📦

best-practices

Name: best-practices
Author: addyosmani

v2.0 Inhaltsrevision r1 Mittleres Risiko ⚡ Enthält Skripte⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen

Improve Web Security and Code Quality

Web applications can accumulate insecure settings, deprecated APIs, and browser compatibility problems. This skill guides evidence-based reviews and targeted fixes using Lighthouse, source inspection, and security checks.

Unterstützt: Claude Codex Code(CC)

📊 66 Angemessen

Maintain this Skill? Claim it 📊 66 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "best-practices" from https://skillstore.io/skills/addyosmani-best-practices.md and its manifest at https://skillstore.io/api/skills/addyosmani-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/addyosmani-best-practices.md Signiertes manifest GET /api/skills/addyosmani-best-practices/manifest Signiertes lockfile GET /api/skills/addyosmani-best-practices/lockfile

Testen

„best-practices“ wird verwendet. Review a page with synchronous requests and event listeners that remain active after navigation.

Erwartetes Ergebnis:

Finding: Synchronous requests block the main thread. Replace them with asynchronous requests and explicit failure handling.
Finding: Listeners remain active after navigation. Remove them during cleanup or attach an AbortController.
Verification: Repeat navigation and confirm listener cleanup and responsive interactions.

„best-practices“ wird verwendet. Review a deployment that publishes source maps and lacks security response headers.

Erwartetes Ergebnis:

Finding: Public source maps may expose original source. Restrict access and remove embedded source content from uploaded maps.
Recommendation: Configure appropriate security response headers and test CSP in report-only mode before enforcement.
Verification: Inspect deployed responses and repeat the same audit. Do not treat a high Lighthouse score as security assurance.

Sicherheitsaudit

Mittleres Risiko

v1 • 22.10.2026 Versionsbericht öffnen

All 95 static findings are false positives involving documentation examples, explicitly discouraged patterns, or legitimate audit references. No evidence found of prompt injection, credential theft, or malicious execution. Two semantic findings identify security guidance errors concerning Permissions-Policy delivery and structuredClone behavior.

Gescannte Dateien

677

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Mittel

SKILL.md:420-430

Permissions Policy Examples Do Not Enforce Restrictions

The skill recommends meta http-equiv="Permissions-Policy" to restrict geolocation, camera, and microphone. Browsers require the HTTP response header, so copied examples leave these policy restrictions unenforced.

Both examples use an unsupported meta delivery mechanism. This creates false assurance about feature restrictions, although browser permission prompts still apply.

Mittel

references/SECURITY.md:157-158

Cloning Is Incorrectly Presented as Dangerous-Key Sanitization

The reference states that structuredClone drops __proto__ and functions, then labels its result deepSafe. Cloning preserves __proto__ data keys, so later unsafe merges can still expose prototype-pollution risks.

A local runtime check confirmed that structuredClone preserves an own __proto__ key and throws DataCloneError for functions. Cloning alone does not sanitize merge inputs.

Risikofaktoren

⚡ Enthält Skripte (7)

references/SECURITY.md:169 references/SECURITY.md:72 references/SECURITY.md:75 references/SECURITY.md:168 references/SECURITY.md:176 SKILL.md:140 SKILL.md:141

⚙️ Externe Befehle (50)

references/SECURITY.md:100-116 SKILL.md:18 SKILL.md:41-49 SKILL.md:49-53 SKILL.md:53-67 SKILL.md:67-71 SKILL.md:71-83 SKILL.md:83-87 SKILL.md:87-112 SKILL.md:112-116 SKILL.md:116 SKILL.md:118-120 SKILL.md:120-129 SKILL.md:129-131 SKILL.md:131 SKILL.md:139-162 SKILL.md:162-166 SKILL.md:166-177 SKILL.md:177-185 SKILL.md:185-199 SKILL.md:199-203 SKILL.md:203-227 SKILL.md:227-231 SKILL.md:231-241 SKILL.md:241-249 SKILL.md:249-265 SKILL.md:265-267 SKILL.md:267 SKILL.md:269 SKILL.md:277-290 SKILL.md:290-294 SKILL.md:294-306 SKILL.md:306-310 SKILL.md:310-328 SKILL.md:328-336 SKILL.md:336-356 SKILL.md:356-360 SKILL.md:360-384 SKILL.md:384-388 SKILL.md:388-399 SKILL.md:399-407 SKILL.md:407-418 SKILL.md:418-422 SKILL.md:422-430 SKILL.md:430-438 SKILL.md:438-439 SKILL.md:439 SKILL.md:440-441 SKILL.md:441 SKILL.md:443-469

🌐 Netzwerkzugriff (18)

references/SECURITY.md:8 references/SECURITY.md:9 references/SECURITY.md:12 references/SECURITY.md:13 references/SECURITY.md:29 references/SECURITY.md:32 references/SECURITY.md:41 references/SECURITY.md:44 references/SECURITY.md:90 SKILL.md:153 SKILL.md:149 SKILL.md:131 SKILL.md:429 SKILL.md:470 SKILL.md:471 SKILL.md:474 SKILL.md:478 SKILL.md:479

📁 Dateisystemzugriff (1)

SKILL.md:480

🔑 Umgebungsvariablen (2)

SKILL.md:263 SKILL.md:263

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/addyosmani-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-best-practices/security.svg)](https://skillstore.io/skills/addyosmani-best-practices?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/addyosmani-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/addyosmani-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

addyosmani. (2026). best-practices security audit report (audit version 1) [Author version 2.0]. Skillstore. https://skillstore.io/skills/addyosmani-best-practices/audits/1

BibTeX-Zitat

@techreport{addyosmani-addyosmani-best-practices-2026,
  author = {addyosmani},
  title = {best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/addyosmani-best-practices/audits/1},
  note = {Author version 2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "best-practices security audit report (audit version 1)"
version: "2.0"
type: report
authors:
  - name: "addyosmani"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/addyosmani-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:addyosmani-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Modernize a Frontend Application

Review deprecated APIs, feature detection, resource loading, and listener cleanup before updating an existing interface.

Review Deployment Security

Compare deployed headers, third-party script integrity, dependency findings, and source-map access against the security checklist.

Verify Release Quality

Collect Lighthouse evidence, investigate console failures, check HTML validity, and compare results after fixes.

Diese Prompts ausprobieren

Review a Page

Review [page or file] for web development best practices. Identify the three most important issues and explain each proposed correction.

Modernize Browser Code

Review [component] for deprecated APIs, browser detection, blocking requests, and listener leaks. Propose focused changes for [supported browsers] and relevant tests.

Check Deployed Security

Audit [authorized application URL] for HTTPS, response headers, CSP, third-party integrity, and source-map exposure. Cite runtime evidence and separate verified issues from assumptions.

Fix and Verify Findings

Audit [authorized application] using available Lighthouse tools and focused source checks. Prioritize evidenced findings, apply scoped fixes, and rerun checks to verify changes.

Bewährte Praktiken

Combine runtime evidence with source, dependency, and deployment configuration checks before reporting a finding.
Apply focused fixes, test behavior, and repeat the same audit to verify improvements.
Verify browser security mechanisms and sanitization behavior before copying examples into production.

Vermeiden

Treating a high Lighthouse score as proof that an application is secure.
Copying placeholder security policies or illustrative snippets into production without validating their behavior.
Running external scans or submitting private application data without authorization.

Häufig gestellte Fragen

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code. Available audit integrations depend on the host environment.

Does the skill include Lighthouse?

No. It guides compatible live Lighthouse tools when available and recommends the Lighthouse CLI as a fallback.

Can it review code without a running page?

Yes. It can guide source and configuration review, but deployed headers and runtime behavior require separate verification.

Does a passing audit guarantee security?

No. Lighthouse and checklist reviews do not replace comprehensive security testing or application-specific threat analysis.

Are all examples ready for production?

No. Correct the Permissions-Policy meta examples and structuredClone sanitization claim. Verify all policies, placeholders, and dependencies before reuse.

What areas does the skill cover?

It covers web security settings, browser compatibility, deprecated APIs, error handling, source maps, HTML quality, event cleanup, and permission requests.