c-review — Claude Code skill: C/C++ security review
Reviews native C/C++ code for memory bugs, integer overflows and races. Use it when auditing userspace applications, daemons or services.
npx skills add trailofbits/skills --skill c-review -a claude-codeWhat c-review does
This skill runs a C/C++ review through one Workflow call and returns a report. It looks for memory-safety defects, integer overflows, race conditions, type confusion and platform-specific weaknesses.
Before the review, it resolves the threat model, worker model, severity filter and review scope. You can target a subdirectory while retaining read access to surrounding code for callers, build flags and reachability context.
uv must be available on PATH, because the review uses it to enumerate units and assemble findings. The skill is not intended for kernel drivers, managed languages or bare-metal code without libc, so those targets need a different review path.
What it helps with
- find memory-safety defects in C/C++ code
- check arithmetic for integer overflows
- detect races in a userspace service
- limit an audit to a repository subdirectory
- filter findings by severity
Example prompts for the agent
- Run c-review on this repository for a remote attacker.
- Use c-review on
src/only and report high-severity findings. - Audit this service with c-review for races and memory errors.
How to install c-review
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill c-review -a claude-code2Manually: put the files in place
~/.claude/skills/c-review/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/c-review/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill c-review -a codex2Manually: put the files in place
.agents/skills/c-review/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill c-review -a cursor2Manually: put the files in place
.cursor/skills/c-review/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills c-review2Manually: put the files in place
.github/skills/c-review/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill c-review -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/c-review/skills/c-reviewManually: put the files in place
.devin/skills/c-review/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill c-review -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about c-review
How do I install c-review in Claude Code?
Run npx skills add trailofbits/skills --skill c-review -a claude-code, then run npx skills add trailofbits/skills --skill c-review -a claude-code again.
What does c-review do?
It orchestrates a security review of native C/C++ code. The review covers memory issues, integer overflows, races, type confusion and platform-specific vulnerabilities.
What does c-review need to run?
uv must be on PATH. The skill also resolves the threat model, review scope and severity filter before starting the workflow.
