security-doctor-chain

Orchestrate Kevin's security/pre-ship doctor chain across React Security Doctor, deepsec, threat modeling, secure-coding review, adversarial bug hunts, vibe-code-doctor, and no-sus-code-doctor. Use when Kevin asks to string together doctors/tools, run a security doctor chain, run deepsec plus React Security Doctor, harden a production app, or decide which security doctors should gate a repo.

Category
Engineering
Skill
142 of 261
Source
Kevin wiki

Use this skill as the selector and runbook for security-sensitive pre-ship work. It does not replace the underlying doctors; it decides which ones to run, in which order, and what evidence is required before saying the repo is safer.

Hard Rules

  • Read each selected underlying SKILL.md before running that doctor.
  • Never run a full deepsec process without Kevin approving the projected cost. A --limit 50 calibration is allowed and expected.
  • Run broad, subsystem-specific scanners before final PR review. Use no-sus-code-doctor as the last gate, not as a substitute for deep scanning.
  • If a selected tool is unavailable, record the failure, run the closest manual fallback, and leave a clear residual-risk note.

Intake

Before choosing the chain:

  1. Identify the repo root, package manager, app/package root, and changed paths.
  2. Classify the risk surface: · React UI: components, routes, forms, auth/session UI, admin UI, HTML sinks. · Backend/service: APIs, server actions, auth, permissions, data access, secrets, webhooks, queues, multi-tenant boundaries, payments. · Inherited/AI-generated codebase: unclear ownership, broad generated code, user says "vibe-coded" or "production-ready". · Security-critical subsystem: sandboxing, signing, crypto, isolation, policy, permissions, arbitrary user input, file/network access. · PR closeout: user asks for "no sus", "score to 100", or merge readiness.
  3. Name what would be unacceptable to miss: XSS, auth bypass, data leak, RCE, SSRF, privilege escalation, secret exposure, supply-chain drift, or broken rollback path.

Chain Selection

Surface or requestRun firstThenFinal gate
React, Next.js, Vite, or React Native UIreact-doctor with React Security Doctor moderepo tests and browser proof for changed behaviorno-sus-code-doctor
Auth/session UI, admin UI, user input, URL handling, dangerouslySetInnerHTML, client secretsreact-doctor security modesecurity-best-practices for the frameworkno-sus-code-doctor
Backend API, service, webhook, data layer, secrets, permissions, or multi-tenant codesecurity-threat-model if boundaries are uncleardeepsec scan + process --limit 50, then approve before full processno-sus-code-doctor
AI-generated, inherited, or vibe-coded repovibe-code-doctorfollow delegated react-doctor / deepsec / test findingsno-sus-code-doctor
Day-0, adversarial, CTF-style, sandbox, or exploit-prone subsystemsecurity-threat-modeldeepsec, then bugs on the highest-risk filesno-sus-code-doctor
Skill/tool import, plugin install, or untrusted agent capabilityskill-auditorinspect source, install count, provenance, and lockfile changesno-sus-code-doctor if code/config changed

Version Checks

For serious runs, verify current package versions:

npm view react-doctor version dist-tags --json
npm view deepsec version dist-tags --json

Record the versions in the output. If the version differs from the wiki tool page, update the page in the same closeout.

Execution Pattern

  1. State the selected chain and skipped doctors with reasons.
  2. Run deterministic local checks first when they are cheap: typecheck, lint, unit tests, or existing repo doctor.
  3. Run subsystem doctors: · React/UI risk -> react-doctor. · Repo-wide security risk -> deepsec scan, then process --limit 50. · Architecture/trust-boundary uncertainty -> security-threat-model. · Language/framework secure defaults -> security-best-practices. · Exploit hunting -> bugs, focused on files surfaced by the prior passes.
  4. Fix or report critical findings before continuing. Do not bury blockers in a summary.
  5. Run no-sus-code-doctor after fixes as the final reviewer-facing quality gate.

Output

Return:

  • selected chain and why
  • versions checked
  • commands run and exit status
  • doctor scores or finding counts
  • findings fixed, findings deferred, and residual risk
  • proof commands after fixes
  • any wiki/tool/skill updates made because routing or versioning changed