# c-review

Reviews native C/C++ code for memory bugs, integer overflows and races. Use it when auditing userspace applications, daemons or services.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3700 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/c-review/skills/c-review/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/c-review

## What it does

This skill runs a C/C++ review through one `Workflow` call and returns a report. It looks for memory-safety defects, integer overflows, race conditions, type confusion and platform-specific weaknesses.

Before the review, it resolves the threat model, worker model, severity filter and review scope. You can target a subdirectory while retaining read access to surrounding code for callers, build flags and reachability context.

\`uv` must be available on `PATH`, because the review uses it to enumerate units and assemble findings. The skill is not intended for kernel drivers, managed languages or bare-metal code without libc, so those targets need a different review path.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill c-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/c-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/c-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill c-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/c-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill c-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/c-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills c-review
```

2. **Manually: put the files in place**
- File: `.github/skills/c-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill c-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/c-review/skills/c-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/c-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill c-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/c-review/skills/c-review/SKILL.md

## When to use it
- find memory-safety defects in C/C++ code
- check arithmetic for integer overflows
- detect races in a userspace service
- limit an audit to a repository subdirectory
- filter findings by severity

## Example prompts
- Run c-review on this repository for a remote attacker.
- Use c-review on `src/` only and report high-severity findings.
- Audit this service with c-review for races and memory errors.

## Similar
- [qt-cpp-review](https://affpapa.org/en/nevibecode/skills/qt-cpp-review.md) — skill · 1000 installs
- [chinese_code_review](https://affpapa.org/en/nevibecode/prompts/chinese-code-review.md) — prompt · ★ 44429
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [code-review-excellence](https://affpapa.org/en/nevibecode/skills/code-review-excellence.md) — skill · 30193 installs
- [security-review](https://affpapa.org/en/nevibecode/skills/getsentry-security-review.md) — skill · 21300 installs
- [code-review](https://affpapa.org/en/nevibecode/skills/coderabbitai-code-review.md) — skill · 14800 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md