c-review

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, code-quality, debugging, developer-tools, security.

What it does

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill c-review

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/c-review/skills/c-review ~/.claude/skills/c-review

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a local C/C++ review orchestrator: it resolves parameters, runs a multi-agent workflow, and writes review artifacts into a timestamped results directory. The main risks are delegated code execution through shipped workflow scripts, plus limited opacity because the substantive logic lives outside the markdown file.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly calls `Workflow({ scriptPath: "<plugin_root>/workflows/c-review.js", ... })` and later `uv run --no-project <plugin_root>/scripts/assemble_findings.py ...`, so it drives local shell/script execution.
Network access	0 (none)	No downloads, uploads, or remote-host calls are described; the documented operations are local workflow, filesystem, and report assembly steps.
Filesystem reach	2 (moderate)	Phase 1 reads from `$HOME/.claude` to locate a cached copy, and it creates `$(pwd)/.c-review-results/...` plus report artifacts in the working tree.
Secrets & credentials	1 (low)	It does not request credentials, but it does access a home dot-directory (`$HOME/.claude`) that may contain user-specific state or cached session material.
Privilege & persistence	0 (none)	There is no `sudo`, service registration, shell startup modification, or other OS-wide privilege change in `SKILL.md`.
Instruction hijack surface	2 (moderate)	The prompt tells the agent to proceed automatically — `"call Workflow without asking again"` — and to `"Do not shrink the fan-out"`, which bypasses normal confirmation/discretion.
Irreversible actions	1 (low)	It autonomously fans out a review workflow, but it does not push, publish, send messages, book, pay, or delete anything.
Transparency	1 (low)	Substantial behavior is delegated to uninspected files (`workflows/c-review.js`, `enumerate_units.py`, `assemble_findings.py`) that are referenced but not shown in the reviewed source.

Before installing

Inspect `workflows/c-review.js` and `scripts/assemble_findings.py` in the installed plugin; they define the real side effects.
Confirm you are okay with the skill reading `$HOME/.claude` and creating `.c-review-results/` in the current repo.
Try it first in a scratch checkout if you do not want review artifacts mixed into your working tree.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/c-review/skills/c-review/SKILL.md
Branch: main
Collection: c-review
Updated: 2026-09-19

rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
differential-review — Performs security-focused differential review of code changes.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.