Install
$ agentstack add skill-sbrudz-agent-skills-react-best-practices ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
React Best Practices for Code Review
Supplement to the standard code review checklist. Covers judgment calls that linters and static analysis cannot catch.
When to Use
During code review when the diff contains React code (.tsx, .jsx, or .ts files importing from "react").
Apply these checks after the standard code quality review, as an additional pass.
Review Checklist
Check each section below. Flag violations as Important or Minor per the standard review severity levels.
1. Component Responsibility & Size
A component is too large when it mixes concerns, not when it exceeds a line count.
Flag when a single component does more than one of:
- Renders UI (view layer)
- Contains business logic (data transformation, validation, calculations)
- Manages complex state interactions (multiple related
useState+useEffect) - Fetches data
The fix pattern:
- View logic stays in the component (JSX, conditional rendering, layout)
- Business logic moves to pure functions (sorting, filtering, formatting, validation). Pure functions are trivially testable without rendering.
- Complex state + effects move to custom hooks (
useOrders,useAuth,useSettings). A hook is "complex" when it combines multipleuseStatecalls that interact with each other or withuseEffect.
// BAD: all mixed in one component
function Dashboard() {
const [orders, setOrders] = useState([]);
const [sorted, setSorted] = useState([]);
useEffect(() => { fetch(/*...*/) }, []);
useEffect(() => { setSorted(orders.sort(/*...*/)) }, [orders]);
const formatPrice = (n: number) => /*...*/;
return ...;
}
// GOOD: separated by responsibility
function Dashboard() {
const { orders, sort, sortField } = useOrders(); // custom hook: state + fetching
return ;
}
// sortOrders(), formatPrice() are pure functions in a utils file
2. useEffect Misuse
Linters catch missing dependencies. They cannot catch unnecessary effects.
Flag these patterns:
| Pattern | Fix | |---|---| | Effect computes derived state (useEffect + setState from other state) | Compute during render or useMemo | | Effect resets state when a prop changes | Use key on the component instead | | Chain of effects (A sets state, triggers B, triggers C) | Do the work in one event handler | | User-driven side effect in useEffect instead of event handler | Move to the handler that caused it | | Effect without cleanup for subscriptions, timers, or fetch | Add cleanup function with AbortController |
useEffect is ONLY for synchronizing with external systems (subscriptions, timers, DOM manipulation, third-party widgets).
3. React Version-Appropriate Patterns
Check package.json for the React version. Review for patterns appropriate to that version.
React 19+ apps should use:
| Instead of | Use | |---|---| | Manual loading/error/data state for fetches | ` boundaries + Server Components for data fetching | | onSubmit + useState for form submission state | useActionState for form action + state, useFormStatus for pending UI | | useEffect to resolve promises | use() hook | | Defensive React.memo, useMemo, useCallback | React Compiler handles memoization automatically. Only add manual memoization when a third-party library requires stable identity, or as an explicit useEffect` dependency. |
useActionState signature reminder: (prevState, formData) => newState — first arg is previous state, not formData. Imported from "react", not "react-dom".
useFormStatus rule: Must be called from a child component rendered inside the ``, not in the same component that renders the form.
4. Accessibility Beyond Linting
eslint-plugin-jsx-a11y catches static markup issues. These behavioral issues require judgment:
Focus management:
- Modal/dialog: trap focus inside, return focus to trigger on close
- Route changes in SPAs: announce new page to screen readers
- Form errors: move focus to error summary or first invalid field
- Success/error messages: use
role="alert"oraria-live="polite"so screen readers announce them
Keyboard navigation:
- Every interactive element must work with keyboard (Tab, Enter, Space, Escape, Arrow keys)
- `
is never a button — use` (linter catches some, not all) - Custom sort controls, dropdowns, tabs need keyboard handlers
Color:
- Status indicators (error, success, pending) must not rely on color alone — add icons, text labels, or patterns
5. Testing Practices
Query priority (most to least preferred):
getByRole— validates accessibility at the same timegetByLabelText— best for form fieldsgetByText— for non-interactive contentgetByTestId— last resort only
Interaction:
- Use
userEvent(simulates real user behavior: focus, keyboard, hover) notfireEvent(dispatches a single DOM event)
What to test:
- What the user sees and does — rendered output, interaction results, accessible names
- NOT implementation details — internal state, hook calls, re-render counts, component instance methods
Mocking:
- Mock at the network boundary with MSW (Mock Service Worker), not by replacing
global.fetchor mocking component imports - If you're testing mock behavior instead of real behavior, the test is wrong
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: sbrudz
- Source: sbrudz/agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.