HTML

Avoid common HTML mistakes — accessibility gaps, form pitfalls, and SEO oversights.

Security Scan

This is an instruction-only skill that provides static HTML best-practice guidance and requests no credentials, binaries, or installs — its declared purpose matches what it does.

Purpose & Capability

The name and description promise HTML guidance and the SKILL.md contains exactly that (accessibility, forms, SEO tips). There are no unrelated environment variables, binaries, or installs requested.

Instruction Scope

The SKILL.md is purely prescriptive content (tips and examples). It does not instruct the agent to run commands, read files, access environment variables, or contact external endpoints — scope stays within documentation.

Install Mechanism

No install spec and no code files are present. As an instruction-only skill, it writes nothing to disk and has minimal attack surface.

Credentials

The skill requires no environment variables, credentials, or config paths. Nothing in the instructions suggests hidden or additional secret access is needed.

Persistence & Privilege

always is false and the skill makes no request to persist state or modify other skills or system settings. Autonomous invocation is allowed (platform default) but harmless given the skill's read-only guidance nature.

Assessment

This skill is low-risk: it only contains static HTML advice and does not install software or ask for secrets. If you want automated checks or fixes (linting, file scanning, CI integration), look for a skill that explicitly declares those behaviors and the minimal required file or API access — and review any declared env vars or install steps before enabling. Otherwise this skill is safe and simply acts as reference content.

Layout Shift Prevention

• width and height on <img> even with CSS sizing — browser reserves space before load
• aspect-ratio in CSS as fallback — for responsive images without dimensions

Form Gotchas

• autocomplete attribute is specific — autocomplete="email", autocomplete="new-password", not just on/off
• <fieldset> + <legend> required for radio/checkbox groups — screen readers announce the group label
• inputmode for virtual keyboard — inputmode="numeric" shows number pad without validation constraints
• enterkeyhint changes mobile keyboard button — enterkeyhint="search", enterkeyhint="send"

Accessibility Gaps

• Skip link must be first focusable — <a href="#main" class="skip">Skip to content</a> before nav
• <th scope="col"> or scope="row" — without scope, screen readers can't associate headers
• aria-hidden="true" hides from screen readers — use for decorative icons, not interactive elements
• role="presentation" on layout tables — if you must use tables for layout (you shouldn't)

Link Security

• target="_blank" needs rel="noopener noreferrer" — noopener prevents window.opener access, noreferrer hides referrer
• User-generated links need rel="nofollow ugc" — ugc tells search engines it's user content

SEO Meta

• <link rel="canonical"> prevents duplicate content — self-referencing canonical on every page
• og:image needs absolute URL — relative paths fail on social platforms
• twitter:card values: summary, summary_large_image, player — not arbitrary

Common Oversights

• <button type="button"> for non-submit — default is type="submit", triggers form submission
• <dialog> element for modals — built-in focus trap and escape handling
• <details> + <summary> for accordions — no JS needed, accessible by default
• Void elements don't need closing slash — <img> not <img /> in HTML5, though both work