Web quality audit
Reviewable capability layer for coding agents. Portable skills, delivery gates, workflow patterns, and verification-first engineering.
npx -y skills add markoblogo/abvx-agent-skills --skill web-quality-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Audit and improve web quality across accessibility, performance, UX, privacy, and browser security. Use for frontend audits, client audits, redesigns, landing pages, production-readiness passes, Core Web Vitals, keyboard navigation, privacy reviews, CSP/cookie/header checks, and responsive UI verification.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.0 KB, as published. Nobody here has run it
Web Quality Audit
Run a compact cross-functional quality pass. Treat accessibility, performance, UX, privacy, and security as connected product risks.
Use authorized-security-router first when the request moves from passive web quality review into security testing, target enumeration, request replay, or any live target with unclear authorization.
Audit Tracks
Accessibility
- Semantic headings, landmarks, labels, alt text, and form errors.
- Keyboard navigation, focus order, visible focus, and modal/menu focus management.
- ARIA only when native HTML does not cover the interaction.
- Color contrast, reduced motion, and responsive text fit.
Performance
- LCP candidate image priority, dimensions, compression, and lazy loading.
- Render-blocking CSS/JS, unnecessary third-party scripts, and asset cache busting.
- Expensive render loops, hydration weight, excessive network waterfalls, and unbounded lists.
- Core Web Vitals or local browser measurements when available.
UX
- First-screen clarity, task orientation, control affordance, empty/loading/error states.
- Mobile layout, tap targets, horizontal overflow, text clipping, and predictable navigation.
- Copy that matches the surface: utility copy for tools, sharper copy for landing pages.
Privacy
- Data minimization, consent clarity, third-party scripts, tracking pixels, embeds, and analytics.
- Cookies, local storage, referrer policy, permissions policy, and logout cleanup.
- Avoid logging private data in client telemetry and violation reports.
Security
- Dangerous DOM sinks, unsafe inline scripts, postMessage validation, frame embedding rules.
- Cookie flags, HTTPS/HSTS, CSP rollout state, Trusted Types readiness, CORS/Fetch Metadata where relevant.
- Report-only policies before strict enforcement on existing apps.
Workflow
- Identify the app type, target users, critical paths, and deployment constraints.
- Run static checks first: HTML structure, image dimensions, obvious headers, bundle/assets, dependency scripts.
- Run browser checks: desktop/mobile, console errors, network failures, keyboard path, overflow, and key interactions.
- Rank findings by user impact, likelihood, and implementation risk.
- Fix low-risk issues immediately when the user asked to improve the site.
- Gate risky policy changes, tracking changes, auth/payment changes, or destructive migrations behind explicit confirmation.
Report Format
For each finding:
- severity;
- evidence;
- affected file/page;
- recommended fix;
- verification.
Final response should separate implemented fixes from deferred risks.