Agent skill · practicalswan
best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to \"apply best practices\", \"security audit\", \"modernize code\", \"code quality review\", or \"check for vulnerabilities\".
What it needs
About 8k tokens when loaded.
What this skill does
Best practices Modern web development standards based on Lighthouse best practices audits. Covers security, browser compatibility, and code quality patterns. Evidence-led audit workflow When a rendered page is available: 1. Run a live Lighthouse Best Practices audit when that capability is available; with Chrome DevTools MCP, use lighthouseaudit. Use navigation mode for a normal page load or snapshot mode when the current state must be preserved. 2. Inspect the listed console and network failures and fetch individual details only when they support a finding. 3. Supplement runtime evidence with dependency, header, configuration, and source inspection; Lighthouse is not a complete security assessment. 4. Fix the implicated code, re-run the same audit, and keep security findings separate from style preferences. If live tools are unavailable, use the Lighthouse CLI plus focused dependency and header checks. Never report a high Lighthouse score as proof that the application is secure. Security Read the security reference when security is in scope or a live audit surfaces a related failure. It covers HTTPS/HSTS, CSP and Trusted Types, Subresource Integrity, headers, dependencies, sanitization, and cookies. At minimum: Use HTTPS without mixed content. Add HSTS only after confirming every relevant subdomain supports HTTPS. Treat a strict CSP as defense in depth. Prefer nonces or hashes and test with report-only before enforcement. Sanitize untrusted HTML and protect DOM XSS sinks. Prefer text APIs when markup is not required. Pin and review third-party code. Use SRI where the delivery model supports it and keep dependencies patched. Verify response headers at runtime. Source configuration alone does not prove what the deployed page sends. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills practicalswan/best-practices