📦

best-practices

Name: best-practices
Author: addyosmani

v2.0 Révision du contenu r1 Risque moyen ⚡ Contient des scripts⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement

Improve Web Security and Code Quality

Web applications can accumulate insecure settings, deprecated APIs, and browser compatibility problems. This skill guides evidence-based reviews and targeted fixes using Lighthouse, source inspection, and security checks.

Prend en charge: Claude Codex Code(CC)

📊 66 Adéquat

Maintain this Skill? Claim it 📊 66 Adéquat

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "best-practices" from https://skillstore.io/skills/addyosmani-best-practices.md and its manifest at https://skillstore.io/api/skills/addyosmani-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/addyosmani-best-practices.md manifest signé GET /api/skills/addyosmani-best-practices/manifest lockfile signé GET /api/skills/addyosmani-best-practices/lockfile

Tester

Utilisation de « best-practices ». Review a page with synchronous requests and event listeners that remain active after navigation.

Résultat attendu:

Finding: Synchronous requests block the main thread. Replace them with asynchronous requests and explicit failure handling.
Finding: Listeners remain active after navigation. Remove them during cleanup or attach an AbortController.
Verification: Repeat navigation and confirm listener cleanup and responsive interactions.

Utilisation de « best-practices ». Review a deployment that publishes source maps and lacks security response headers.

Résultat attendu:

Finding: Public source maps may expose original source. Restrict access and remove embedded source content from uploaded maps.
Recommendation: Configure appropriate security response headers and test CSP in report-only mode before enforcement.
Verification: Inspect deployed responses and repeat the same audit. Do not treat a high Lighthouse score as security assurance.

Audit de sécurité

Risque moyen

v1 • 22/10/2026 Ouvrir le rapport versionné

All 95 static findings are false positives involving documentation examples, explicitly discouraged patterns, or legitimate audit references. No evidence found of prompt injection, credential theft, or malicious execution. Two semantic findings identify security guidance errors concerning Permissions-Policy delivery and structuredClone behavior.

Fichiers analysés

677

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Moyen

SKILL.md:420-430

Permissions Policy Examples Do Not Enforce Restrictions

The skill recommends meta http-equiv="Permissions-Policy" to restrict geolocation, camera, and microphone. Browsers require the HTTP response header, so copied examples leave these policy restrictions unenforced.

Both examples use an unsupported meta delivery mechanism. This creates false assurance about feature restrictions, although browser permission prompts still apply.

Moyen

references/SECURITY.md:157-158

Cloning Is Incorrectly Presented as Dangerous-Key Sanitization

The reference states that structuredClone drops __proto__ and functions, then labels its result deepSafe. Cloning preserves __proto__ data keys, so later unsafe merges can still expose prototype-pollution risks.

A local runtime check confirmed that structuredClone preserves an own __proto__ key and throws DataCloneError for functions. Cloning alone does not sanitize merge inputs.

Facteurs de risque

⚡ Contient des scripts (7)

references/SECURITY.md:169 references/SECURITY.md:72 references/SECURITY.md:75 references/SECURITY.md:168 references/SECURITY.md:176 SKILL.md:140 SKILL.md:141

⚙️ Commandes externes (50)

references/SECURITY.md:100-116 SKILL.md:18 SKILL.md:41-49 SKILL.md:49-53 SKILL.md:53-67 SKILL.md:67-71 SKILL.md:71-83 SKILL.md:83-87 SKILL.md:87-112 SKILL.md:112-116 SKILL.md:116 SKILL.md:118-120 SKILL.md:120-129 SKILL.md:129-131 SKILL.md:131 SKILL.md:139-162 SKILL.md:162-166 SKILL.md:166-177 SKILL.md:177-185 SKILL.md:185-199 SKILL.md:199-203 SKILL.md:203-227 SKILL.md:227-231 SKILL.md:231-241 SKILL.md:241-249 SKILL.md:249-265 SKILL.md:265-267 SKILL.md:267 SKILL.md:269 SKILL.md:277-290 SKILL.md:290-294 SKILL.md:294-306 SKILL.md:306-310 SKILL.md:310-328 SKILL.md:328-336 SKILL.md:336-356 SKILL.md:356-360 SKILL.md:360-384 SKILL.md:384-388 SKILL.md:388-399 SKILL.md:399-407 SKILL.md:407-418 SKILL.md:418-422 SKILL.md:422-430 SKILL.md:430-438 SKILL.md:438-439 SKILL.md:439 SKILL.md:440-441 SKILL.md:441 SKILL.md:443-469

🌐 Accès réseau (18)

references/SECURITY.md:8 references/SECURITY.md:9 references/SECURITY.md:12 references/SECURITY.md:13 references/SECURITY.md:29 references/SECURITY.md:32 references/SECURITY.md:41 references/SECURITY.md:44 references/SECURITY.md:90 SKILL.md:153 SKILL.md:149 SKILL.md:131 SKILL.md:429 SKILL.md:470 SKILL.md:471 SKILL.md:474 SKILL.md:478 SKILL.md:479

📁 Accès au système de fichiers (1)

SKILL.md:480

🔑 Variables d’environnement (2)

SKILL.md:263 SKILL.md:263

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/addyosmani-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-best-practices/security.svg)](https://skillstore.io/skills/addyosmani-best-practices?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/addyosmani-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/addyosmani-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

addyosmani. (2026). best-practices security audit report (audit version 1) [Author version 2.0]. Skillstore. https://skillstore.io/skills/addyosmani-best-practices/audits/1

Citation BibTeX

@techreport{addyosmani-addyosmani-best-practices-2026,
  author = {addyosmani},
  title = {best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/addyosmani-best-practices/audits/1},
  note = {Author version 2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "best-practices security audit report (audit version 1)"
version: "2.0"
type: report
authors:
  - name: "addyosmani"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/addyosmani-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:addyosmani-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Modernize a Frontend Application

Review deprecated APIs, feature detection, resource loading, and listener cleanup before updating an existing interface.

Review Deployment Security

Compare deployed headers, third-party script integrity, dependency findings, and source-map access against the security checklist.

Verify Release Quality

Collect Lighthouse evidence, investigate console failures, check HTML validity, and compare results after fixes.

Essayez ces prompts

Review a Page

Review [page or file] for web development best practices. Identify the three most important issues and explain each proposed correction.

Modernize Browser Code

Review [component] for deprecated APIs, browser detection, blocking requests, and listener leaks. Propose focused changes for [supported browsers] and relevant tests.

Check Deployed Security

Audit [authorized application URL] for HTTPS, response headers, CSP, third-party integrity, and source-map exposure. Cite runtime evidence and separate verified issues from assumptions.

Fix and Verify Findings

Audit [authorized application] using available Lighthouse tools and focused source checks. Prioritize evidenced findings, apply scoped fixes, and rerun checks to verify changes.

Bonnes pratiques

Combine runtime evidence with source, dependency, and deployment configuration checks before reporting a finding.
Apply focused fixes, test behavior, and repeat the same audit to verify improvements.
Verify browser security mechanisms and sanitization behavior before copying examples into production.

Éviter

Treating a high Lighthouse score as proof that an application is secure.
Copying placeholder security policies or illustrative snippets into production without validating their behavior.
Running external scans or submitting private application data without authorization.

Foire aux questions

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code. Available audit integrations depend on the host environment.

Does the skill include Lighthouse?

No. It guides compatible live Lighthouse tools when available and recommends the Lighthouse CLI as a fallback.

Can it review code without a running page?

Yes. It can guide source and configuration review, but deployed headers and runtime behavior require separate verification.

Does a passing audit guarantee security?

No. Lighthouse and checklist reviews do not replace comprehensive security testing or application-specific threat analysis.

Are all examples ready for production?

No. Correct the Permissions-Policy meta examples and structuredClone sanitization claim. Verify all policies, placeholders, and dependencies before reuse.

What areas does the skill cover?

It covers web security settings, browser compatibility, deprecated APIs, error handling, source maps, HTML quality, event cleanup, and permission requests.