yoriiis/frontend-code-review
Use when asked to review a MR/PR on GitHub or GitLab. Checks for XSS vulnerabilities, validates ARIA attributes and WCAG compliance, identifies render-blocking issues and race conditions, enforces semantic HTML. Produces actionable feedback.
93
Quality
93%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Securityby
Advisory
Suggest reviewing before use
html.mdreferences/
HTML
Reference standards for HTML review. Only enforce rules that match the target project's conventions.
Semantics
- Respect HTML element hierarchy (
ul > li, notul > div). [Important] - Use
<ul>/<ol>for lists. [Important] - Use heading tags (
h1–h6) for titles, respecting hierarchy. [Important] - Use
<strong>and<em>instead of<b>and<i>(semantic meaning over visual styling). [Suggestion] - Use semantic elements (
<header>,<nav>,<main>,<article>,<section>,<footer>) over generic<div>when appropriate. [Suggestion]
Semantic HTML
- Heading hierarchy skips break screen reader navigation (
h1→h3withouth2). [Important] - Non-semantic interactive elements (
<div onclick>) are invisible to assistive technologies — use<button>or<a>. [Important]
Script loading
- Application scripts in
<head>must usedefer. Noasyncfor app scripts. [Important] - Scripts in
<head>withoutdeferblock rendering. [Important] type="module"scripts are deferred by default — do not adddefer(redundant, invalid on some parsers). [Minor]asyncallowed for third-party scripts that are fully isolated and independent of the DOM (e.g. analytics, tracking pixels). [Suggestion]- Non-critical scripts: place before
</body>closing tag. [Suggestion] - Inline
<script>blocks that execute synchronously block parsing. [Important] - Add
crossoriginattribute on cross-origin scripts. [Important] - Respect dependency order: a script that depends on another must load after it. [Important]
Syntax
- No self-closing tags on void elements in HTML5:
<meta>not<meta />,<br>not<br />. [Minor] - W3C valid markup: structure should pass W3C validator without errors. [Important]
Critical verification checkpoints
- Is element hierarchy correct (e.g. ul > li)?
- Is heading hierarchy continuous (no skip)?
- Are application scripts in head using defer (not async)?
- Are cross-origin scripts using crossorigin?
- Does markup pass W3C validation?