--- title: "C and C++ Security Review: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-c-review/ description: "Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger." --- # C and C++ Security Review: review, setup & limitations · Undominated.ai > Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger. [← Explore all skills](/skills/) SECURITY / trailofbits # C and C++ Security Review Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/skills/c-review) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher trailofbits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services” [trailofbits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/skills/c-review/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The declared tools are Workflow, AskUserQuestion, Bash, and Read, and the assemble step is a local Python script run with uv. - Kernel drivers, bare-metal code without libc, and managed languages are named as out of scope before the workflow starts. - The definition separates reviewer findings from coverage-gate acceptance and explicitly disables the FP judge. - Review user-space C/C++ with a stated remote or local threat model ### A good fit for - A C or C++ review that should stop rather than guess a missing path or a missing uv binary. - Merging workflow findings only when the run directory exists on disk. - Review user-space C/C++ with a stated remote or local threat model - Read finding JSON, Markdown, SARIF and ledger coverage together ### Weigh up before choosing - Bash can still write files even though Write is not listed. The skill does not itself compile or execute the program under review as a test. - assemble_findings.py refuses a run directory that is not there. It is not a remote scanning service. - This review did not execute the resource. - The documented workflow requires the host Workflow capability and the complete plugin; a standalone SKILL.md is insufficient. - This configuration has no independent false-positive judge; reviewer severity and judgeRan=false must stay visible. - A written report can coexist with a rejected or unavailable ledger gate. Missing coverage and failed groups are not clean findings. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/c-review/skills/c-review/SKILL.md - plugins/c-review/scripts/assemble_findings.py - LICENSE - README.md ### Our findings - Frontmatter allows Workflow, AskUserQuestion, Bash, and Read. Assembly is `uv run` of a local script, not a network API. - The skill says it is not for kernel modules, managed languages, or bare-metal code with no libc. - If uv is missing it says to stop. The assembler raises if the run directory does not exist, and this review did not start that workflow. - The definition separates reviewer findings from coverage-gate acceptance and explicitly disables the FP judge. - The assembler header distinguishes exit 0 accepted, exit 1 artifacts written but unverified, and exit 2 no artifacts; part-file field validation and unrecognized-part handling were inspected. ### Not established by this review - The resource was not executed and its tools were not called. - The C review workflow and assemble_findings.py were not executed. - No skill execution, authenticated service operation, or outcome benchmark was performed. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) - Check out trailofbits/skills at 8e54050ae63c2f62224c35b1616efe71865b4777 and install the complete c-review plugin through the publisher-supported host workflow, retaining sibling agents, workflows, scripts and references. - Choose finding scope separately from read-only context roots; resolve the plugin root and uv before starting. - Read artifact-presence, gateAccepted and failed-unit fields before describing completion. ### Before you start - Workflow-capable plugin host - uv and Python 3.11+ - Authorized local native C/C++ source ### Compatibility A supported full-plugin host; Workflow orchestration requires the Workflow capability named in the definition ### Local instructions; runtime access depends on the workflow - Read target and context source; execute local Python analysis helpers and model workers; write run artifacts. ### Cost model Instructions are free; agent usage and separately licensed tools can incur charges. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Pinned skill definition ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/skills/c-review/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/skills/c-review/SKILL.md Supports: summary, whySelected, bestFor, limitations, install, access, review - [Publisher repository and installation guidance ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: install - [CC-BY-SA-4.0 licence ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: license - [plugins/c-review/scripts/assemble_findings.py ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/scripts/assemble_findings.py) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/c-review/scripts/assemble_findings.py Supports: review, limitations, access, install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Burp Project Parser ↗ Extract and search captured Burp traffic while distinguishing empty results from parser startup failures.](/skills/trailofbits-burpsuite-project-parser/)[### DWARF Debug Information ↗ Inspect DWARF symbols, types, line tables and address mappings using tool-specific commands.](/skills/trailofbits-dwarf-expert/)[### Security Audit Preparation ↗ Prepare a frozen, buildable codebase and evidence package for an external security review.](/skills/trailofbits-audit-prep-assistant/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)