React Security Stinger
Designed and built by Legion Code Inc.
Where this skill's files are
Every path below (guides/, references/, scripts/) is relative to the folder that contains this SKILL.md. In Claude Code that folder is ${CLAUDE_SKILL_DIR}. If that text was not replaced with a real path, find the folder yourself (for example with Glob for **/react-security-stinger/SKILL.md) and use it as <skill> in every command.
Purpose
Find, confirm, and report the security weaknesses that are specific to React application code, for the security dimension of an /audit-my-code run (contract 1.0). It covers React 18 and 19 client components, server rendering, and React Server Components with Server Functions where they run outside Next.js (Vite with @vitejs/plugin-rsc, React Router RSC and Framework Mode, Waku, Parcel, RedwoodSDK, hand-rolled react-server-dom-* servers). It produces 02-security/findings-react-security-wasp-drone.jsonl, metrics-react-security-wasp-drone.json, and notes-react-security-wasp-drone.md, with every finding backed by evidence, and changes nothing in the audited repository.
When to use
- The orchestrator's stack routing says
react(ornextjs, for the client half) and dispatchesreact-security-wasp-drone - "Security audit this React app", "check our Vite SPA for XSS", "are we exposed to React2Shell", "is CVE-2025-55182 patched here"
- "Audit our Server Functions", "are our
'use server'actions safe", "do we leak secrets in the bundle" - Reviewing an AI-built React app (Lovable, Bolt, v0, Cursor, Claude Code scaffolds) for the usual generator mistakes
When not to use
- Next.js server surfaces (Server Actions, route handlers, middleware or proxy,
next.config, Next.js version advisories):nextjs-security-stinger - Generic OWASP pass, repository-wide and git-history secret scanning, dependency advisories outside React:
security-stinger - Svelte or SvelteKit:
sveltekit-security-stinger. Non-JavaScript backends:polyglot-security-stinger - Fixing the issues: this Stinger is research-only and never edits the audited repository; remediation planning is the
mariotier's job - Architecture review without a security question:
react-stinger
Procedure
- Read the arming line and the contract (
audit-my-code-stinger/references/audit-contract.md). Write only inside<workspace>/02-security/and only to your per-source files. - Scope and versions: run guides/00-scoping-and-version-detection.md. It runs
scripts/react_version_check.py(lockfiles against the advisory table) andscripts/sink_scan.py(candidate lines), maps the stack per path, and decides which guides apply. - XSS and SSR injection: guides/01-xss-and-injection-sinks.md.
- RSC and Server Functions (when present outside Next.js): guides/02-rsc-and-server-functions.md.
- Secrets and data exposure: guides/03-secrets-and-data-exposure.md.
- Auth, routing, client trust: guides/04-auth-routing-client-trust.md.
- Supply chain and AI-generated patterns: guides/06-supply-chain-and-ai-patterns.md.
- Write findings, metrics, and notes: guides/05-writing-findings.md. Every candidate becomes a finding, a "Not confirmed" note, or a dismissed count; never a finding without evidence.
- Return the verdict, finding counts by severity, every coverage cap, and the list of raw files written.
References map
| Path | Load when |
|---|---|
references/REFERENCE.md | finding which file holds a check, table, or script option |
references/checks-xss-and-ssr.md | guide 01: RX and RS checks with detection, confirmation, severity, code pairs, refs |
references/checks-rsc.md | guide 02: RC checks |
references/checks-secrets-and-data.md | guide 03: SD checks |
references/checks-auth-routing.md | guide 04: AR checks |
references/checks-supply-chain-and-ai.md | guide 06, and any AI-built app: SC checks, AI patterns, React 19 behavior table |
references/advisory-table.md | explaining or hand-checking a version finding; updating the script's table |
references/detection-patterns.md | ripgrep commands per check id |
references/finding-rules.md | before writing any finding, metrics, or notes |
references/research/distilled-react-security.md | verifying a domain claim or settling a dispute |
| Source research archive (not shipped with the plugin) | Source-repository only; the shipped distillation summarizes it, do not require it |
scripts/react_version_check.py | guide 00, every run |
scripts/sink_scan.py | guide 00, every run; reruns with --checks to lift caps |
scripts/test/run_tests.py | after editing either script or the advisory table |
Related drones and stingers
- react-security-wasp-drone - The paired Drone in this pack; the orchestrator dispatches it with an arming line.
- nextjs-security-stinger - Next.js server boundaries; runs beside this Stinger on Next.js apps.
- audit-my-code-stinger - The run contract, tiers, routing, and the security merge script.
security-stinger(core, when installed) - Generic OWASP pass, repository secrets, non-React dependency advisories.polyglot-security-stingerandsveltekit-security-stinger(this pack) - Other stacks in a monorepo.react-stingerinweb-development-tools(confirm installed) - React architecture questions that come up during the audit.
Critical Directive
- You must read all files and context contained within your skill.
- In the event your core knowledge does not provide sufficient guidance you must make every attempt to search the internet, related knowledge base documentation files, and other available resources to supplement your knowledge prior to proceeding with your task.
- Additional related skills can be found here:
- nextjs-security-stinger - Next.js Server Actions, route handlers, middleware, config, and Next.js version advisories.
- audit-my-code-stinger - Audit My Code contract, tiers, security routing, and merge.
Designed and built by Legion Code Inc. Licensed under AGPL-3.0-or-later.
