React Router Code Review

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:19 AM UTC
• Version: 1.1.1

Overview

This React Router review skill is mostly instructional, but it requires an unreviewed sibling skill to control part of its review process.

Review or pin the referenced review-verification-protocol skill before installing. Treat the React Router guidance as advisory, and be careful with the error-logging examples so production apps do not send sensitive error details to analytics or monitoring services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62
• Finding: Mandatory Unpinned External Skill Dependency## Vulnerability Details **File Location**: `SKILL.md:62-64` **Vulnerability Type**: Unverified external instruction dependency **Risk Level**: Medium ### Vulnerable Code ```md ### Gate 4 — Verification protocol Load and follow [review-verification-protocol](../review-verification-protocol/SKILL.md). **Pass when:** Its pre-report checklist (and any issue-type subsection that applies) is complete for each finding you will output. ``` ### Technical Analysis The Skill requires the Agent to load and follow another `SKILL.md` located outside the audited package. The referenced file is not included in the project, and the dependency is not version-pinned or protected by an integrity check. As a result, the reviewed files do not fully define the Skill's effective instructions. Any party able to create or modify the sibling `../review-verification-protocol/SKILL.md` file can change the protocol after this Skill has been reviewed. Because loading that file is presented as a mandatory gate, its instructions may influence which findings are reported and how the Agent behaves. This is an insecure supply-chain boundary rather than evidence that the current package is itself malicious. ### Attack Path 1. An attacker obtains write access to the parent package directory or controls installation of the sibling `review-verification-protocol` package. 2. The attacker creates or modifies `../review-verification-protocol/SKILL.md`. 3. A user invokes this React Router review Skill. 4. Gate 4 directs the Agent to load and follow the attacker-controlled sibling file. 5. The external instructions may suppress findings, manipulate review output, or request access unrelated to the legitimate review. 6. The malicious content can subsequently change without any modification to the audited package. ### Impact Assessment Exploitation does not directly grant operating-system privileges. Its scope is the Agent session and any tools or data al ...[truncated 337 chars]
• Remediation: ## Remediation Suggestions 1. Include the verification protocol inside the reviewed Skill package and reference it with an in-package path. 2. If an external protocol is unavoidable, pin it to an immutable version and verify its cryptographic hash before use. 3. Treat externally loaded Skill text as untrusted input rather than automatically authoritative instructions. 4. Document the dependency and include it in the same security-review scope. 5. Fail safely when the expected protocol is missing or fails integrity validation. 6. Prevent external protocol files from expanding tool access, changing safety constraints, or overriding the parent Skill's stated review purpose.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/error-handling.md:375
• Finding: Recommended Error Telemetry May Expose Sensitive Data## Vulnerability Details **File Location**: `references/error-handling.md:375-433` **Vulnerability Type**: Unsanitized transmission of error details to monitoring and analytics services **Risk Level**: Medium ### Vulnerable Code ```tsx ### 6. Not Logging Errors **Problem**: No visibility into production errors, hard to debug. // GOOD - Errors logged to monitoring service function ErrorBoundary() { const error = useRouteError(); React.useEffect(() => { // Log to error tracking service if (isRouteErrorResponse(error)) { logError({ type: 'RouteError', status: error.status, statusText: error.statusText, data: error.data, }); } else if (error instanceof Error) { logError({ type: 'JavaScriptError', message: error.message, stack: error.stack, }); } else { logError({ type: 'UnknownError', error: String(error), }); } }, [error]); return <ErrorDisplay error={error} />; } // BETTER - Centralized error logging function useErrorLogging(error: unknown) { React.useEffect(() => { // Don't log in development if (import.meta.env.DEV) return; // Send to monitoring service (Sentry, etc.) if (isRouteErrorResponse(error)) { window.analytics?.track('Route Error', { status: error.status, statusText: error.statusText, path: window.location.pathname, }); } else if (error instanceof Error) { window.analytics?.track('JavaScript Error', { message: error.message, stack: error.stack, path: window.location.pathname, }); } }, [error]); } ``` ### Technical Analysis The reference recommends forwarding raw route-response data, exception messages, stack traces, and application paths to unspecified monitoring or analytics services. It doe ...[truncated 1954 chars]
• Remediation: ## Remediation Suggestions 1. Replace raw error serialization with a strict allowlist of non-sensitive fields, such as an internal event identifier and normalized error category. 2. Redact credentials, session identifiers, authorization headers, cookies, personal information, query parameters, and request or response bodies. 3. Do not transmit production stack traces to general-purpose analytics platforms; use a restricted error-monitoring service with appropriate access controls. 4. Validate and explicitly configure telemetry destinations rather than relying on an unspecified global logger. 5. Remove query strings and sensitive path segments before recording URLs. 6. Apply environment, consent, regional-processing, retention, and deletion controls. 7. Add automated tests using canary secrets to verify that the telemetry pipeline performs redaction. 8. Document that user-controlled exception text must not be treated as safe telemetry.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Empty errorElement at route level** - Route may intentionally rely on parent error boundary
- **Form without action prop** - Posts to current URL by convention; explicit action is optional
- **loader returning null** - Valid when data may not exist; null is a legitimate loader return value
- **Using fetcher.data without checking fetcher.state** - May be intentional when stale data is acceptable during revalidation

## Context-Sensitive Rules

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}
```

### 6. Blocking Navigation Without Confirmation

**Problem**: Lost unsaved changes, data loss.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Problem**: Lost unsaved changes, data loss.

```tsx
// BAD - No confirmation on navigation
function EditUser() {
  const [formData, setFormData] = useState({});
  const [isDirty, setIsDirty] = useState(false);

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.