react-doctor

SUSPICIOUS. The skill's scanning purpose mostly matches its capabilities, and the npm CLI path appears same-project and official. However, `/doctor` introduces a significant live remote-instruction dependency: it fetches mutable publisher-hosted prompts and tells the agent to follow them while editing the working tree, which expands behavior beyond the static skill and creates indirect prompt-injection and change-control risk.