react-native-best-practices
No security findings. Scanned 1 time, most recently 2026-02-01.
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Provides React Native performance optimization guidelines for FPS, TTI, bundle size, memory leaks, re-renders, and animations. Applies to tasks involving Hermes optimization, JS thread blocking, bridge overhead, FlashList, native modules, or debugging jank and frame drops.
- Package
- 42 files, 6.3 MB
- SKILL.md
- 879 words, 12+ sections
- Code
- None. Instructions only.
- License
- MIT
SKILL.md covers: React Native Best Practices · Overview · Skill Format · When to Apply · Priority-Ordered Guidelines · Quick Reference · Critical: FPS & Re-renders · Open React Native DevTools · Press 'j' in Metro, or shake device → "Open DevTools" · Critical: Bundle Size · High: TTI Optimization · High: Native Performance
Findings
No findings. SAFE
What is in the package
42 files, 6.3 MB. Show the list.
| File | Kind | Size |
|---|---|---|
POWER.md | doc | 6.0 KB |
SKILL.md | doc | 6.7 KB |
references/bundle-analyze-app.md | doc | 5.2 KB |
references/bundle-analyze-js.md | doc | 6.3 KB |
references/bundle-barrel-exports.md | doc | 4.9 KB |
references/bundle-code-splitting.md | doc | 4.9 KB |
references/bundle-hermes-mmap.md | doc | 3.8 KB |
references/bundle-library-size.md | doc | 4.2 KB |
references/bundle-native-assets.md | doc | 4.3 KB |
references/bundle-r8-android.md | doc | 4.5 KB |
references/bundle-tree-shaking.md | doc | 5.4 KB |
references/js-animations-reanimated.md | doc | 8.4 KB |
references/js-atomic-state.md | doc | 5.9 KB |
references/js-concurrent-react.md | doc | 6.2 KB |
references/js-lists-flatlist-flashlist.md | doc | 5.0 KB |
references/js-measure-fps.md | doc | 4.7 KB |
references/js-memory-leaks.md | doc | 5.1 KB |
references/js-profile-react.md | doc | 4.7 KB |
references/js-react-compiler.md | doc | 8.8 KB |
references/js-uncontrolled-components.md | doc | 5.0 KB |
references/native-android-16kb-alignment.md | doc | 3.4 KB |
references/native-measure-tti.md | doc | 6.7 KB |
references/native-memory-leaks.md | doc | 5.5 KB |
references/native-memory-patterns.md | doc | 6.2 KB |
references/native-platform-setup.md | doc | 5.1 KB |
references/native-profiling.md | doc | 4.7 KB |
references/native-sdks-over-polyfills.md | doc | 5.4 KB |
references/native-threading-model.md | doc | 5.6 KB |
references/native-turbo-modules.md | doc | 6.4 KB |
references/native-view-flattening.md | doc | 5.0 KB |
references/images/bundle-treemap-source-map-explorer.png | image | 652 KB |
references/images/controlled-textinput-pingpong.png | image | 124 KB |
references/images/devtools-flamegraph.png | image | 508 KB |
references/images/emerge-xray-ios.png | image | 429 KB |
references/images/expo-atlas-treemap.png | image | 604 KB |
references/images/flashlight-flatlist-vs-flashlist.png | image | 306 KB |
references/images/fps-drop-graph.png | image | 149 KB |
references/images/memory-heap-snapshot.png | image | 301 KB |
references/images/tti-warm-start-diagram.png | image | 124 KB |
references/images/view-hierarchy-flattening.png | image | 2.5 MB |
references/images/xcode-instruments-templates.png | image | 399 KB |
references/images/xcode-thread-view.png | image | 174 KB |
External hosts referenced
bundlephobia.com developer.android.com get.flashlight.dev my-cdn.com cs.android.com docs.expo.dev github.com pkg-size.dev playground.react.dev re-pack.dev react.dev ui.perfetto.dev zephyr-cloud.io
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 0036df26a1a1. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/callstackincubator/agent-skills
- Raw scan result: react-native-best-practices-scan.json
- Badge for your README:
- Request a re-scan