Add design/accessibility/security/sanitization skills

README.md

@@ -43,6 +43,14 @@ than assuming the delegate can fetch it itself.
   as fact; how to actually re-verify.
 - `karpathy-guidelines` -- general LLM-coding behavioral guidelines
   (simplicity, surgical changes, surfacing assumptions).
+- `web-design-best-practices` -- modern UI/UX conventions to apply by
+  default (typography, spacing, color/contrast, motion, forms).
+- `web-accessibility` -- WCAG-aligned baseline (semantic HTML, keyboard
+  nav, contrast, ARIA usage, forms).
+- `security-headers-and-tls` -- HTTP security headers and TLS/SSL
+  configuration strength, including reverse-proxy-layer gotchas.
+- `code-sanitization` -- framework-agnostic injection-prevention baseline
+  (SQLi, XSS, command injection, path traversal, uploads, deserialization).
 
 ## Provenance