Search skills/

React Doctor Claude skills

Skills built around the React Doctor scanner: the agent runs npx react-doctor, triages what it finds, and writes a read-only audit and fix plans.

millionco/react-doctor 17 skills Code review & quality

with caveats

The React audit skills are useful and deliberately read-only, but the license is unclear and most of the pack is internal tooling for the project's own maintainers.

broad access: loads instructions from a server · runs unpinned remote code → security details

Depth
3/5
Last update
today
Installs
—
Stars
15K
Forks
493
License
Unclear

What React Doctor does

React Doctor is a diagnostic tool for React code, and this repo ships agent skills that put it to work. The react-doctor skill runs npx react-doctor and walks the agent through a /doctor triage flow for the diagnostics it reports. The improve-react skill (about 12 KB, with two reference files) has the agent survey a whole React codebase as a senior React engineer would, using the scan output as evidence. It produces a prioritized audit plus self-contained implementation plans that other agents can pick up. That skill is strictly read-only: no --fix, no code edits, no commits, no formatters and no dependency installs. There is also an improve-threejs skill of about 9 KB.

Most of the 17 skills live in .agents/skills and serve the maintainers of React Doctor itself. benchmark-fp-fn-audit audits the tool against a ReactBench corpus at a hardcoded local path. rule-research, rule-writing and rule-validate cover authoring rules. run-parity comes with 14 scripts and 7 tests, and ship reviews a branch against AGENTS.md. Two of them, deslop for code cleanup and find-similar-functions, which uses the truffler symbol search tool, are general enough to use in other projects.

Good for

  • React codebases where agents write a lot of the code
  • Getting a prioritized React audit without letting the agent edit anything
  • Producing fix plans to hand off to other agents

Not for

  • Non-React projects
  • Teams that need a clearly stated open-source license

What's inside depth 3/5

17 skills averaging about 6 KB, a few with reference files, and one internal skill with 14 scripts and 7 tests. The user-facing skills are instructions plus references that drive an external CLI.

Skills
17
Reference docs
5
Scripts
14
Tests / evals
125
Templates
0
Avg SKILL.md
5.7 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Node.js with npx (runs the react-doctor package)
  • truffler CLI for the find-similar-functions skill
  • Bun for some internal maintainer skills

Security review

Security: Broad access

This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.

  • Loads instructions from a server at run timeOn /doctor, the agent is told to curl https://www.react.doctor/prompts/react-doctor-agent.md and follow every step in it; the skill says updating that prompt changes every agent's behavior on its next fetch..agents/skills/react-doctor/SKILL.md:27
  • Loads instructions from a server at run timeThe distributed react-doctor skill contains the same runtime fetch of the canonical playbook, plus per-rule prompts from react.doctor/prompts/rules/.skills/react-doctor/SKILL.md:33

The react-doctor skill runs the latest published react-doctor package via npx. Its /doctor workflow downloads a playbook from react.doctor at runtime and tells the agent to follow it, so its behavior can change without any change to this repo. Per the repo's own notes, the CLI sends anonymized Sentry telemetry. Most of the repository (over 7,000 files, including the CLI source) was not available for review.

Worth knowing

  • Runs remote code at an unpinned versionNormal use runs npx react-doctor@latest, which executes whatever version of the package is currently published..agents/skills/react-doctor/SKILL.md:13
  • Relies on a CLI or package we could not reviewSeveral skills run bunx @rayhanadev/truffler, an external npm package whose source is not in the reviewed files..agents/skills/find-similar-functions/SKILL.md
  • Makes network requestsFetches prompt files from www.react.doctor with curl..agents/skills/react-doctor/SKILL.md:30
  • Makes network requestsThe parity skill runs evaluations in Vercel Sandbox using VERCEL_OIDC_TOKEN or VERCEL_TOKEN, and queries GitHub via gh..agents/skills/run-parity/SKILL.md
  • Sends usage data by default (can be turned off)States that the React Doctor CLI sends anonymized Sentry telemetry, and that it is a no-op with --no-score, in tests and in the API library..agents/skills/product-thinking/SKILL.md:66
  • browser_session_optionalCan attach to the user's authenticated Chrome through --cdp <remote-debugging-url>, but only when the user needs that and Chrome is started with remote debugging.skills/react-doctor/SKILL.md:29
  • Installs packages or toolsInstructs running ni to install repository dependencies before evaluation..agents/skills/run-parity/SKILL.md

What we checked

The repository (7445 files) on Nov 1, 2026. Not a full review: 7406 of 7445 files were not downloaded (large repository; we reviewed the skill folders); we read 7 of 14 code files; it relies on code outside the repository: Remote playbook https://www.react.doctor/prompts/react-doctor-agent.md and per-rule prompts under https://www.react.doctor/prompts/rules/ (fetched at runtime); npm package react-doctor@latest (run via npx), including its Sentry telemetry code; npm package @rayhanadev/truffler (run via bunx).

NVIDIA SkillSpector static scan: 49 pattern hits (MCP Rug Pull 45, Excessive Agency 2, YARA Match 1, Prompt Injection 1). The 45 'MCP Rug Pull' hits are unpinned npx react-doctor@latest commands in the skills. The Excessive Agency hits are wording in the internal ship skill. The YARA and Prompt Injection hits on 'ignore previous instructions' are in skills/improve-react/SKILL.md, which was not provided, so they could not be checked.

A review, not a certification. Skills change after we check them — read the files before installing.

License

GitHub reports the license as NOASSERTION. Read the repo's license file before any commercial use.

Can it run unattended?

Not really. improve-react produces a one-off audit and plans without changing code, and the dossier shows no loops or resumable state for long unattended runs.

Alternatives to React Doctor

Vercel Agent Skills

vercel-labs/agent-skills

Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit.

recommended Security: Broad access depth3/5

Web Quality Skills

addyosmani/web-quality-skills

Six skills by Addy Osmani for auditing and fixing web performance, Core Web Vitals, accessibility, SEO and best practices, built around Lighthouse.

recommended Security: Check first depth3/5

Callstack Agent Skills

callstackincubator/agent-skills

React Native skills from Callstack: performance, navigation, TV apps, upgrades, brownfield migration, GitHub Actions builds and device-driven testing.

recommended Security: Check first depth4/5

anti-slop

dmmulroy/anti-slop

Opinionated vendored Oxlint rules that reject low-evidence TypeScript and JavaScript patterns, installed and configured by a bundled setup skill.

with caveats Security: Check first depth3/5

FAQ

What is React Doctor?

React Doctor is a scanner from millionco that flags problems in React code, with rule documentation at react.doctor/docs/rules. This repo adds agent skills that run the scanner and turn its findings into triage, audits and implementation plans.

How do I run React Doctor from an agent?

The react-doctor skill has the agent run npx react-doctor and then follow a /doctor triage flow. You need Node.js with npx. Because the command doesn't pin a version, consider pinning one yourself.

Does the improve-react skill change my code?

No. Its rules forbid --fix, code edits, commits, formatters and dependency installs. It runs React Doctor read-only and writes a prioritized audit plus implementation plans for other agents to carry out.

Is React Doctor safe to install?

The scanner's prompt-injection hits point at improve-react's read-only rules, and the excerpt shows no attempt to override the agent. The real caveat is that npx react-doctor is unpinned, so each run fetches the latest package version.

Which skills are meant for end users?

react-doctor, improve-react and improve-threejs are the user-facing ones, and deslop and find-similar-functions also work in other projects. Skills like benchmark-fp-fn-audit, rule-writing, run-parity and ship exist to maintain React Doctor itself, and some reference the maintainer's local paths.

Curated by , AI enthusiast. Reviews are written by AI reviewers under our rubric and checked against the repository files.

Sources: GitHub repository (stars, license, file tree, last push Nov 1, 2026). Review based on the README and SKILL.md files as published.