react-frontend — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited react-frontend (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Verify before implementing: For App Router patterns, React 19 APIs, or version-specific behavior, look up current docs (Context7 query-docs if available, else the framework's official docs via web search) before writing code. Training data may lag current releases.
Effects are escape hatches; most logic should NOT use effects.
| Need | Solution |
|---|---|
| Derived value from props/state | Calculate during render (useMemo if expensive) |
| Reset state on prop change | key prop on component |
| Respond to user event | Event handler |
| Notify parent of state change | Call onChange in event handler, or fully controlled component |
| Chain of state updates | Calculate all next state in one event handler |
| Sync with external system | Effect with cleanup |
Effect rules:
setItems(prev => [...prev, item])) to remove state dependenciesuseEffectEvent for non-reactive values (e.g., theme in a connection effect)AbortController for fetch; ignore flag for non-cancellable promises. With React Query, pass the query function's signal to the transport, such as queryFn: ({ signal }) => fetch(url, { signal }). Without consuming that signal, an unused query can finish and populate the cache; do not describe that behavior as transport cancellation.eslint-disable, @ts-ignore) in new codeuseEffect dependency arrays not manually overriddenforwardRef usage in React 19+ projects (use ref prop directly)Read the relevant reference before implementing or reviewing the matching behavior:
@theme tokens, CVA/tailwind-variants, dark mode, v3-to-v4 migration, or overflow and hidden pitfalls: tailwind.md.Existing specialized references, when the corresponding topic applies:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.