Audit Agent Output with the Best-Practices Skill

Where this fits

You've just had your agent refactor a legacy Express app. Before you merge, you want to know if the changes introduced security regressions or dropped support for older browsers. Instead of manually reviewing every diff, you ask your agent to "apply best practices" — and it runs a Lighthouse audit, checks headers, and flags vulnerabilities in one pass.

Why agents benefit

• Runs a real Lighthouse Best Practices audit (navigation or snapshot mode) when a live page is available, giving evidence-based findings instead of guesses.
• Correlates console and network failures with specific code changes, so you get actionable fixes, not a generic report.
• Supplements runtime checks with dependency, header, and configuration inspection, catching issues Lighthouse can't see.
• Separates security findings from style preferences, so you can prioritize what actually matters before a release.
• Re-runs the same audit after fixes, giving you a clear before/after signal for your pull request.

Practical scenarios

Post-refactor security regression check

Your agent refactored authentication middleware. You ask it to "check for vulnerabilities" — it runs a Lighthouse audit, inspects CSP headers, and flags a missing X-Content-Type-Options header introduced during the refactor.

Modernizing a legacy codebase

You're upgrading a jQuery-era app. The skill audits the current state, identifies deprecated APIs, and suggests modern replacements while verifying the changes don't break existing functionality.

Pre-deployment code quality gate

Before shipping a feature, your agent reviews the codebase for quality issues — unused dependencies, insecure patterns, and browser compatibility gaps — and produces a prioritized list of fixes.

Add it to your agent workflow

Install the skill with:

npx skills add addyosmani/web-quality-skills --skill best-practices

Then, in your agent prompt:

Apply best practices to the current codebase. Run a Lighthouse audit in navigation mode, check for vulnerable dependencies, and report security findings separately from style suggestions.

The agent will follow the evidence-led workflow: audit, inspect, fix, re-audit.

Compare before adopting

Before you commit to this skill, compare it against alternatives:

• Quality signals: Does it produce evidence (Lighthouse scores, console errors, dependency versions) rather than opinions? This skill does.
• Maintenance freshness: Check the GitHub repo (2739 stars) for recent commits and issue resolution. A stale skill drifts from current best practices.
• Alternatives: Consider other security-focused skills or a manual Lighthouse CI setup. The skill's value is in the agent-native workflow, not just the audit itself.
• Workflow fit: Does it integrate with your existing agent tools (like Chrome DevTools MCP)? The skill is designed to use Lighthouse when available and fall back to static inspection otherwise.

Why it is worth tracking

This skill has strong community momentum (2739 stars) and is authored by Addy Osmani, a well-known figure in web performance. The evidence-led workflow is a good template for how agents should handle audits — runtime evidence first, static analysis second, fixes verified. Track it if you're building agents that touch front-end code, and evaluate it when your agent starts producing or modifying web-facing code. For more details, see the skill page on OpenAgentSkill.