React Router Action Contract Review

React Router Action Contract Review is a skill for Claude Code from s977043/river-review. It costs 41 tokens per session (971 once invoked), scanned A, original, MIT.

A review rule for React Router v7 form actions and error boundaries. It checks how validation failures, successful submissions, and route errors are returned or displayed.

In plain words
What is it for?
It reviews action or clientAction changes, checking for 4xx validation responses, redirects after success, and the expected three-way ErrorBoundary handling.
Why use it?
It prevents validation errors from reaching the wrong error screen, successful forms from being submitted again, and failed responses from incorrectly using a successful 2xx status.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the river-review plugin — 138 skills, 18 commands, 5 agents, 3 hooks shipped together

Good fit It reviews action or clientAction changes, checking for 4xx validation responses, redirects after success, and the expected three-way ErrorBoundary handling.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/s977043/river-review/react-router-action-contract
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add s977043/river-review --skill react-router-action-contract
Clone the repo
git clone --depth 1 https://github.com/s977043/river-review

Made for: Claude Code.

Or install river-review, the plugin that ships this one along with the rest of its 138 skills, 18 commands, 5 agents, 3 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for React Router Action Contract Review

README.md
[![agentmods](https://agentmods.dev/badge/skills/s977043/river-review/react-router-action-contract/github.svg)](https://agentmods.dev/skills/s977043/river-review/react-router-action-contract)
Your own site
<a href="https://agentmods.dev/skills/s977043/river-review/react-router-action-contract"><img src="https://agentmods.dev/badge/skills/s977043/river-review/react-router-action-contract/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for React Router Action Contract Review

Your own site · 80×15
<a href="https://agentmods.dev/skills/s977043/river-review/react-router-action-contract"><img src="https://agentmods.dev/badge/skills/s977043/river-review/react-router-action-contract.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 41 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 971 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00041 $0.00971
Opus 5 $0.00020 $0.00485
Sonnet 5 $0.00008 $0.00194
Haiku 4.5 $0.00004 $0.00097

Measured 5d ago against content hash 9dfb34cf9021, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

React Router Action Contract Review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/midstream/react-router-action-contract/SKILL.md · 74 lines

What it actually says

Pattern declaration

Primary pattern: Reviewer Secondary patterns: Inversion Why: action のエラー契約と ErrorBoundary 分岐をチェックリスト型で検査する

Goal / 目的

  • バリデーション失敗が ErrorBoundary へ throw され、フォームのインラインエラー表示と自動 revalidation の制御が壊れるのを防ぐ。
  • action 成功時の redirect() 欠落による再送信問題、エラー返却時のステータス不備(2xx のまま)を検出する。

Non-goals / 扱わないこと

  • loader / data loading の規約(react-router-loader-boundary のスコープ)。
  • Form と fetcher のどちらを使うべきかの UX 判断(要件依存のため一律指摘しない。質問に留める)。
  • バリデーションライブラリの選定。

Pre-execution Gate / 実行前ゲート

このスキルは以下の条件がすべて満たされない限りNO_REVIEWを返す。

  • 差分に action / clientAction の追加・変更、または ErrorBoundary の変更が含まれている
  • diff コンテキストが利用可能である

ゲート不成立時の出力: NO_REVIEW: react-router-action-contract — action / ErrorBoundary の変更なし

False-positive guards / 抑制条件

  • throw data("Not Found", { status: 404 }) 等、リソース不在・認可エラーの 意図的な throw は公式に許可された規約であり指摘しない(バリデーション失敗の throw と区別する)。
  • React Router 管理外の外部 API へ直接 POST する設計が要件上正当な場合は指摘しない。
  • 成功時に同一ページへ結果を表示する設計(redirect しない)が意図的な場合は質問に留める。

Rule / ルール

  • 期待されるバリデーション失敗は return data({ errors }, { status: 400 }) で返す(throw しない。2xx のままだと不要な revalidation が走る点も確認)。
  • 成功時は redirect() で再送信問題を防ぐ。
  • ErrorBoundary は isRouteErrorResponse(error) / error instanceof Error / その他 の 3 分岐で処理し、error.message への直接アクセスを避ける。
  • 独立して失敗してよい UI 単位にはルート単位の ErrorBoundary を検討する(root のみでも最低限は満たすため、強制はしない)。

Evidence / 根拠の取り方

  • 指摘は <file>:<line> で差分に紐づけ、公式規約(form-validation / error-boundary)を 1 行で添える。

Output / 出力(短文版の推奨)

コメントは日本語で返す。

  • Finding: どの契約に反しているか(1文)
  • Impact: インラインエラー不能 / 再送信 / 不要 revalidation 等
  • Fix: data({errors}, {status: 400}) / redirect() / 3 分岐の最小修正案

Sources / 出典

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 74 lines · 41 tokens per session scan A 9dfb34cf9021

Subscribe to this mod's changes

React Router Action Contract Review is a skill published in the GitHub repository s977043/river-review (3 stars, last pushed yesterday), licensed MIT. It adds 41 tokens to every session and 971 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

component-api-validator

Audit component APIs for consistency, breaking changes, TypeScript coverage, and contract compliance across a component library. Trigger when someone says: component prop review, verify component types are exported, component API audit, check our component interfaces, are our props consistent, API consistency check…

murphytrueman/design-system-ops · 83 tokens

tailwind-css

Tailwind CSS v4 patterns: CSS-first config, utility classes, component variants, v3 migration. Use when styling with Tailwind, configuring @theme tokens, using tailwind-variants/CVA, migrating v3 to v4, or fixing Tailwind styles and dark mode.

iliaal/whetstone · 61 tokens

testing-react

Writes React/TypeScript tests using Vitest and React Testing Library. Use when "write react tests", "vitest", "component test", "hook test", "RTL", "testing library", "snapshot test", or testing React components, hooks, and utilities.

iliaal/whetstone · 57 tokens

react-effects-audit

Use when auditing React or Next.js components for unnecessary or unsafe useEffect usage -- detects 9 anti-patterns from "You Might Not Need an Effect".

fusengine/agents · 36 tokens

fec-route-protection

A guide for protecting front-end routes, meaning the pages and URLs of a web application, based on whether someone is signed in and what permissions they have. It covers login checks, role-based access, expired sessions, and redirects.

bovinphang/frontend-craft · 67 tokens

fec-state-management

A guide for deciding where an application's changing information should live, such as inside a component, in the URL, in a form, in a browser cache, or in a shared store. A store is a shared place for client-side information used across parts of an app.

bovinphang/frontend-craft · 102 tokens