cpp-static-analysis

Runs and interprets clang-tidy, scan-build, cppcheck, IWYU, and sanitizer checks for C++ code.

6|2|Updated May 6, 2026
One-click install
npx skills add https://github.com/sek788432/Stock-Back-Test-System --skill cpp-static-analysis-sek788432
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cpp-static-analysis
Source: https://github.com/sek788432/Stock-Back-Test-System/tree/main/.agents/skills/cpp-static-analysis
Command: npx skills add https://github.com/sek788432/Stock-Back-Test-System --skill cpp-static-analysis-sek788432

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? C++ defects like null dereferences, use-after-free, data races, and include hygiene issues are easy to miss in review. This Skill explains how to run the repository's full static-analysis and sanitizer stack locally, interpret each tool's output, and satisfy the merge-blocking quality gates before opening a pull request. ## Core Features & Use Cases - Full analyzer orchestration: Run clang-format, clang-tidy, scan-build, cppcheck, and IWYU across all translation units via RunQuality.sh, with a --fast mode that skips only scan-build. - Sanitizer workflows: Build and test with ASan/UBSan/LSan (dev-sanitize preset) and TSan (dev-tsan preset) matching the CI sanitizer matrix. - Finding interpretation: Guidance for reading clang-tidy diagnostics, scan-build HTML reports, sanitizer stack traces, and IWYU add/remove suggestions, plus rules for narrow NOLINT suppressions. - Use Case: Before pushing a C++ change, run ./RunQuality.sh --base origin/main --head HEAD, fix any clang-tidy or cppcheck findings, and confirm the sanitizer ctest presets pass so CI does not reject the PR. ## Quick Start Ask the assistant to run the full static-analysis and sanitizer checks on your current C++ branch and explain any findings before you open the pull request.

Frequently Asked Questions about cpp-static-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run clang-tidy and cppcheck on a C++ project before a pull request?▼

Run ./RunQuality.sh --base origin/main --head HEAD, which executes clang-format, clang-tidy, scan-build, cppcheck, and IWYU across all project translation units. Use the --fast flag to skip only the whole-tree scan-build pass during iteration.

How do I run AddressSanitizer and ThreadSanitizer with CMake presets?▼

Configure with cmake --preset dev-sanitize for ASan/UBSan/LSan or dev-tsan for TSan, then build and run ctest with the matching preset. These presets mirror the CI sanitizer matrix, and any finding fails the test run.

How do I suppress a clang-tidy warning I disagree with?▼

First prove the code is correct with a test, then suppress at the smallest scope using a per-line // NOLINT(check-name) comment with a reason documented in the PR. Blanket-disabling checks in .clang-tidy requires maintainer approval.

What does a clang static analyzer scan-build report mean?▼

scan-build writes HTML reports under Output/scan-build-reports describing data-flow bugs like null dereferences or leaks. Reproduce the reported execution path before judging it a false positive; suppressions must be narrow and maintainer-approved.

When should I not suppress a sanitizer finding?▼

Never suppress a sanitizer report just to make a gate pass; treat every ASan, UBSan, LSan, or TSan finding as a real defect. No suppression file is wired into the build, and any future mechanism requires a reviewed tooling change.