# C Review

Performs comprehensive C/C++ security review for memory corruption, integer overflows...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Security
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills --skill c-review -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill c-review -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill c-review -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill c-review -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# C/C++ Security Review

Resolve four parameters, make one `Workflow` call, return the report. The workflow owns
concurrency, retries and result collection.

**Use for:** native C/C++ userspace, memory safety, integer overflow, races, type
confusion, Linux/macOS daemons, Windows services.

**Not for:** kernel drivers or modules; managed languages (Java, C#, Python, Go, Rust);
embedded or bare-metal code with no libc.

## Phase 0, Parameters

Parse any free text on the invocation line (`flamenco only`, `high severity only`, `use
haiku`) and pre-fill what it implies. Then make **one** `AskUserQuestion` call for
whatever is still unresolved. Never silently default a required parameter.

| Parameter | Values | Inferring it from the invocation |
|---|---|---|
| `threat_model` | `REMOTE` / `LOCAL_UNPRIVILEGED` / `BOTH` | "remote", "network", "attacker" → `REMOTE`; "local", "unprivileged" → `LOCAL_UNPRIVILEGED`; otherwise ask |
| `worker_model` | `haiku` / `sonnet` / `opus` / `inherit` | An explicit model name. Otherwise ask. `inherit` uses the session model |
| `severity_filter` | `all` / `medium` / `high` | "all", "every", "noisy" → `all`; "medium and above" → `medium`; "high only" → `high`; otherwise ask |
| `scope_subpath` | repo-relative directory, optional | "X only", "just audit X/" → the matching subdirectory, fuzzy-matched against top-level dirs. Absent → `.`. Ambiguous → ask |

Two scopes stay separate for the whole run:

- **`finding_scope_root`** = `scope_subpath` (default `.`), a finding must live inside
  it, and it is the tree the unit list is generated from.
- **`context_roots`** = `.`, read freely to establish callers, build flags and
  reachability. Narrow it to `finding_scope_root` only if the user explicitly forbids
  wider reading, and say that reachability confidence drops when you do.

## Phase 1, Resolve paths

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/c-review/skills/c-review/SKILL.md