acaprino/pwa-development
plugins/pwa-expert/skills/pwa-development/SKILL.md
Progressive Web App knowledge base for 2025-2026: Web App Manifest, Service Workers (Workbox 7, Serwist), Web Push (VAPID, RFC 8030/8291/8292, Declarative Push for Safari 18.4+), install flows (beforeinstallprompt, Window Controls Overlay), OPFS storage, Project Fugu, Core Web Vitals (INP < 200ms), security (HTTPS, CSP, COOP/COEP), and distribution (Bubblewrap, PWA Builder MSIX, Capacitor). TRIGGER WHEN: building, auditing, or debugging PWAs, including manifest, service worker, Web Push, install flow, OPFS, Background Sync, Wake Lock, vite-plugin-pwa, Next.js Serwist, @angular/pwa, @vite-pwa/nuxt, Bubblewrap, TWA, PWA Builder, or Capacitor wrapping. DO NOT TRIGGER WHEN: the task is generic frontend styling (use frontend), React performance (use react-development:review-react), cross-platform security unrelated to PWA (use platform-engineering), Tauri or Electron wrappers (use tauri-development), or GA4 / analytics (use digital-marketing).
$ install --global
skillsauthnpx skillsauth add acaprino/alfio-claude-plugins pwa-developmentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 26, 2026, 4:23 AM25.6s15 files scanned
SKILL.md
- name:
- pwa-development
- description:
- >
- Progressive Web App knowledge base for 2025-2026:
- Web App Manifest, Service Workers
- TRIGGER WHEN:
- building, auditing, or debugging PWAs, including manifest, service
- DO NOT TRIGGER WHEN:
- the task is generic frontend styling (use frontend), React
- performance (use react-development:
- review-react), cross-platform security unrelated
Progressive Web App Development
Knowledge base for building, auditing, and shipping Progressive Web Apps in 2025-2026. Covers manifest, service workers, Web Push, install flows, storage, Project Fugu capabilities, platform constraints, performance (Core Web Vitals), security, and distribution to Google Play, Microsoft Store, App Store (via Capacitor), and Meta Quest.
When to use this skill
Use this skill whenever the active task involves any of:
- A
manifest.webmanifestormanifest.json, manifest members, icons, splash screens, iOS meta tags. - A service worker file, registration, caching strategy, update flow, Workbox 7, Serwist.
- Web Push: VAPID keys, subscription, server-side delivery, Declarative Web Push.
- PWA install flow on Chromium (
beforeinstallprompt), iOS (manual), or Window Controls Overlay on desktop. - Background execution: Background Sync, Periodic Background Sync, Background Fetch, Screen Wake Lock.
- Storage: IndexedDB, OPFS, quotas,
navigator.storage.persist(). - Project Fugu APIs: File System Access, Web Share, Web Bluetooth / USB / HID / Serial / NFC, WebAuthn, etc.
- Performance for PWAs: Core Web Vitals 2025, INP < 200ms, app shell, code splitting.
- Security headers for PWAs: HTTPS, CSP tuned for SW, COOP / COEP for
SharedArrayBuffer. - Distribution: Bubblewrap to Google Play (TWA +
assetlinks.json), PWA Builder to Microsoft Store (MSIX), Capacitor to App Store, PWA Builder to Meta Quest. - Framework integration: Vite (
vite-plugin-pwa), Next.js (@serwist/next), Angular (ng add @angular/pwa), Nuxt (@vite-pwa/nuxt).
Skip this skill if the task is generic frontend styling, generic React performance, cross-platform security unrelated to PWA mechanics, Tauri or Electron wrappers, or GA4 / analytics.
References Library
Read the relevant reference on-demand for the active task. Do NOT preload all references at once; pick the one that matches the question.
| Reference | Topic |
|---|---|
| references/manifest.md | Web App Manifest: members, icons, splash, iOS meta tags |
| references/service-workers.md | SW lifecycle, caching strategies, Workbox 7, updates, debugging |
| references/background-execution.md | Background Sync, Periodic Sync, Background Fetch, Wake Lock |
| references/push-notifications.md | Web Push end-to-end: VAPID, RFCs, Declarative Push, Badge API |
| references/install-flows.md | beforeinstallprompt, iOS manual install, Window Controls Overlay |
| references/permissions.md | Permissions API, Permissions-Policy header, platform availability |
| references/storage-persistence.md | IndexedDB, OPFS, quotas, persistent storage |
| references/capabilities-fugu.md | Project Fugu API matrix and worked examples |
| references/platform-constraints.md | iOS / Android / Desktop per-platform reality check |
| references/performance.md | Core Web Vitals 2025, INP < 200ms, audit tooling |
| references/security.md | HTTPS, CSP for SW, COOP / COEP, secure contexts |
| references/distribution.md | Bubblewrap / TWA, PWA Builder MSIX, Capacitor, Meta Quest |
| references/frameworks-tooling.md | Vite, Next.js, Angular, Nuxt + debugging surface |
| references/production-checklist.md | Full deploy checklist for going to production |
Decision quick-reference
| Question | Answer |
|---|---|
| Which SW caching strategy for hashed JS / CSS? | CacheFirst |
| Which for HTML navigation? | NetworkFirst with networkTimeoutSeconds: 3 |
| Which for avatars / low-criticality data? | StaleWhileRevalidate |
| Which for POST mutations? | NetworkOnly + BackgroundSyncPlugin |
| Should skipWaiting() be called by default? | No. Pair with a coordinated reload UX, or omit. |
| Minimum icon sizes for Chromium install? | 192 PNG + 512 PNG, both purpose: "any". Add separate maskable assets. |
| Combine "any maskable" on one icon? | No. web.dev explicitly discourages it. |
| iOS Web Push: requirements? | iOS 16.4+, PWA installed to Home Screen, display: standalone, user-gesture-triggered subscribe. |
| Periodic Background Sync on iOS? | Not supported. Plan a degraded path. |
| Lighthouse PWA category? | Removed in Lighthouse 12.0.0 (Chrome 126, May 2024). Use individual Application-panel checks. |
| Next.js PWA library in 2026? | @serwist/next (not the unmaintained original next-pwa). |
Related Skills
acaprino/review-quality-gates
development
VerifiedTrustedCommunity
Quality gates for multi-reviewer code review pipelines: adversarial verification panel, completeness critic, reviewer pipeline conventions, and the context sharing pattern for parallel reviewers. TRIGGER WHEN: running /senior-review:team-review quality gates; running /senior-review:code-review Steps 4b/4c (adversarial verification and completeness check); consolidating or deduplicating findings from multiple parallel reviewers. DO NOT TRIGGER WHEN: single-reviewer style review without a consolidation phase, or generic team coordination (the upstream agent-teams skills cover that).
6SKILL.mdUpdated Jul 28, 2026
acaprino/abstraction-architect
development
VerifiedTrustedCommunity
Knowledge base for pure-architecture decisions on when to unify duplicated logic into a shared abstraction versus leave it duplicated. Covers the canonical theory (Rule of Three, DRY/WET/AHA, Wrong Abstraction, Locality of Behaviour, Bounded Contexts, Tidy First options framing, CUPID vs SOLID), 12 essential-duplication patterns that justify unification, 12 wrong-abstraction patterns that justify inlining or decomposition, an operational decision frame, and a verified reading list. TRIGGER WHEN: the user is making an architectural decision about whether to centralize, extract, or remove a layer; reviewing an abstraction for premature generality; auditing scattered cross-cutting concerns; spawned by the abstraction-architect agent during /abstraction-architect:audit or as the Abstraction dimension of /senior-review:team-review or /senior-review:code-review; the user asks "should I extract this into a service" / "is this DRY enough" / "is this wrong abstraction". DO NOT TRIGGER WHEN: the task is code formatting and readability cleanup (use clean-code:clean-code), Python-specific refactoring with metrics (use python-development:python-refactor), generic dead-code removal (use senior-review:cleanup-dead-code), security review (use senior-review:security-auditor), or pure pattern-consistency review without an architecture lens (use senior-review:code-auditor).
6SKILL.mdUpdated May 26, 2026
acaprino/frontend-css
development
VerifiedTrustedCommunity
Unified web frontend knowledge base covering CSS architecture, UX psychology, UI components, distinctive aesthetics, and interface design generation. TRIGGER WHEN: working on web styling, design systems, component decisions, responsive strategy, distinctive frontend aesthetics, or exploring multiple interface designs. DO NOT TRIGGER WHEN: the task is purely backend or unrelated to web frontend.
6SKILL.mdUpdated May 13, 2026
acaprino/stripe
development
VerifiedTrustedCommunity
Stripe payments knowledge base - API patterns, checkout optimization, subscription lifecycle, pricing strategies, webhook reliability, Firebase integration, cost analysis, and revenue modeling. Loaded by stripe-integrator and revenue-optimizer agents; also consumable directly when the user asks for Stripe-specific patterns without needing an agent. TRIGGER WHEN: working with Stripe API (Payment Intents, Customers, Subscriptions, Checkout Sessions, Connect, webhooks, tax, usage-based billing), pricing strategy, or revenue modeling. DO NOT TRIGGER WHEN: payment work is non-Stripe (PayPal, Square, crypto) or the task is generic e-commerce unrelated to payments.
6SKILL.mdUpdated Apr 20, 2026