SECURITY / trailofbits
C and C++ Security Review
Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger.
“Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services”
01 / THE REASONING
Why this made the selection.
- The declared tools are Workflow, AskUserQuestion, Bash, and Read, and the assemble step is a local Python script run with uv.
- Kernel drivers, bare-metal code without libc, and managed languages are named as out of scope before the workflow starts.
- The definition separates reviewer findings from coverage-gate acceptance and explicitly disables the FP judge.
- Review user-space C/C++ with a stated remote or local threat model
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/c-review/skills/c-review/SKILL.md
- plugins/c-review/scripts/assemble_findings.py
- LICENSE
- README.md
Our findings
- Frontmatter allows Workflow, AskUserQuestion, Bash, and Read. Assembly is `uv run` of a local script, not a network API.
- The skill says it is not for kernel modules, managed languages, or bare-metal code with no libc.
- If uv is missing it says to stop. The assembler raises if the run directory does not exist, and this review did not start that workflow.
- The definition separates reviewer findings from coverage-gate acceptance and explicitly disables the FP judge.
- The assembler header distinguishes exit 0 accepted, exit 1 artifacts written but unverified, and exit 2 no artifacts; part-file field validation and unrecognized-part handling were inspected.
Not established by this review
- The resource was not executed and its tools were not called.
- The C review workflow and assemble_findings.py were not executed.
- No skill execution, authenticated service operation, or outcome benchmark was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
- Check out trailofbits/skills at 8e54050ae63c2f62224c35b1616efe71865b4777 and install the complete c-review plugin through the publisher-supported host workflow, retaining sibling agents, workflows, scripts and references.
- Choose finding scope separately from read-only context roots; resolve the plugin root and uv before starting.
- Read artifact-presence, gateAccepted and failed-unit fields before describing completion.
Before you start
- Workflow-capable plugin host
- uv and Python 3.11+
- Authorized local native C/C++ source
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Pinned skill definition ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/skills/c-review/SKILL.md
Supports: summary, whySelected, bestFor, limitations, install, access, review
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: install
- CC-BY-SA-4.0 licence ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: license
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/scripts/assemble_findings.py
Supports: review, limitations, access, install