What is codemod-react-pipeline?

A scripted workflow for applying JSX, TSX, and React codemods across large legacy codebases. A codemod is an automated source-code transformation; this workflow checks its findings and validates each batch before broad application.

Use it to scaffold, dry-run, validate, and apply an idempotent transformation across many files with incremental commits and build, type, and test checks.

It reduces the risk of breaking a large React or TypeScript project during renames, API migrations, import changes, or hook updates.

codemod-react-pipeline — Skill for Claude Code by pproenca

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add pproenca/dot-skills --skill codemod-react-pipeline

Clone the repo

git clone --depth 1 https://github.com/pproenca/dot-skills

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/pproenca/dot-skills/codemod-react-pipeline/github.svg)](https://agentmods.dev/skills/pproenca/dot-skills/codemod-react-pipeline)

Your own site

<a href="https://agentmods.dev/skills/pproenca/dot-skills/codemod-react-pipeline"><img src="https://agentmods.dev/badge/skills/pproenca/dot-skills/codemod-react-pipeline/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/pproenca/dot-skills/codemod-react-pipeline"><img src="https://agentmods.dev/badge/skills/pproenca/dot-skills/codemod-react-pipeline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 143 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,736 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 54
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00143	$0.01736
Opus 5	$0.00072	$0.00868
Sonnet 5	$0.00029	$0.00347
Haiku 4.5	$0.00014	$0.00174

Measured 5d ago against content hash fdea6ae7a3be, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

codemod-react-pipeline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

The scan reads SKILL.md. This mod also ships 10 executable files (scripts/00-plan.sh, scripts/01-scaffold.sh, scripts/02-inner-loop.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/.experimental/codemod-react-pipeline/SKILL.md · 110 lines

How it starts

The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Codemod React Pipeline

A safe, repeatable workflow for applying JSX / TSX / React codemods to large legacy codebases — from a 50-file rename to a 100k-file API migration. It composes the Codemod CLI (JSSG, ast-grep, workflows) into an inner/outer loop and gates every mass change behind a dry-run plus validation. For the why behind each rule it cites, see the sibling codemod best-practices reference.

When to Apply

Use this skill when:

You're migrating a pattern across a large React/TS codebase (component/prop rename, deprecated API, import swap, hook migration) and a hand-run codemod jssg run ./t.ts ./src is too risky.
You need the change to land incrementally and reviewably — per-batch commits, resumable on failure, with the build/typecheck/tests green at every checkpoint.
You want to see and validate the findings (what would change, and whether it's safe) before touching files at scale.
The transform must be idempotent and proven so before mass apply.

Don't use it for a one-file edit, or a change better done by hand in a single PR.

Workflow Overview

00 plan ─▶ 01 scaffold ─▶ 02 inner loop ─▶ 03 dry-run ─▶ 04 validate ─▶ 05 batched apply ─▶ 06 verify
   goal       templates      fixture tests     preview       gates          per-batch            final
   + blast    (transform/    + 1-file trial    + findings     (idempotency,  apply+verify+commit  assertions
   radius     rule/wf/tests)                    report        type/lint/test) (resumable)
                                                  │                                  │
                                                  └── sentinel ──── required by ──────┘
                              (on any failure: working tree reverted; fix and re-run — nothing committed yet)

Step	Action	Tool / Script	Risk
0	Capture goal, classify transform, count blast radius	`scripts/00-plan.sh`	read-only
1	Scaffold transform + fixtures + workflow from templates	`scripts/01-scaffold.sh`	write (new files)
2	Fixture tests + single-file trial run (auto-reverted)	`scripts/02-inner-loop.sh`	read-only (reverts)
3	Preview changes; write findings report + dry-run sentinel	`scripts/03-dry-run.sh`	read-only (reverts)
4	Gate: idempotency, typecheck, lint, format, tests	`scripts/04-validate-findings.sh`	read-only (reverts)
5	Apply in resumable batches, verify + commit each	`scripts/05-run-batched.sh`	destructive (commits)
6	Final assertions over the whole migration	`scripts/verify.sh`	read-only

Read the full file on GitHub · 110 lines

Files

What ships with it

24 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 110 lines · 143 tokens per session scan A fdea6ae7a3be

Subscribe to this mod's changes

codemod-react-pipeline is a skill published in the GitHub repository pproenca/dot-skills (205 stars, last pushed 24d ago), licensed MIT. It adds 143 tokens to every session and 1,736 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Frontend React Testing

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens

next-dev-loop

Verify Next.js runtime behavior after editing app code. Use this skill to confirm a change actually works in a running app — not just that it compiles or type-checks. Combines /next/mcp (Next.js's view) with agent-browser (the browser's view). Requires a running next dev.

vercel/next.js · 68 tokens

compiler-commit

Use when you want to verify compiler changes and commit with the correct convention. Runs tests, lint, and format, then commits with the [compiler] or [rust-compiler] prefix.

react/react · 42 tokens

compiler-port

Port a compiler pass from TypeScript to Rust. Gathers context, plans the port, implements in a subagent with test-fix loop, then reviews.

react/react · 35 tokens

compiler-verify

Use when you need to run all compiler checks (tests, lint, format) before committing. Detects whether TS or Rust code changed and runs the appropriate checks.

react/react · 37 tokens

shipwright-pipeline

Autonomous app builder that converts plain-English descriptions into fully built, tested applications. Use when the user wants to build a new app, scaffold a project, generate a full-stack application, or create an app from a description. Trigger with "build me an app", "create a new app", "shipwright build"…

jeremylongshore/tons-of-skills-marketplace · 80 tokens