
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
Source
Repository: https://github.com/addyosmani/web-quality-skills
best-practices FAQ
What does the best-practices skill do?
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities". [ ] HTTPS enabled, no mixed content [ ] No vulnerable dependencies (npm audit)
What does best-practices require?
Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default; // ✅ If you need preventDefault, be explicit // Explain why you need it [ ] require-trusted-types-for 'script' enforced (or report-only during rollout)
How do I install best-practices?
Run: npx -y skills add https://github.com/addyosmani/web-quality-skills --skill best-practices --agent claude-code — the source lives at github.com/addyosmani/web-quality-skills.
Maintain best-practices?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/addyosmani-web-quality-skills-best-practices?ref=badge) npx agentictools info skills/addyosmani-web-quality-skills-best-practices The second line is the CLI lookup for this page — handy in READMEs and docs.
Related skills
security-requirement-extraction Transform threat analysis into actionable security requirements.
solidity-security Comprehensive smart contract security patterns, vulnerability prevention, and secure Solidity development practices.
k8s-security-policies Defense-in-depth Kubernetes security through network policies, pod security standards, RBAC, and admission control.
sql-code-review Comprehensive SQL security, performance, and quality analysis across MySQL, PostgreSQL, SQL Server, and Oracle databases.
skill-vetter Pre-install security vetting for OpenClaw skills using a structured red-flag checklist.
firestore-security-rules-auditor Automated security auditor for Firestore rules using red-team methodology and structured scoring.