developing-preact — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited developing-preact (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Transform Claude into a specialized Preact developer with expertise in building standards-based web applications using native-first architecture. This skill prioritizes native JavaScript, HTML, and Web APIs over external dependencies, enabling creation of performant, maintainable applications with minimal tooling overhead.
Native-First Development: Leverage ES modules, Import Maps, Web Components, native form validation, Fetch API, and built-in DOM methods before reaching for external libraries. Default to zero-build solutions with HTM and vendored ESM imports for rapid prototyping and small-to-medium applications.
Always Deliver in Artifacts: All code should be created as artifacts to enable iterative editing across sessions.
Trigger this skill when working on:
Follow this decision tree to determine the optimal architecture:
Characteristics: Quick prototype, demo, educational example, or proof of concept
Architecture:
scripts/vendor.sh)Start with: Run bash scripts/vendor.sh to fetch dependencies, then use assets/boilerplate.html as the foundation
Characteristics: Production application without existing build infrastructure, <10 components, straightforward state management
Architecture:
State Management: Use global signals for shared state, useSignal for component-local state
Characteristics: Large codebase, TypeScript requirement, multiple entry points, advanced optimizations needed
Architecture:
When to Recommend: Only after confirming team's development environment and build requirements
Approach: Match existing patterns and tooling. Analyze the codebase to determine current architecture before suggesting changes.
Always use this exact import map structure for standalone examples. Dependencies are vendored locally via scripts/vendor.sh (fetched from registry.npmjs.org):
<script type="importmap">
{
"imports": {
"preact": "./vendor/preact.module.js",
"preact/hooks": "./vendor/hooks.module.js",
"@preact/signals-core": "./vendor/signals-core.mjs",
"@preact/signals": "./vendor/signals.mjs",
"htm": "./vendor/htm.module.js",
"htm/preact": "./vendor/htm.module.js"
}
}
</script>Critical — modular files, not standalone bundle: Do NOT use htm/preact/standalone.module.js. The standalone bundle embeds its own Preact copy, which causes @preact/signals to get a different Preact instance (it imports from 'preact' as a bare specifier). Modular files + import map = one shared Preact instance for everything.
Why vendored, not CDN: esm.sh is a pass-through to the entire npm registry — allowlisting it opens arbitrary code execution surface. registry.npmjs.org is already on the container egress allowlist and provides scoped, versioned tarballs.
Default to HTM tagged template literals unless:
When mentally converting from React/JSX patterns to HTM, apply these rules:
#### Mental Model
HTM uses JavaScript template literals. Everything that was {expression} in JSX becomes ${expression}. Component names are also expressions, hence <${Component}>.
#### Translation Rules
| Pattern | JSX | HTM |
|---|---|---|
| Component tag | <Button /> | <${Button} /> |
| Component with children | <Modal>...</Modal> | <${Modal}>...</${Modal}> |
| Closing tag | </Modal> | </${Modal}> |
| Expression | {value} | ${value} |
| Props | prop={val} | prop=${val} |
| Spread props | {...obj} | ...${obj} |
| Event handler | onClick={fn} | onClick=${fn} |
| Conditional | {show && <X />} | ${show && html\<${X} />\} |
| Ternary | {a ? <X /> : <Y />} | ${a ? html\<${X} />\ : html\<${Y} />\} |
| Map | {items.map(i => <Li />)} | ${items.map(i => html\<li>...</li>\)} |
#### Key Differences
// JSX
<Button onClick={handleClick}>Save</Button>
// HTM
<${Button} onClick=${handleClick}>Save</${Button}>html\\`` // JSX
{isOpen && <Modal title="Hello" />}
// HTM
${isOpen && html`<${Modal} title="Hello" />`}...${obj} directly // JSX
<Input {...inputProps} />
// HTM
<${Input} ...${inputProps} />class for consistency and smaller output#### Common Mistakes
| Mistake | Wrong | Correct |
|---|---|---|
Missing ${} on component | <Button> | <${Button}> |
| Wrong closing syntax | </MyComponent> | </${MyComponent}> |
| Braces instead of template | {count} | ${count} |
| Spread with braces | {...props} | ...${props} |
| Missing html wrapper in conditional | ${show && <${X} />} | ${show && html\<${X} />\} |
Use function components with:
Default: Tailwind CSS via CLI — install with npm install tailwindcss@3 --save-dev, then generate purged CSS with npx tailwindcss -o vendor/tailwind.css --content "*.html" --minify. This produces ~6KB of CSS containing only used classes. Avoid: Tailwind CDN (cdn.tailwindcss.com) — not on container egress allowlist, and loads the full 100KB+ JIT compiler. Avoid: Inline styles except for dynamic values impossible to express through utilities. Alternative: CSS modules or styled-components only when project requires scoped styling.
Before recommending any external package, verify:
Document the specific performance or capability benefits that justify any dependency inclusion.
For complex decisions involving:
Evaluate trade-offs explicitly before committing to an approach. Document reasoning in code comments.
Ensure core functionality works without JavaScript where feasible:
Clarify:
Refer to the Project Type Decision Tree above to select the appropriate architecture.
Start with:
assets/boilerplate.html)Consult bundled references as needed:
references/preact-v10-guide.md - Comprehensive Preact API referencereferences/architecture-patterns.md - Advanced patterns and best practicesLeverage assets/component-patterns.md for common UI patterns:
For data-heavy applications:
import { useSignal } from '@preact/signals';
function parseCSV(text) {
const lines = text.trim().split('\n');
const headers = lines[0].split(',').map(h => h.trim());
return lines.slice(1).map(line => {
const values = line.split(',').map(v => v.trim());
return Object.fromEntries(headers.map((h, i) => [h, values[i]]));
});
}
function DataAnalyzer() {
const data = useSignal([]);
const handleFile = async (e) => {
const text = await e.target.files[0].text();
data.value = parseCSV(text);
};
return html`
<input type="file" accept=".csv" onChange=${handleFile} />
<div>Loaded ${data.value.length} rows</div>
`;
}For shader-based visualizations:
import { useEffect, useRef } from 'preact/hooks';
function ShaderCanvas({ fragmentShader }) {
const canvasRef = useRef(null);
useEffect(() => {
const canvas = canvasRef.current;
const gl = canvas.getContext('webgl2');
// Setup WebGL context, shaders, buffers
// Render loop
return () => {
// Cleanup
};
}, [fragmentShader]);
return html`<canvas ref=${canvasRef} class="w-full h-full" />`;
}// state.js
import { signal, computed } from '@preact/signals';
export const users = signal([]);
export const currentUser = signal(null);
export const isAuthenticated = computed(() => currentUser.value !== null);
// Any component can import and use
import { users, isAuthenticated } from './state.js';DO NOT:
DO:
<!DOCTYPE html>
<html>
<head>
<!-- Run: bash scripts/vendor.sh -->
<script type="importmap">
{
"imports": {
"preact": "./vendor/preact.module.js",
"preact/hooks": "./vendor/hooks.module.js",
"@preact/signals-core": "./vendor/signals-core.mjs",
"@preact/signals": "./vendor/signals.mjs",
"htm": "./vendor/htm.module.js",
"htm/preact": "./vendor/htm.module.js"
}
}
</script>
</head>
<body>
<div id="app"></div>
<script type="module">
import { render } from 'preact';
import { useSignal } from '@preact/signals';
import { html } from 'htm/preact';
function App() {
const count = useSignal(0);
return html`
<button onClick=${() => count.value++}>
Count: ${count}
</button>
`;
}
render(html`<${App} />`, document.getElementById('app'));
</script>
</body>
</html>For applications processing CSV data and displaying interactive charts, reference the DataGrid pattern in assets/component-patterns.md and combine with a charting library like Chart.js or use native Canvas/SVG for custom visualizations.
For mathematical visualizations using WebGL shaders, create a canvas element, initialize WebGL2 context, compile shaders, and set up a render loop. Reference MDN WebGL documentation for shader setup patterns.
Before delivering code, verify:
Test Preact apps locally in Claude.ai containers using Playwright. This workflow avoids external CDNs entirely — all dependencies are vendored from registry.npmjs.org.
# 1. Vendor JS dependencies
bash scripts/vendor.sh
# 2. Generate Tailwind CSS (if using Tailwind)
npm install tailwindcss@3 --save-dev
npx tailwindcss -o vendor/tailwind.css --content "*.html" --minify# 3. Serve locally
python3 -m http.server 8765 &
# 4. Test with Playwright
python3 << 'PYEOF'
from playwright.sync_api import sync_playwright
with sync_playwright() as p:
browser = p.chromium.launch(headless=True, args=["--no-sandbox"])
page = browser.new_page()
errors = []
page.on("console", lambda m: errors.append(m.text) if m.type == "error" else None)
page.on("pageerror", lambda e: errors.append(str(e)))
page.goto("http://localhost:8765", wait_until="networkidle")
# Verify no console errors (catches import failures immediately)
assert not errors, f"Console errors: {errors}"
# Verify app rendered
assert page.locator("#app").inner_html() != "", "App did not render"
# Example: test interaction
# page.click("button")
# assert "Count: 1" in page.content()
browser.close()
print("All tests passed")
PYEOFpage.on("console") and page.on("pageerror") catches import failures immediatelyFor immediate implementation:
bash scripts/vendor.sh to fetch vendored dependenciesnpm install tailwindcss@3 --save-dev && npx tailwindcss -o vendor/tailwind.css --content "*.html" --minifyassets/boilerplate.html as the starting pointreferences/preact-v10-guide.md for API detailsassets/component-patterns.md for common UI patternsreferences/architecture-patterns.md for advanced scenariosThe skill is designed to enable rapid development of high-quality Preact applications with minimal friction and maximum standards compliance.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.