📦

best-practices

Name: best-practices
Author: addyosmani

v2.0 Ревизия содержимого r1 Средний риск ⚡ Содержит скрипты⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе🔑 Переменные окружения

Improve Web Security and Code Quality

Web applications can accumulate insecure settings, deprecated APIs, and browser compatibility problems. This skill guides evidence-based reviews and targeted fixes using Lighthouse, source inspection, and security checks.

Поддерживает: Claude Codex Code(CC)

📊 66 Адекватно

Maintain this Skill? Claim it 📊 66 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "best-practices" from https://skillstore.io/skills/addyosmani-best-practices.md and its manifest at https://skillstore.io/api/skills/addyosmani-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/addyosmani-best-practices.md Подписанный manifest GET /api/skills/addyosmani-best-practices/manifest Подписанный lockfile GET /api/skills/addyosmani-best-practices/lockfile

Протестировать

Использование «best-practices». Review a page with synchronous requests and event listeners that remain active after navigation.

Ожидаемый результат:

Finding: Synchronous requests block the main thread. Replace them with asynchronous requests and explicit failure handling.
Finding: Listeners remain active after navigation. Remove them during cleanup or attach an AbortController.
Verification: Repeat navigation and confirm listener cleanup and responsive interactions.

Использование «best-practices». Review a deployment that publishes source maps and lacks security response headers.

Ожидаемый результат:

Finding: Public source maps may expose original source. Restrict access and remove embedded source content from uploaded maps.
Recommendation: Configure appropriate security response headers and test CSP in report-only mode before enforcement.
Verification: Inspect deployed responses and repeat the same audit. Do not treat a high Lighthouse score as security assurance.

Аудит безопасности

Средний риск

v1 • 22.10.2026 Открыть версионный отчет

All 95 static findings are false positives involving documentation examples, explicitly discouraged patterns, or legitimate audit references. No evidence found of prompt injection, credential theft, or malicious execution. Two semantic findings identify security guidance errors concerning Permissions-Policy delivery and structuredClone behavior.

Просканировано файлов

677

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Средний

SKILL.md:420-430

Permissions Policy Examples Do Not Enforce Restrictions

The skill recommends meta http-equiv="Permissions-Policy" to restrict geolocation, camera, and microphone. Browsers require the HTTP response header, so copied examples leave these policy restrictions unenforced.

Both examples use an unsupported meta delivery mechanism. This creates false assurance about feature restrictions, although browser permission prompts still apply.

Средний

references/SECURITY.md:157-158

Cloning Is Incorrectly Presented as Dangerous-Key Sanitization

The reference states that structuredClone drops __proto__ and functions, then labels its result deepSafe. Cloning preserves __proto__ data keys, so later unsafe merges can still expose prototype-pollution risks.

A local runtime check confirmed that structuredClone preserves an own __proto__ key and throws DataCloneError for functions. Cloning alone does not sanitize merge inputs.

Факторы риска

⚡ Содержит скрипты (7)

references/SECURITY.md:169 references/SECURITY.md:72 references/SECURITY.md:75 references/SECURITY.md:168 references/SECURITY.md:176 SKILL.md:140 SKILL.md:141

⚙️ Внешние команды (50)

references/SECURITY.md:100-116 SKILL.md:18 SKILL.md:41-49 SKILL.md:49-53 SKILL.md:53-67 SKILL.md:67-71 SKILL.md:71-83 SKILL.md:83-87 SKILL.md:87-112 SKILL.md:112-116 SKILL.md:116 SKILL.md:118-120 SKILL.md:120-129 SKILL.md:129-131 SKILL.md:131 SKILL.md:139-162 SKILL.md:162-166 SKILL.md:166-177 SKILL.md:177-185 SKILL.md:185-199 SKILL.md:199-203 SKILL.md:203-227 SKILL.md:227-231 SKILL.md:231-241 SKILL.md:241-249 SKILL.md:249-265 SKILL.md:265-267 SKILL.md:267 SKILL.md:269 SKILL.md:277-290 SKILL.md:290-294 SKILL.md:294-306 SKILL.md:306-310 SKILL.md:310-328 SKILL.md:328-336 SKILL.md:336-356 SKILL.md:356-360 SKILL.md:360-384 SKILL.md:384-388 SKILL.md:388-399 SKILL.md:399-407 SKILL.md:407-418 SKILL.md:418-422 SKILL.md:422-430 SKILL.md:430-438 SKILL.md:438-439 SKILL.md:439 SKILL.md:440-441 SKILL.md:441 SKILL.md:443-469

🌐 Доступ к сети (18)

references/SECURITY.md:8 references/SECURITY.md:9 references/SECURITY.md:12 references/SECURITY.md:13 references/SECURITY.md:29 references/SECURITY.md:32 references/SECURITY.md:41 references/SECURITY.md:44 references/SECURITY.md:90 SKILL.md:153 SKILL.md:149 SKILL.md:131 SKILL.md:429 SKILL.md:470 SKILL.md:471 SKILL.md:474 SKILL.md:478 SKILL.md:479

📁 Доступ к файловой системе (1)

SKILL.md:480

🔑 Переменные окружения (2)

SKILL.md:263 SKILL.md:263

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/addyosmani-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-best-practices/security.svg)](https://skillstore.io/skills/addyosmani-best-practices?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/addyosmani-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/addyosmani-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

addyosmani. (2026). best-practices security audit report (audit version 1) [Author version 2.0]. Skillstore. https://skillstore.io/skills/addyosmani-best-practices/audits/1

Цитата BibTeX

@techreport{addyosmani-addyosmani-best-practices-2026,
  author = {addyosmani},
  title = {best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/addyosmani-best-practices/audits/1},
  note = {Author version 2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "best-practices security audit report (audit version 1)"
version: "2.0"
type: report
authors:
  - name: "addyosmani"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/addyosmani-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:addyosmani-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Modernize a Frontend Application

Review deprecated APIs, feature detection, resource loading, and listener cleanup before updating an existing interface.

Review Deployment Security

Compare deployed headers, third-party script integrity, dependency findings, and source-map access against the security checklist.

Verify Release Quality

Collect Lighthouse evidence, investigate console failures, check HTML validity, and compare results after fixes.

Попробуйте эти промпты

Review a Page

Review [page or file] for web development best practices. Identify the three most important issues and explain each proposed correction.

Modernize Browser Code

Review [component] for deprecated APIs, browser detection, blocking requests, and listener leaks. Propose focused changes for [supported browsers] and relevant tests.

Check Deployed Security

Audit [authorized application URL] for HTTPS, response headers, CSP, third-party integrity, and source-map exposure. Cite runtime evidence and separate verified issues from assumptions.

Fix and Verify Findings

Audit [authorized application] using available Lighthouse tools and focused source checks. Prioritize evidenced findings, apply scoped fixes, and rerun checks to verify changes.

Лучшие практики

Combine runtime evidence with source, dependency, and deployment configuration checks before reporting a finding.
Apply focused fixes, test behavior, and repeat the same audit to verify improvements.
Verify browser security mechanisms and sanitization behavior before copying examples into production.

Избегать

Treating a high Lighthouse score as proof that an application is secure.
Copying placeholder security policies or illustrative snippets into production without validating their behavior.
Running external scans or submitting private application data without authorization.

Часто задаваемые вопросы

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code. Available audit integrations depend on the host environment.

Does the skill include Lighthouse?

No. It guides compatible live Lighthouse tools when available and recommends the Lighthouse CLI as a fallback.

Can it review code without a running page?

Yes. It can guide source and configuration review, but deployed headers and runtime behavior require separate verification.

Does a passing audit guarantee security?

No. Lighthouse and checklist reviews do not replace comprehensive security testing or application-specific threat analysis.

Are all examples ready for production?

No. Correct the Permissions-Policy meta examples and structuredClone sanitization claim. Verify all policies, placeholders, and dependencies before reuse.

What areas does the skill cover?

It covers web security settings, browser compatibility, deprecated APIs, error handling, source maps, HTML quality, event cleanup, and permission requests.