BB SkillsFind a workflow. Make it your own.
Create account
New here? Start with the guide ↗
Browse sections ＋
Library / Web & HTML / Evidence-led Web Quality Audit
↗
Resource profile / Evidence-led Web Quality Audit
About this skill

Workflow & requirements

Web quality audit

Comprehensive quality review that combines live browser evidence with source inspection. Covers Performance, Accessibility, SEO, Best Practices, and Agentic Browsing without treating an aggregate score as proof of quality.

Lighthouse 13+. The Performance category now uses shared Performance Insights across Lighthouse and the DevTools Performance panel (announcement). Follow current insight names and evidence. Do not require removed audit IDs or automatically recreate their recommendations; some were retired because they were noisy, inactionable, or easy to over-recommend.

How it works

  1. Establish the audit target: representative URLs, important states and journeys, public versus authenticated access, and mobile/desktop scope.
  2. If a page can run, read the measurement workflow and collect a minimal live baseline before searching the codebase broadly.
  3. Use runtime failures to localize source inspection. Keep measured findings separate from hypotheses found only in code.
  4. Categorize by user impact and confidence, then make or recommend specific fixes.
  5. Re-run equivalent automated checks and the affected manual flows. Report what is verified and what still needs field or human validation.

Tool routing

Use the best capability already available; do not block the audit on optional setup.

Need Preferred route Fallback
Performance and Core Web Vitals Record a browser performance trace and analyze focused insights; with Chrome DevTools MCP, use performance_start_trace then performance_analyze_insight Lighthouse CLI or PageSpeed Insights lab data
Real-user performance CrUX values included in current DevTools trace summaries PageSpeed Insights/CrUX Vis; direct CrUX API only when a key is already available or automation is requested
Accessibility, SEO, Best Practices, Agentic Browsing Run a live Lighthouse audit; with Chrome DevTools MCP, use lighthouse_audit Category-specific Lighthouse CLI audits plus manual checks
Rendered semantics and interaction Inspect the accessibility tree and exercise the UI; with Chrome DevTools MCP, use take_snapshot and focused evaluate_script Browser/manual testing
Source smoke test bash "$BB_SKILL_DIR/scripts/analyze.sh" "<file_or_directory>" Direct source inspection

Chrome DevTools MCP's lighthouse_audit intentionally excludes performance. Its navigation mode reloads the page; use snapshot mode when preserving the current authenticated or user-created state matters. The static analyzer is a fast smoke test, not a substitute for a rendered-page audit.

Audit categories

Performance

Core Web Vitals — Must pass for good page experience: * LCP (Largest Contentful Paint) < 2.5s. The largest visible element must render quickly. Optimize images, fonts, and server response time. * INP (Interaction to Next Paint) < 200ms. User interactions must feel instant. Reduce JavaScript execution time and break up long tasks. * CLS (Cumulative Layout Shift) < 0.1. Content must not jump around. Set explicit dimensions on images, embeds, and ads.

Resource Optimization: * Compress images. Use WebP/AVIF with fallbacks. Serve correctly sized images via srcset. * Minimize JavaScript. Remove unused code. Use code splitting. Defer non-critical scripts. * Optimize CSS. Extract critical CSS. Remove unused styles. Avoid @import. * Efficient fonts. Use font-display: swap. Preload critical fonts. Subset to needed characters.

Loading Strategy: * Preconnect to origins. Add <link rel="preconnect"> for third-party domains. * Preload critical assets. LCP images, fonts, and above-fold CSS. * Lazy load below-fold content. Images, iframes, and heavy components. * Cache effectively. Long cache TTLs for static assets. Immutable caching for hashed files.

Accessibility

Perceivable: * Text alternatives. Every <img> has meaningful alt text. Decorative images use alt="". * Color contrast. Minimum 4.5:1 for normal text, 3:1 for large text (WCAG AA). * Don't rely on color alone. Use icons, patterns, or text alongside color indicators. * Captions and transcripts. Video has captions. Audio has transcripts.

Operable: * Keyboard accessible. All functionality available via keyboard. No keyboard traps. * Focus visible. Clear focus indicators on all interactive elements. * Skip links. Provide "Skip to main content" for keyboard users. * Sufficient time. Users can extend time limits. No auto-advancing content without controls.

Understandable: * Page language. Set lang attribute on <html>. * Consistent navigation. Same navigation structure across pages. * Error identification. Form errors clearly described and associated with fields. * Labels and instructions. All form inputs have associated labels.

Robust: * Valid HTML. No duplicate IDs. Properly nested elements. * ARIA used correctly. Prefer native elements. ARIA roles match behavior. * Name, role, value. Interactive elements have accessible names and correct roles.

SEO

Crawlability: * Valid robots.txt. Doesn't block important resources. * XML sitemap. Lists all important pages. Submitted to Search Console. * Canonical URLs. Prevent duplicate content issues. * No noindex on important pages. Check meta robots and headers.

On-Page SEO: * Unique title tags. Make each title descriptive and concise; display truncation varies by device and result type. * Meta descriptions. Write useful, page-specific summaries; search engines may choose a different snippet. * Heading hierarchy. The primary heading is descriptive and the structure is logical; do not fail valid HTML solely for using more than one <h1>. * Descriptive link text. Not "click here" or "read more".

Technical SEO: * Mobile-friendly. Responsive design. Tap targets ≥ 48px. * HTTPS. Secure connection required. * Page experience signals. Use field Core Web Vitals as evidence, without promising a ranking change. * Structured data. JSON-LD for rich snippets (Article, Product, FAQ, etc.).

Best practices

Security: * HTTPS everywhere. No mixed content. HSTS enabled. * No vulnerable libraries. Keep dependencies updated. * CSP headers. Content Security Policy to prevent XSS. * No exposed source maps. In production builds.

Modern Standards: * No deprecated APIs. Replace document.write, synchronous XHR, etc. * Valid doctype. Use <!DOCTYPE html>. * Charset declared. <meta charset="UTF-8"> as first element in <head>. * No browser errors. Clean console. No CORS issues.

UX Patterns: * No intrusive interstitials. Especially on mobile. * Clear permission requests. Only ask when needed, with context. * No misleading buttons. Buttons do what they say.

Agentic browsing

Use the Lighthouse Agentic Browsing results as technical signals for how well assistants can understand and interact with the rendered page.

  • Accessible interaction surface. Semantic HTML, labels, names, roles, and states must expose meaningful controls in the accessibility tree.
  • WebMCP integrations are valid when present. Review registered tools, schemas, and form coverage; do not add WebMCP solely to raise an audit score.
  • llms.txt is optional. A valid file may help compatible tools discover curated content, but a Lighthouse pass does not prove that search or AI products will ingest, rank, or cite it.
  • Keep this category separate from SEO claims. Agentic browsability is not evidence of search ranking or AI visibility.

Severity levels

Level Description Action
Critical Security vulnerabilities, complete failures Fix immediately
High Core Web Vitals failures, major a11y barriers Fix before launch
Medium Performance opportunities, SEO improvements Fix within sprint
Low Minor optimizations, code quality Fix when convenient

Audit output format

When performing an audit, structure findings as:

## Audit results

### Evidence
| Signal | Scope/conditions | Result | Source |
|--------|------------------|--------|--------|
| LCP | URL, phone, p75/28 days | 3.1s (needs improvement) | CrUX |
| Accessibility | URL, mobile navigation | 92 | Lighthouse |

### Critical issues (X found)
- **[Category]** Issue description. File: `path/to/file.js:123`
  - **Impact:** Why this matters
  - **Evidence:** Measured failure, runtime observation, or source hypothesis
  - **Fix:** Specific code change or recommendation

### High priority (X found)
...

### Summary
- Performance: measured status and X findings
- Accessibility: automated status, X findings, manual checks pending/passed
- SEO: X findings
- Best Practices: X findings
- Agentic Browsing: X findings or not available

### Recommended priority
1. First fix this because...
2. Then address...
3. Finally optimize...

### Verification
- Re-run results under the same conditions
- Manual checks completed
- Field validation still pending

Quick checklist

Before every deploy

  • [ ] Core Web Vitals passing
  • [ ] No accessibility errors (axe/Lighthouse)
  • [ ] No console errors
  • [ ] HTTPS working
  • [ ] Meta tags present

Weekly review

  • [ ] Check Search Console for issues
  • [ ] Review Core Web Vitals trends
  • [ ] Update dependencies
  • [ ] Test with screen reader

Monthly deep dive

  • [ ] Full Lighthouse audit
  • [ ] Performance profiling
  • [ ] Accessibility audit with real users
  • [ ] SEO keyword review

References

For detailed guidelines on specific areas: - Performance Optimization - Core Web Vitals - Accessibility - SEO - Best Practices

BB Skills installation-path note

Set BB_SKILL_DIR to the absolute installed web-quality-audit folder before invoking the optional static helper. Pass the target HTML file or project directory separately. The helper reads source text and returns findings; a successful process or success: true means the scanner ran, not that the target passed an accessibility or security audit.

PACKAGE TRANSPARENCY

Inspect before installing

Source: Addy Osmani · MIT · SHA-256 shown alongside the download.

8 files18762 ZIP bytes1 script/code file

License file included. A license and checksum are not a security certification. Review package instructions and scripts before running them.

View files and uncompressed sizes

An adaptation record is bundled. Inspect the declared changes and archived original before use. Review adaptation and original-file hashes →

Machine-readable installation guide →
CATALOG REVIEW NOTES

Know what you need before installing

Source and packaging checks recorded on 2026-10-03. These notes are not safety certification or measured task performance.

Requirements

Choose representative URLs and states, and use authorized browser/audit tools. The optional static HTML helper needs Bash, jq, grep and find. Set BB_SKILL_DIR to the installed web-quality-audit directory and pass the target project/file separately; run with Bash rather than assuming an executable bit.

Costs, access & practical limits

Independent MIT project maintained by Addy Osmani; not official Google guidance or certification. The package does not provide Chrome DevTools MCP, Lighthouse, credentials, user telemetry or a model. Tool, model and infrastructure access may have separate costs. Check current W3C and Google documentation; automated checks cover a subset of issues and cannot establish WCAG conformance, application security, search rankings or field Core Web Vitals. Full skill/agent runtime evaluation has not been performed. Packaging links are adapted; required cross-skill reference documents are bundled, while related SKILL.md links open pinned upstream source and do not install other skills.

View the recorded checks
  • Pinned originals verified against Git blob hashes
  • Complete upstream MIT notice preserved
  • Core identity and local Markdown dependencies checked
  • Link adaptations declared and exact changed originals retained
  • Independent attribution and measurement limits disclosed

Upstream commit: afa8da942115f2961fdbfa80807ea0b232ff6c00

Runtime status: not tested by this catalog. Configure your client and test the skill in your own environment.

SCENARIOS

Inputs, criteria and recorded outcomes

Records are supplied by the site administrator and bound to a specific package. They are not third-party safety certification. This page does not execute skills.

Static HTML helper: eight synthetic behavior fixtures

Reported passed · vafa8da942115.bb1

View input and acceptance criteria

Input

Run original Bash helper bytes as a non-root process on synthetic local HTML. Check literal basics, missing attributes, two known false positives, quoted filenames, empty input directory, output bounds and invalid target.

Acceptance criteria

Eight expected behavior assertions match, including two documented false positives. A successful scanner exit or empty result is not proof of page quality. No rendered website or full AI workflow was audited.

Recorded outcome

Eight synthetic static-helper behavior checks, including documented limitations; no rendered-page, Lighthouse, screen-reader, security, field-performance or full AI-agent evaluation. Assertion success is not a clean audit verdict.
{
  "format": 1,
  "executed_at": "2026-10-03T04:03:31.723331+00:00",
  "status": "passed",
  "skill_slug": "web-quality-audit",
  "skill_version": "afa8da942115.bb1",
  "package_sha256": "dd1896332340b2c621d195dfea8004a885615a7b2515b7074ffbb9273bf590a3",
  "helper_sha256": "b1b28663af412f746baf5008618e3ae798e322b10ff5ab7ae1830826a6d8e4e2",
  "probe_sha256": "441a4bfc47387baf3674775221e81218b16e4d3b93a33f301c6c35ffb6e56e25",
  "environment": "Linux-6.12.111+deb13-amd64-x86_64-with-glibc2.41; Bash GNU bash, Version 5.2.37(1)-release (x86_64-pc-linux-gnu); jq-1.7; non-root process; synthetic local HTML only",
  "scope": "Eight synthetic static-helper behavior checks, including documented limitations; no rendered-page, Lighthouse, screen-reader, security, field-performance or full AI-agent evaluation. Assertion success is not a clean audit verdict.",
  "fixtures": [
    {
      "case": "clean literal HTML",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 0,
      "warning_count": 0,
      "truncated": false,
      "error_type": null
    },
    {
      "case": "missing HTML basics and alt",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 4,
      "warning_count": 2,
      "truncated": false,
      "error_type": null
    },
    {
      "case": "valid title attribute: known false positive",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 1,
      "warning_count": 0,
      "truncated": false,
      "error_type": null
    },
    {
      "case": "valid single-quoted viewport: known false positive",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 1,
      "warning_count": 0,
      "truncated": false,
      "error_type": null
    },
    {
      "case": "quoted filename JSON escaping",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 0,
      "warning_count": 1,
      "truncated": false,
      "error_type": null
    },
    {
      "case": "empty directory: no rendered-site conclusion",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 0,
      "warning_count": 0,
      "truncated": false,
      "error_type": null
    },
    {
      "case": "bounded finding output",
      "assertion_matched": true,
      "process_exit": 0,
      "issue_count": 0,
      "warning_count": 126,
      "truncated": true,
      "error_type": null
    },
    {
      "case": "missing target",
      "assertion_matched": true,
      "process_exit": 1,
      "issue_count": null,
      "warning_count": null,
      "truncated": null,
      "error_type": "invalid_input"
    }
  ],
  "limitations": [
    "The original line-based helper falsely flags a valid title element with an attribute and a valid single-quoted viewport in these fixtures.",
    "An empty directory returns success with no findings; this is not evidence that a real site was reviewed.",
    "Findings are regex-based source smoke signals; multiline markup, semantics, JavaScript rendering and accessibility behavior require separate tools and manual checks."
  ],
  "read_only_confirmed": true,
  "temporary_storage_removed": true
}
Evidence SHA-256: 3b7c1ad38475bbd2d9706d7b57ad3ae214d6ebdf3cb85e89a016eecf0e63815d

Environment

Linux-6.12.111+deb13-amd64-x86_64-with-glibc2.41; Bash GNU bash, Version 5.2.37(1)-release (x86_64-pc-linux-gnu); jq-1.7; non-root process; synthetic local HTML only

Package SHA-256: dd1896332340b2c621d195dfea8004a885615a7b2515b7074ffbb9273bf590a3

Outcome recorded: 2026-10-03 04:03 UTC

Community reviews

★ New

Be the first to share your experience.

Sign in to leave a review →

More to explore

View all ↗