Skills react-doctor
๐Ÿ“ฆ

react-doctor

v1.2.0 Content revision r3 High Risk โš™๏ธ External commands๐ŸŒ Network access

Diagnose and Improve React Code

React issues can hide across correctness, performance, accessibility, design, and architecture. This skill runs focused diagnostics and guides prioritized fixes with validation.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "react-doctor" from https://skillstore.io/skills/millionco-react-doctor.md and its manifest at https://skillstore.io/api/skills/millionco-react-doctor/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "react-doctor". Check the React changes on my branch.

Expected outcome:

  • Health score: 86, down from 89.
  • Two new warnings affect accessibility and list rendering.
  • Recommended order: restore button labels, then replace the unstable list key.

Using "react-doctor". Why did the no-array-index-as-key rule fire?

Expected outcome:

Index keys can associate state with the wrong item after reordering. Use a stable item identifier, or disable only this rule when justified.

Using "react-doctor". Audit the interface design.

Expected outcome:

  • Three focused findings need review.
  • The highest-impact issue is an icon button without an accessible name.
  • Typography and motion findings are advisory.

Security Audit

High Risk
v7 โ€ข 8/9/2026 Open versioned report

Most static alerts are Markdown formatting or ordinary rule references. Real risks remain because the skill executes an unpinned package and follows mutable remote instructions that can edit the working tree.

2
Files scanned
131
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Mutable Remote Instructions Control Local Edits
The skill requires agents to fetch and follow every remote playbook step. The remote source can change and directs working-tree edits without renewed review.
Lines 27-37 explicitly make the fetched playbook authoritative, require every step, and state that source updates reach agents without reinstalling the skill.
Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Ruby/shell backtick execution
```bash
This Bash block runs curl to retrieve instructions from an external host. Those instructions are then followed as an agent workflow.
High
Hardcoded URL
https://www.react.doctor/prompts/react-doctor-agent.md
The URL supplies a mutable remote playbook that the agent must follow. A server change can alter behavior after marketplace review.
High
Hardcoded URL
Pair it with the matching per-rule prompts at `https://www.react.doctor/prompts/rules/<plugin>/<rule
The skill fetches rule-specific prompts from this mutable URL template on demand. Remote content can introduce unreviewed instructions.
Medium
Ruby/shell backtick execution
Run `npx react-doctor@latest --verbose --scope changed` and check the score did not regress.
The skill directs the agent to execute an npm package from the mutable latest tag. This runs external code without a pinned reviewed version.
Medium
Ruby/shell backtick execution
Run `npx react-doctor@latest --verbose` (the default `--scope full`) to scan the full codebase. Fix
The full scan executes react-doctor through npx using the mutable latest tag. Package changes can run before marketplace review.
Medium
Ruby/shell backtick execution
Run `npx react-doctor@latest design --verbose`. This selects only design-tagged UI composition, typo
The design audit executes the unpinned react-doctor package through npx. This is legitimate tooling with supply-chain and execution risk.
Medium
Ruby/shell backtick execution
When the user wants to understand a rule, disagrees with one, or wants to disable / tune which rules
This line directs execution of npx rule commands that can modify project configuration. The package is unpinned and external.
Medium
Ruby/shell backtick execution
```bash
The fenced Bash example executes the unpinned react-doctor package through npx. This is an intentional external command.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/millionco-react-doctor/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/millionco-react-doctor/security.svg)](https://skillstore.io/skills/millionco-react-doctor?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/millionco-react-doctor?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/millionco-react-doctor/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/millionco-react-doctor.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

millionco. (2026). react-doctor security audit report (audit version 7) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/millionco-react-doctor/audits/7

BibTeX citation

@techreport{millionco-millionco-react-doctor-2026, author = {millionco}, title = {react-doctor security audit report (audit version 7)}, institution = {Skillstore}, year = {2026}, number = {7}, url = {https://skillstore.io/skills/millionco-react-doctor/audits/7}, note = {Author version 1.2.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "react-doctor security audit report (audit version 7)" version: "1.2.0" type: report authors: - name: "millionco" date-released: "2026-08-09" url: "https://skillstore.io/skills/millionco-react-doctor/audits/7" identifiers: - type: other value: "skillstore:millionco-react-doctor:audit:7" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
41
Architecture
100
Maintainability
87
Content
69
Community
91
Spec Compliance

What You Can Build

Check a feature before commit

Scan changed files, review new diagnostics, and verify that the health score did not regress.

Triage an existing codebase

Run a full scan and prioritize correctness, security, performance, accessibility, and architecture findings.

Tune team diagnostics

Explain noisy rules and apply narrow configuration changes for severity, categories, tags, or reporting surfaces.

Try These Prompts

Check my recent React changes
Scan my changed React code. Summarize new issues by severity and tell me whether the score regressed.
Run a focused design audit
Audit this React project for design, typography, interaction, accessibility, and motion issues. Prioritize user-impacting findings.
Explain and configure a rule
Explain why [rule name] fired. Show the narrowest configuration change that matches [team requirement], then validate it.
Triage the full project
Run a full React diagnostic review. Group root causes, propose a fix order, apply approved changes, and validate each batch.

Best Practices

  • Review the exact command and package version before execution.
  • Fix errors before warnings, then rerun the same scope.
  • Use the narrowest rule configuration that satisfies the team requirement.

Avoid

  • Do not accept a score increase without reviewing changed behavior.
  • Do not disable entire categories to avoid one disputed rule.
  • Do not follow mutable remote instructions without reviewing their current contents.

Frequently Asked Questions

What projects does this skill support?
It supports React projects that can run the react-doctor package through Node.js and npx.
Can it scan only my changes?
Yes. The changed scope reports issues introduced relative to the base branch.
Can it audit interface design?
Yes. Design mode focuses on composition, typography, interaction, accessibility, and motion rules.
Can it explain a diagnostic rule?
Yes. It can explain the rule, its impact, and available configuration controls.
Does it modify project files?
Rule commands can update doctor configuration files. The full remote workflow may also edit the working tree.
Does it require network access?
Yes. npx may download the package, and the full workflow fetches prompts from react.doctor.

Developer Details

Author

millionco

License

MIT

Author version

v1.2.0

Skillstore revision

r3

Version notice

The installable content changed, but the author did not update the declared version.

Ref

02be9409c79ca1183f7844009c14d9df684d0cf9

Maintenance freshness

8/11/2026

Usage

8 downloads ยท 128 views

File structure

๐Ÿ“ references/

๐Ÿ“„ explain.md

๐Ÿ“„ SKILL.md

View all