modern-cpp

An agent skill by trailofbits, from trailofbits/skills. Tags: cli, code-quality, debugging, developer-tools, security.

What it does

Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE with concepts, printf with std::print, error codes with std::expected.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill modern-cpp

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/modern-cpp/skills/modern-cpp ~/.claude/skills/modern-cpp

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only C++ guidance skill: it reads like a style and security playbook and ships no executable code or setup scripts. Its main effect is advisory only, though it can steer a project toward different compiler flags and language features if the user adopts its recommendations.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell commands, scripts, evaluators, or native binaries are shipped; the files are plain Markdown guidance only.
Network access	0 (none)	The skill does not download anything or send data anywhere; it only mentions external references like GitHub, OpenSSF, and Compiler Explorer as citations.
Filesystem reach	0 (none)	There are no paths or commands that read, write, or delete files outside the repository, and no home-dotfile or system-path edits.
Secrets & credentials	0 (none)	It does not ask for tokens, keys, passwords, `.env` files, browser sessions, or other credentials.
Privilege & persistence	0 (none)	No sudo, global installs, services, scheduled tasks, or OS/shell configuration changes are requested.
Instruction hijack surface	0 (none)	The text contains no prompt-injection patterns like instructions to ignore higher-priority rules, hide actions, or fetch and follow remote content.
Irreversible actions	0 (none)	It does not send messages, deploy, publish, pay, book, merge, or delete anything; it only advises on code style and hardening.
Transparency	0 (none)	All shipped files are readable Markdown; there are no binaries, blobs, generated installers, or decoded-at-runtime content.

Before installing

No install-time action is needed; this skill is documentation only.
If you plan to adopt its hardening flags, try them first in a scratch build or CI branch.
Verify your compiler/runtime actually supports the C++20/23/26 features it recommends before applying them broadly.

Rated 2026-10-20 by an automated review of 7 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/modern-cpp/skills/modern-cpp/SKILL.md
Branch: main
Collection: modern-cpp
Updated: 2026-09-19

c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
code-reviewer — Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries.
rust-engineer — Writes, reviews, and debugs idiomatic Rust code with memory safety and zero-cost abstractions.
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.