react-doctor

SUSPICIOUS. The core React scanning purpose aligns with the official react-doctor CLI, and the npm/source relationship appears legitimate. The main concern is the '/doctor' workflow's runtime fetch of mutable remote prompts that become authoritative instructions for local code edits; that creates indirect prompt-injection and change-control risk even without clear credential theft or malware behavior.