Orchestrate Kevin's security/pre-ship doctor chain across React Security Doctor, deepsec, threat modeling, secure-coding review, adversarial bug hunts, vibe-code-doctor, and no-sus-code-doctor. Use when Kevin asks to string together doctors/tools, run a security doctor chain, run deepsec plus React Security Doctor, harden a production app, or decide which security doctors should gate a repo.
Use this skill as the selector and runbook for security-sensitive pre-ship work. It does not replace the underlying doctors; it decides which ones to run, in which order, and what evidence is required before saying the repo is safer.
SKILL.md before running that doctor.process without Kevin approving the projected cost. A --limit 50 calibration is allowed and expected.no-sus-code-doctor as the last gate, not as a substitute for deep scanning.Before choosing the chain:
| Surface or request | Run first | Then | Final gate |
|---|---|---|---|
| React, Next.js, Vite, or React Native UI | react-doctor with React Security Doctor mode | repo tests and browser proof for changed behavior | no-sus-code-doctor |
Auth/session UI, admin UI, user input, URL handling, dangerouslySetInnerHTML, client secrets | react-doctor security mode | security-best-practices for the framework | no-sus-code-doctor |
| Backend API, service, webhook, data layer, secrets, permissions, or multi-tenant code | security-threat-model if boundaries are unclear | deepsec scan + process --limit 50, then approve before full process | no-sus-code-doctor |
| AI-generated, inherited, or vibe-coded repo | vibe-code-doctor | follow delegated react-doctor / deepsec / test findings | no-sus-code-doctor |
| Day-0, adversarial, CTF-style, sandbox, or exploit-prone subsystem | security-threat-model | deepsec, then bugs on the highest-risk files | no-sus-code-doctor |
| Skill/tool import, plugin install, or untrusted agent capability | skill-auditor | inspect source, install count, provenance, and lockfile changes | no-sus-code-doctor if code/config changed |
For serious runs, verify current package versions:
npm view react-doctor version dist-tags --json
npm view deepsec version dist-tags --jsonRecord the versions in the output. If the version differs from the wiki tool page, update the page in the same closeout.
react-doctor. · Repo-wide security risk -> deepsec scan, then process --limit 50. · Architecture/trust-boundary uncertainty -> security-threat-model. · Language/framework secure defaults -> security-best-practices. · Exploit hunting -> bugs, focused on files surfaced by the prior passes.no-sus-code-doctor after fixes as the final reviewer-facing quality gate.Return: