c-review

What problem does it solve? Auditing large native C/C++ codebases for memory safety bugs, integer overflows, and race conditions is slow and error-prone when done manually, and single-pass reviews miss entire bug classes. This Skill coordinates a multi-worker, multi-judge pipeline that systematically covers dozens of vulnerability classes and produces deduplicated, severity-rated findings. ## Core Features & Use Cases - Parallel cluster-based review: Spawns multiple worker subagents, each assigned a cluster of bug classes (buffer overflows, use-after-free, integer overflows, races, format strings) selected deterministically from a manifest based on codebase flags (C++, POSIX, Windows) and threat model. - Two-stage judge pipeline: A dedup judge merges duplicate findings by exact location, then an FP/severity judge assigns verdicts (TRUE_POSITIVE through OUT_OF_SCOPE) and threat-model-aware severity ratings. - Machine-readable output: Produces per-finding markdown files with YAML frontmatter, a human-readable REPORT.md, and a SARIF 2.1.0 export for integration with code scanning tools. - Use Case: Point it at a network-facing C daemon, choose a REMOTE threat model and high severity filter, and receive a deduplicated report of remotely exploitable memory corruption bugs with reachability traces and fix recommendations. ## Quick Start Run a security review of this C++ codebase with a remote attacker threat model and report only high severity findings.