best-practices

Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/best-practices/SKILL.md

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-organized reference with strong executable examples, held back by overall length and a monolithic structure rather than an overview pointing to split-out detail files.

Suggestions

Move the longer reference material (CSP/Trusted Types recipes, vulnerable-library patterns) into reference files and keep SKILL.md as an overview with one-level-deep links, improving both conciseness and progressive disclosure.

Add an explicit sequenced audit workflow with validation checkpoints (e.g. run npm audit -> review findings -> fix -> re-audit -> only proceed when clean) to lift workflow clarity.

Trim historical narrative (X-XSS-Protection removal, polyfill.io timeline) to one-line pointers so the body earns every token.

Dimension	Reasoning	Score
Conciseness	The style is lean (tight prose plus executable ❌/✅ code), but the body is very long (~640 lines) and a few passages, such as the X-XSS-Protection deprecation narrative and the polyfill.io incident recap, could be trimmed without losing actionability.	2 / 3
Actionability	It supplies extensive copy-paste-ready, executable examples across HTML, JS, JSON, bash, and HTTP headers, with specific commands (e.g. 'openssl dgst -sha384 ...', 'npm audit --audit-level=moderate').	3 / 3
Workflow Clarity	An audit checklist and one mini feedback loop ('Roll out with Report-Only first ... then flip to enforcement') provide structure, but there is no explicit sequenced workflow with validation checkpoints for the operations it describes.	2 / 3
Progressive Disclosure	Sections are clearly organized and the References list is well signaled, but the file is monolithic — security and code-quality detail that could live in one-level-deep reference files is inlined, and no bundle files are provided to split it.	2 / 3
	Total	9 / 12 Passed

Description

82%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A solid description with explicit what/when structure and natural trigger phrases, weakened mainly by a generic lead verb and some overlap risk with broader code-quality skills.

Suggestions

Replace the abstract verb 'Apply ... best practices' with concrete actions, e.g. 'Audit web apps for security headers, mixed content, vulnerable dependencies, and deprecated APIs'.

Tighten distinctiveness by scoping the lead to the Lighthouse/web-app context so it does not compete with general code-quality skills.

Dimension	Reasoning	Score
Specificity	It names the domain ('modern web development') and three sub-domains ('security, compatibility, and code quality'), but the verb is the abstract meta-action 'Apply ... best practices' rather than multiple concrete actions like 'extract text', 'fill forms'.	2 / 3
Completeness	It explicitly answers both 'what' ('Apply modern web development best practices for security, compatibility, and code quality') and 'when' via an explicit 'Use when asked to ...' clause, matching the level-3 anchor.	3 / 3
Trigger Term Quality	It lists five natural trigger phrases users would actually say ('apply best practices', 'security audit', 'modernize code', 'code quality review', 'check for vulnerabilities'), giving good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	The triggers point at a fairly specific web-quality niche, but the lead phrase 'apply best practices' is broad and could overlap with general web or code-quality skills, so it is not yet a clearly non-conflicting niche.	2 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (642 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: addyosmani/web-quality-skills
Path: skills/best-practices/SKILL.md
Commit: 95d6e25

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.