You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add <Severity_Scale> (CRITICAL/MAJOR/MINOR/ENHANCEMENT) and
<Severity_Calibration_Examples> with 3 React-specific scenarios:
stale closure downgrade, re-render context upgrade, race condition hold.
No eval delta — additive change.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: .claude/agents/react-critic.md
+28Lines changed: 28 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,6 +29,34 @@ Process:
29
29
If you cannot demonstrate a concrete exploit path accessible to non-admin/non-privileged users, tag the finding as `[UNCONFIRMED]` and move it to Open Questions. Do NOT leave unconfirmed security findings in scored sections.
30
30
9. Produce a calibrated verdict, and state if adversarial escalation was triggered.
31
31
32
+
<Severity_Scale>
33
+
- CRITICAL: Blocks functionality, causes data loss, or creates security vulnerability. Architectural fix required.
- MINOR: Suboptimal but functional. Better patterns exist but current approach works.
36
+
- ENHANCEMENT: Best practice not followed but no functional impact.
37
+
</Severity_Scale>
38
+
39
+
<Severity_Calibration_Examples>
40
+
Example 1 — Downgrade:
41
+
Initial: CRITICAL — "useEffect missing dependency causes stale closure"
42
+
After Realist Check: MAJOR
43
+
Mitigated by: The stale value is a configuration constant that only changes on page reload. Users will never encounter the stale value during normal interaction.
44
+
Evidence: `useSettings.ts:12` — `config.apiUrl` is set once at mount and never updates.
45
+
Rationale: Technically incorrect dependency array, but no user-visible bug. Fix is still needed for correctness, but this isn't blocking functionality.
46
+
47
+
Example 2 — Upgrade:
48
+
Initial: MINOR — "Component re-renders on every parent render"
49
+
After Realist Check: MAJOR
50
+
Evidence: Component is rendered inside a virtualized list of 10,000 items. Each parent render triggers 10,000 child re-renders. Measured: 340ms render time, exceeding 16ms frame budget by 21x.
51
+
Rationale: In isolation this is minor, but in context of the list it causes visible jank on every keystroke in the search filter.
52
+
53
+
Example 3 — Holds:
54
+
Initial: CRITICAL — "Race condition between concurrent API calls overwrites form state"
55
+
After Realist Check: Still CRITICAL
56
+
Evidence: `useFormSubmit.ts:34` — No abort controller, no request deduplication. Double-clicking submit sends two requests; second response overwrites first, potentially saving partial data.
57
+
Rationale: Data loss scenario reachable through normal user interaction (double-click). No compensating control.
0 commit comments