13K skills · sorted by popularity
Review Referrer-Policy settings to limit sensitive URL details shared when visitors follow external links. Check response headers and pages containing private parameters, suggest suitable policy values, and explain how to verify the resulting browser behavior.
Audit account settings, privacy pages, and API routes for a complete data deletion flow. Check browser storage cleanup, server deletion requests, and user confirmation, then identify missing pieces and guide implementation.
Review HTTP response headers and restrict browser features an application does not need, such as camera, microphone, and location access. Guide Permissions-Policy settings that limit what attackers could use if the site is compromised.
Review form fields for code that blocks pasting, then remove those restrictions. The skill helps check password manager use, keyboard interactions, and accessibility so people can paste passwords and other long values into inputs.
Review password fields for security and ease of use. Check autocomplete settings, accessible visibility controls, strength indicators, and password manager support, then verify relevant browser and HTTP behavior in an environment resembling production.
Review parallax effects, where backgrounds and foregrounds move at different speeds. Check reduced-motion support and access to essential content, then suggest static alternatives and an optional site-wide control for disabling motion.
Review website animations against users’ reduced motion preferences, a setting that requests less movement. Check flashing content, scrolling effects, alternative transitions, pause controls, and advance warnings, and identify changes needed in rendered pages and interactive states.
Set and review limits for bundled file size and page performance so CI, automated checks on code changes, can catch regressions. Check enforcement on pull requests and review production monitoring for slowdowns after release.
Compare button and link text with accessible names, the names assistive technology uses for controls. Identify mismatches and suggest ARIA label changes so people using voice control can refer to the words they see.
Check the HTML delivered to browsers for broken internal, external, anchor, and email links. Locate errors and unintended redirects, suggest URL updates or replacements, and help introduce automated checks and ongoing monitoring.
Review links embedded in body text to check whether readers can recognize them without relying on color alone. Identify CSS issues with underlines, color contrast, and hover or keyboard focus states, then suggest specific fixes.
Check HTML for meta refresh redirects that can interrupt reading and confuse users. Suggest server-side redirects or clear links users choose themselves, with guidance for checking the resulting behavior using accessibility tools or assistive technology.
Evaluate whether tests catch defects in business logic, calculations, or state machines. Using Stryker, the skill introduces small code changes, reviews which changes escape detection, and helps strengthen tests where important behavior is insufficiently checked.
Review page source, browser JavaScript, and Git history for exposed API keys, passwords, and tokens. Identify potential leaks and guide fixes, including moving secrets to the server, replacing compromised credentials, and adding checks before commits.
Review a page to ensure it has exactly one main landmark, the region identifying its primary content. Find missing or duplicate main regions and get corrections that give assistive technology users a clear navigation target.
Review mobile test coverage across real devices and simulated screen sizes. Find gaps in automated checks and CI, the workflow that runs project checks, and add Playwright tests for key mobile user flows.
Review HTML lists for incorrect child elements and nesting, then identify fixes that help screen readers, tools that read page content aloud, announce item counts and positions accurately.
Find resources loaded over unencrypted HTTP within HTTPS pages, a problem called mixed content. Review resource URLs and security headers, then guide HTTPS replacements and automatic request upgrades to address blocked or insecure resources.
Review how tests use mocks, substitutes for external services or resources. Identify excessive mocking and missing cleanup, suggest more realistic tests, and check whether automated checks consistently catch problems and prevent regressions.
Review HTML and JSX links that open new tabs, identify missing rel attributes, and add protective values. The skill also explains how these values prevent changes to the original tab and control referral information.
Review HTML forms and JavaScript requests to find data sent over unencrypted HTTP. Check submission URLs, pages with implicit form destinations, and server redirects, then update endpoints to use HTTPS.
Audit whether a website serves all pages over HTTPS with valid TLS certificates, which secure connections. Check certificate coverage and expiration, permanent redirects from HTTP, and HTTPS URLs for internal links and resources, then review the necessary configuration changes.
Check that HTTP requests redirect to HTTPS with a permanent 301 response while preserving the page path and query parameters. Review server or CDN settings, verify response headers, and explain how HSTS helps returning visitors avoid HTTP requests.
Review public forms for automated abuse protection. Check CAPTCHA, a mechanism for detecting bots, along with hidden trap fields and request limits, then help integrate a CAPTCHA service and validate its tokens on the server.