xoai/web
skills/web/SKILL.md
Universal web development principles — accessibility (WCAG 2.2), performance (Core Web Vitals), security headers (OWASP), SEO, responsive design, error UX, and loading states. Framework-agnostic.
$ install --global
skillsauthnpx skillsauth add xoai/sage webInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 25, 2026, 2:12 PM209.4s6 files scanned
SKILL.md
- name:
- web
- description:
- Universal web development principles — accessibility (WCAG 2.2), performance (Core Web Vitals), security headers (OWASP), SEO, responsive design, error UX, and loading states. Framework-agnostic.
- version:
- 2.0.0
- type:
- knowledge
- layer:
- domain
- sage:
- >=1.0.0
- detected:
- [react, vue, svelte, angular, next, nuxt, astro, remix, gatsby, vite, webpack, html]
- tags:
- [react,vue,svelte,angular,next]
web
Layer 1 — Domain Foundation (v2.0)
Universal web development principles that apply to every web project regardless of framework. React, Vue, Svelte, vanilla JS — these principles hold.
Philosophy
This pack encodes the foundational web platform knowledge that agents frequently get right in isolation but miss in practice. An agent knows what ARIA labels are. It still produces a form with no error announcements for screen readers. An agent knows about Core Web Vitals. It still renders a 2MB hero image without dimensions.
The gap isn't knowledge — it's consistent application.
What's Included
| Type | Count | Coverage | |------|-------|----------| | Patterns | 7 | Accessibility (WCAG 2.2), performance (Core Web Vitals), security headers (OWASP), SEO, responsive design, error UX, loading states | | Anti-patterns | 6 | Div soup, missing alt text, layout shift, unprotected forms, client-only critical paths, no security headers | | Constitution | 7 | principles |
Grounded in: W3C WCAG 2.2 (October 2023), Google Core Web Vitals (2025), OWASP Secure Headers Project, OWASP CSP Cheat Sheet, MDN Web Docs, Web Almanac 2025, European Accessibility Act (June 2025).
What This Pack Does NOT Cover
- Framework-specific patterns (see
react,nextjs, etc.) - CSS methodology opinions (BEM vs utility-first vs CSS-in-JS)
- Build tool configuration (Webpack, Vite, Turbopack)
- Backend/API patterns (see
apiorbaas)
Related Skills
xoai/fix
testing
VerifiedTrustedCommunity
Root cause diagnosis with evidence, Reproducing test, Minimal patch
23SKILL.mdUpdated Jul 12, 2026
xoai/continue
tools
VerifiedTrustedCommunity
Session resumption with context
23SKILL.mdUpdated Jul 12, 2026
xoai/configure
tools
VerifiedTrustedCommunity
Configure Sage preset and project settings. Switch between base, startup, enterprise, or opensource constitution presets. Use when the user says "configure sage", "change preset", or "sage settings".
23SKILL.mdUpdated Jul 12, 2026
xoai/build
development
VerifiedTrustedCommunity
Brief (medium+ tasks), Spec, Implementation plan
23SKILL.mdUpdated Jul 12, 2026