Vercel / skills/react-best-practices/SKILL.md
React Best Practices
A prioritized React and Next.js review guide covering request waterfalls, bundle size, rendering and server behavior.
Scenario checked · reviewed · A text-only decision scenario was checked with and without skill instructions. This is not an executed workflow or proof of effectiveness.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Reviewing React or Next.js performance changes
- Finding avoidable sequential requests and oversized client bundles
02 / Setup & access
What it asks of your environment.
Requirements
- An agent able to read SKILL.md and the referenced rule files; no executable helper is invoked by the reviewed entrypoint.
- Access to the target React/Next.js source. Building and measuring changes needs that project's own runtime and tooling.
- No Vercel account or skill-specific API key is specified. Operating-system support depends on the host agent and project; not tested here.
Permissions & data access
- Read application source and bundled guidance.
- Writing code or running project commands is a separate host-agent capability; the guide is not a permission sandbox.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Review before use
Server changes need security review
The rules explicitly address authentication and cross-request data leaks. IonBin assessment: performance refactors touching server state or actions still need application-specific authorization and concurrency checks.
Review before use
Version-sensitive recommendations
The guide references framework features and libraries. IonBin assessment: check the target project's versions and measure behavior before accepting a suggested rewrite.
Limits and nuances
- Selected rules reviewed; not every rule or the compiled AGENTS.md.
- The reviewed SKILL.md advertises 70 rules; no independent rule count or performance gain was verified.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- SKILL.md entrypoint and rule index
- rules/server-no-shared-module-state.md
- rules/server-auth-actions.md
- README.md license declaration
- Bounded evaluation; exact operations, counts, environment and limitations in the linked public report
Not tested or established
- No effectiveness benchmark or security certification
- Transitive dependencies, current advisories and host-agent permission controls not audited
- One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.
- The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.
- Review date
- Source revision
063bee94c3f4df8453406c830b0a7df0f2860278- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Decision scenario
Results with their limits attached.
One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 7/7; baseline 7/7. No measured advantage or executed workflow is claimed.
- Passed
- 7
- Failed
- 0
- Total recorded
- 7
These counts refer to the cases in this report. They are not a benchmark against other skills. These are text-only decision checks, not executed tasks. Read the report for the baseline and conditioned results.
Read the evidence reportThe report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Codex agent session; separate fresh baseline and skill-conditioned agents
- Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations
Recorded commands (3)
Commands document this evaluation. They are not setup instructions for your environment.
Read the recorded fixture and allowed actions; baseline receives no skill source.Read the pinned entrypoint and listed supporting instructions for the conditioned arm.Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric.Findings from this evaluation
Observation
No measured advantage over baseline
Both arms selected the same scored actions: baseline 7/7, skill-conditioned 7/7. These are decision checks, not completed real-world tasks.
Evaluation limitations
- One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.
- The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.
- The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.
- Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.
- No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation.
05 / Reuse & discovery
License, attribution & popularity.
MIT
MIT is declared in the skill frontmatter and repository README; this review did not inspect a separate license text.
Why it is in this collection
Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.
32,600 repository stars (rounded)
- Scope
- Repository-wide; not individual skill usage.
- Observed
- Time window
- Single observation; no trend is established.
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
06 / Follow the evidence
Go to the original.
- Skill purpose, requirements and rule index github.com
- Shared server state and data-leak guidance github.com
- Server-action authorization guidance github.com
- Repository license declaration github.com
- Repository popularity context github.com
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.