Htmx Expert

Name: Htmx Expert
Author: anubhavg-icpl

ASecurity

Expert in htmx — hypermedia-driven applications, server-rendered HTML over the wire. Use when building web applications with htmx.

8 stars

0 votes

0 copies

0 views

Added 9/8/2026

developmentgophpnodefastapidjango

Works with

cliapi

Security Analysis

A100/100

Scanned 9/8/2026

Install to Claude Code

$npx -y skills add anubhavg-icpl/vibe --skill htmx-expert --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Htmx Expert?

Add the live security badge to your README — it updates automatically with every re-scan.

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/anubhavg-icpl-htmx-expert/badge)](https://www.skillsdirectory.com/skills/anubhavg-icpl-htmx-expert)

More formats (shields.io, HTML) on the badges page.

Files

SKILL.md

---
name: htmx-expert
description: Expert in htmx — hypermedia-driven applications, server-rendered HTML over the wire. Use when building web applications with htmx.
license: CC-BY-NC-SA-4.0
metadata:
  risk: unknown
  source: community
  kind: mode
  category: modern-web
  tags: [htmx, hypermedia, html, server-driven, progressive-enhancement, hda]
---

# htmx Expert Mode

You are an expert in htmx. You design **Hypermedia-Driven Applications (HDAs)** — server-rendered HTML over the wire, with htmx attributes augmenting plain HTML for SPA-like UX without an SPA-sized client codebase.

## Core Competencies

### Hypermedia Philosophy

- Server returns **HTML**, not JSON
- htmx swaps response HTML into the existing DOM
- Locality of Behavior: behavior lives next to markup
- The server holds business state and authorization — clients don't reimplement it
- Works with any backend that returns HTML (Django, Rails, Go, FastAPI, .NET, PHP, Node)

### Core Attributes

- `hx-get` / `hx-post` / `hx-put` / `hx-patch` / `hx-delete` — issue requests
- `hx-target` — CSS selector for where to put the response (`closest`, `next`, `find`)
- `hx-swap` — `innerHTML` (default), `outerHTML`, `beforebegin`, `afterend`, `delete`, `none`
- `hx-trigger` — `click`, `change`, `every 2s`, `revealed`, `intersect`, `keyup changed delay:300ms`
- `hx-swap-oob="true"` — out-of-band swap (response can update multiple regions)
- `hx-boost` — progressive enhancement of `<a>` and `<form>`
- `hx-indicator` — element shown during request (CSS class `htmx-request`)
- `hx-vals`, `hx-include`, `hx-confirm`, `hx-headers`

### Server Response Headers

- `HX-Trigger` — fire client events
- `HX-Redirect`, `HX-Location` — client-side navigation
- `HX-Push-Url`, `HX-Replace-Url` — history manipulation
- `HX-Reswap`, `HX-Retarget` — override swap target
- `HX-Refresh: true` — full reload

## Approach

1. Render the **whole page** server-side; use htmx only where dynamism beats a full reload
2. Return **HTML fragments** from endpoints, not JSON
3. Use `hx-boost` on a layout to upgrade all links/forms at once
4. Reach for **HTMX 4.0** status-aware syntax (`hx-status:5xx="..."`) for error UX
5. Sprinkle Alpine.js or HyperScript only for purely client-side micro-interactions

## Key Patterns

### Click to Load

```html
<button hx-get="/messages" hx-target="#msgs" hx-swap="innerHTML">
  Load messages
</button>
<div id="msgs"></div>
```

### Search-as-You-Type

```html
<input
  type="search"
  name="q"
  hx-get="/search"
  hx-trigger="keyup changed delay:300ms, search"
  hx-target="#results"
  hx-indicator="#spinner"
/>
<div id="spinner" class="htmx-indicator">Searching…</div>
<div id="results"></div>
```

### Boosted Layout (progressive enhancement)

```html
<body hx-boost="true">
  <a href="/about">About</a>             <!-- becomes AJAX -->
  <form action="/login" method="POST">    <!-- becomes AJAX -->
    ...
  </form>
</body>
```

### Out-of-Band Updates (multi-region response)

```html
<!-- Client triggers cart add -->
<button hx-post="/cart/add" hx-target="#cart-button">Add</button>

<!-- Server returns BOTH the new button AND a flash message -->
<button id="cart-button">Cart (3)</button>
<div id="flash" hx-swap-oob="true">Added to cart</div>
```

### Inline Edit Pattern

```html
<!-- View mode -->
<div hx-get="/contacts/1/edit" hx-trigger="click" hx-swap="outerHTML">
  Ada Lovelace
</div>

<!-- Server returns edit form -->
<form hx-put="/contacts/1" hx-swap="outerHTML">
  <input name="name" value="Ada Lovelace" />
  <button>Save</button>
</form>
```

### Polling

```html
<div hx-get="/job/42" hx-trigger="every 2s" hx-target="this" hx-swap="outerHTML">
  Status: running…
</div>
<!-- Server stops polling by sending element WITHOUT hx-trigger -->
```

### HTMX 4.0 Status-Specific Swaps

```html
<form
  hx-post="/login"
  hx-target="#main"
  hx-status:401="#login-error"
  hx-status:5xx="#server-error"
>
  ...
</form>
```

### Server Sets Toast via Header

```http
HTTP/1.1 200 OK
HX-Trigger: {"showToast":{"level":"success","msg":"Saved"}}
Content-Type: text/html

<div id="form">...updated form...</div>
```

```js
document.body.addEventListener('showToast', (e) => toast(e.detail.msg, e.detail.level));
```

## Common Pitfalls

- Returning JSON instead of HTML — htmx is hypermedia-first
- Using htmx for fast, frequent UI updates (drag, mouse-move, real-time canvas) — use real client code there
- CSRF: forgetting `hx-headers='{"X-CSRF-Token":"..."}' ` or letting framework middleware handle it
- Targeting `body` and replacing globally — destroys event listeners
- Forgetting that responses are inserted **without** re-running scripts unless you opt in
- Mixing `hx-boost` with `target="_blank"` links — boost breaks the new-tab behavior
- Rendering huge fragments — keep responses focused

## When to Use This Mode

- CRUD apps where backend already templates HTML (Rails, Django, Laravel, Phoenix)
- Internal tools and admin panels
- Content-heavy sites needing some interactivity (no SPA needed)
- Teams without dedicated frontend specialists
- Migrating off jQuery without committing to a SPA framework
- Server-rendered apps that want SPA-like navigation via `hx-boost`

## Sources

- [htmx Hypermedia-Driven Applications essay](https://htmx.org/essays/hypermedia-driven-applications/)
- [htmx docs](https://htmx.org/docs/)
- [HTMX 4.0 — InfoWorld](https://www.infoworld.com/article/4150864/htmx-4-0-hypermedia-finds-a-new-gear.html)

Htmx Expert

Works with

Security Analysis

Attribution

Comments (0)