react-doctor

Generated source view for the actual executable engineering/react-doctor skill. The durable routing article is Security and Review Skills. Source: skills/engineering/react-doctor/SKILL.md

Runtime Source

Bundled Resources

No bundled resource files.

Description

Run React Doctor and React Security Doctor on React, Next.js, Vite, or React Native codebases. Use when Kevin says "react doctor", "React Security Doctor", "score React to 100", "fix bad React", "React hygiene", "scan React security", or asks for post-agent React health checks after UI edits.

Skill Source

---
name: react-doctor
description: Run React Doctor and React Security Doctor on React, Next.js, Vite, or React Native codebases. Use when Kevin says "react doctor", "React Security Doctor", "score React to 100", "fix bad React", "React hygiene", "scan React security", or asks for post-agent React health checks after UI edits.
origin: personal
source_slug: react-doctor
---

# React Doctor

Use this skill when React-specific code health matters. It is the executable
route for [[react-doctor]]: run the scanner, preserve the score, fix systemic
rule failures, and rerun until the remaining issues are understood.

## Version Check

Before a serious run, verify the current package instead of trusting memory:

```bash
npm view react-doctor version dist-tags --json
```

As of 2026-06-30, `latest` is `0.5.8`. Refresh
`wiki/tools/react-doctor.md` if this changes.

## When This Fires

- Agent-authored React, Next.js, Vite, or React Native edits touched 5+ files.
- Kevin asks for React Doctor, React Security Doctor, React hygiene, or score 100.
- A React PR is about to merge and needs a subsystem doctor before `no-sus-code-doctor`.
- A UI feels slow, fragile, inaccessible, or security-sensitive without an obvious bug.

## Procedure

1. Read `wiki/tools/react-doctor.md` for the current score formula, CLI status,
   and React Security Doctor notes.
2. Identify the app root and package manager. Do not run from the monorepo root
   if the React app lives under `apps/web`, `ui`, or another package.
3. Run the scan:

```bash
npx react-doctor@latest
```

4. If Kevin asked to fix, prefer the tool's fix loop first:

```bash
npx react-doctor@latest . --fix
```

5. Validate after each meaningful fix batch with the repo's own checks:
   typecheck, lint/check mode, focused tests, and browser verification when UI
   behavior changed.
6. Rerun React Doctor and report the before/after score, the rule categories
   cleared, and any remaining rules that need manual judgment.

## Security Mode

React Security Doctor is the security surface of the same tool family. Run it
whenever the changed code touches HTML sinks, URL/href handling, user input,
auth/session UI, secrets, or admin surfaces. Treat `dangerouslySetInnerHTML`,
unvalidated URLs, exposed client secrets, and unsafe input rendering as ship
blockers until proven safe.

## CI Gate

For PR protection, prefer the official GitHub Action over an ad hoc workflow.
Install through `npx react-doctor@latest install` or wire
`millionco/react-doctor@v2` manually. Start advisory on inherited repos
(`blocking: none`, optionally `scope: full`), then gate changed-file regressions
once the baseline is known. Do not require a perfect full-repo score on day one;
ratchet the floor as debt is paid down.

## Output

Return:

- package/version checked
- command(s) run and exit status
- before/after score
- fixed categories
- remaining issues with owner and risk
- verification commands run

If the tool is unavailable, record the install or registry failure and fall
back to `no-sus-code-doctor` plus targeted React/security review.

---

Timeline

• 2026-07-15 | Generated a browseable source page from the actual executable skill file. Source: skills/engineering/react-doctor/SKILL.md