Is the Best Practices skill free?

Yes. The skill itself is free from addyosmani/web-quality-skills. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Best Practices SkillProof Score?

9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.

How do I install Best Practices?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Best Practices with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Best Practices

Modern web security, compatibility and code-quality patterns from Lighthouse best-practices audits.

by addyosmani · addyosmani/web-quality-skills

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.6/10
Tested: Jul 20, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 818d55e

Fetched the repo tree (6 sibling skills), read skills/best-practices/SKILL.md fully plus the README. Frontmatter parses with name+description; the one relative link (../web-quality-audit/SKILL.md) resolves in the tree; manual install is a plain cp with no hardcoded paths; no scripts, no external CLI needed to use it. Content is current and accurate (2024 polyfill.io attack, Trusted Types Baseline, prototype-pollution guidance, hidden-source-map + sourcesContent stripping). Only caveat: the "security audit" trigger phrase is broad enough to collide with non-web/backend contexts.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 5/5

What Best Practices does

A pure-instruction skill that audits and modernizes front-end web code against Lighthouse "best practices": HTTPS/mixed content, CSP, Trusted Types, SRI, prototype-pollution, deprecated APIs, source-map hygiene, semantic/valid HTML. Triggers on "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".

How to install Best Practices

cp -r skills/* ~/.claude/skills/  (or: npx add-skill addyosmani/web-quality-skills / plugin install)

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Best Practices

/best-practices Modern web security, compatibility and code-quality patterns from Lighthouse best-practices audits.

It also activates on plain-language prompts like these:

Apply best practices to this codebase
Run a security audit on this project
Check for vulnerabilities and modernize this code

Frequently asked questions

Is the Best Practices skill free?: Yes. The skill itself is free from addyosmani/web-quality-skills. SkillProof publishes the install command and an independent test verdict at no cost.
Does Best Practices work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 20, 2026. Verdict: Tested · Works. Fetched the repo tree (6 sibling skills), read skills/best-practices/SKILL.md fully plus the README. Frontmatter parses with name+description; the one relative link (../web-quality-audit/SKILL.md) resolves in the tree; manual install is a plain cp with no hardcoded paths; no scripts, no external CLI needed to use it. Content is current and accurate (2024 polyfill.io attack, Trusted Types Baseline, prototype-pollution guidance, hidden-source-map + sourcesContent stripping). Only caveat: the "security audit" trigger phrase is broad enough to collide with non-web/backend contexts.
What is the Best Practices SkillProof Score?: 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
How do I install Best Practices?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Best Practices with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.