C Review

C/C++ security code review. Bug-class knowledge based on the Trail of Bits Testing Handbook.

Invoke with /c-review:c-review. Artifacts land in $(pwd)/.c-review-results/ /.

uv must be on PATH — two phases run Python through it.

How it works

Most review tools split the work by bug type: one agent hunts buffer overflows, another hunts use-after-free, and so on. c-review splits it by place in the source instead.

A parser first cuts the codebase into units — one function, or a slice of a long function, capped at 150 lines. Every line of the tree lands in exactly one unit, and each unit belongs to exactly one agent. That is the coverage claim: not "the agents said they read it", but "a parser assigned it and we can check".

Then each agent works through its units by asking the same fixed set of ten questions of every one:

> bounds at every write · integer width and signedness · allocation/free pairing · > sizeof arithmetic · NUL termination · unchecked return values · what the unit assumes > of its caller · banned APIs · macro contracts · initialisation

A question is only asked where the parser found something for it to be about — no writes in the function, no bounds question. And crucially, the parser counts the relevant spots (the twelve writes, the four malloc calls) and tells the agent the number but not the line numbers. The agent has to read the code to find them.

For each question the agent writes down what it found — the lines it examined and what was at them, whether or not it filed a bug. Those written answers are the coverage record (called the ledger in the code and artifacts). At the end, check_ledger.py re-derives the spots from the source and checks the agent's answers against them. An agent that skipped a function, or claimed "no bugs here" over twelve writes while naming none, fails that check and the run is reported as assembled but unverified.

Two things this buys, both of which a plain "review this code" prompt gives up:

• A bug found does not end the question. A finding is a reason to look harder in that function, not to move on — the record still owes an account of the other eleven writes.
• Coverage is a number you can check, reported as checks satisfied / checks required rather than "functions touched". A function can be touched by every agent while most of its questions go unanswered.

The bug-type catalogue — 56 classes in 18 groups — still exists, in two roles. Review agents get the class names so they can label what they find. Then a sweep phase takes the classes that got no finding anywhere — minus the ones the platform gate, the threat model or Detect's candidate-site check already removed — and sends one agent to look for them across the whole tree, which catches the scattered single-site slips a reader working through a region in order tends to walk past.

Pipeline

/c-review:c-review
└── SKILL.md                    collect parameters, resolve paths, one Workflow call
    └── workflows/c-review.js
        ├── 1. Detect               1 agent
        ├── 2. Review            4-14 agents
        ├── 3. Sweep              0-2 agents
        ├── 4. Dedup              0-1 agent
        └── 5. Assemble             1 agent