A firmware updater that sets CURLOPT_SSL_VERIFYPEER to 0 "because the device clock is wrong" installs whatever a hostile Wi-Fi network sends it. A ping helper that builds "ping -c 1 %s" with snprintf and hands it to system() runs any command typed after a semicolon, and a log call written as printf(msg) lets %n in that message write to memory. This skill finds those and the other C and C++ mistakes below before the code ships, and tells you how to fix each one.

Your agent runs a scanner on your .c, .h, .cpp, .cc, .hpp and Arduino .ino files and on CMakeLists.txt, *.cmake, Makefiles, meson.build and Visual Studio .vcxproj files. It understands comments, string and character literals (including raw strings and digit separators), skips #if 0 blocks and vendored or package-manager folders such as third_party, .pio and managed_components, tells calls apart from declarations and member calls, and follows a command through local variables, so char cmd[] = "clear"; system(cmd); is not reported while a host name formatted into "ping -c 1 %s" is. For TLS it checks whether the code is a client or a server, so SSL_VERIFY_NONE in a server that does not ask for client certificates is not reported, and a switch-off behind an insecure or debug setting is a review item, not a blocker. Credentials are a blocker only when their meaning is certain (a password passed to WiFi.begin or CURLOPT_USERPWD, a connection string, a private key, a known key format, a generated-looking key); a literal that only its name marks as secret is a review item. It never compiles or runs your code. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• C01: calls of gets() (also std::gets and _getws)
• C02: system(), popen(), their Windows forms and execl("/bin/sh", "sh", "-c", cmd) with a command built at run time: a value formatted or joined into a fixed command, or a command from argv, getenv or a read
• C03: printf-family calls (printf, fprintf, snprintf, syslog, dprintf and others) whose format is not a literal and that have no other arguments
• C04: scanf and fscanf reading %s or %[ with no field width
• C05: TLS checks turned off in client code: libcurl VERIFYPEER or VERIFYHOST set to 0, SSL_VERIFY_NONE, ssl::verify_none, QSslSocket::VerifyNone or MBEDTLS_SSL_VERIFY_NONE in a client, verify callbacks that always accept, cpp-httplib and cpr switches, ESP32 setInsecure() and ESP-IDF skip_cert_common_name_check, WinHTTP and SChannel ignore flags, CMake TLS_VERIFY OFF
• C06: credentials whose meaning is certain: passwords passed to WiFi.begin, mysql_real_connect, CURLOPT_USERPWD or an ESP-IDF wifi_config, connection strings, passwords in the user-info part of URLs, Authorization headers, PEM private keys, known key formats, and generated-looking keys under a secret name

REVIEW (check before release)

• C11: strcpy, strcat, sprintf with %s, vsprintf and sscanf %s copying a string of unknown length into a fixed buffer
• C12: rand(), random(), drand48() or std::mt19937 used to make tokens, session ids, keys, salts, nonces or IVs
• C13: mktemp, tmpnam and tempnam
• C14: build files that turn off hardening: -fno-stack-protector, -z execstack, -z norelro, -D_FORTIFY_SOURCE=0, -no-pie, -Wno-format-security, MSVC /GS-, /DYNAMICBASE:NO and the matching Visual Studio settings
• C15: passwords hashed with MD5, SHA-1 or SHA-2 instead of a password hash
• C16: incomplete TLS checks: OpenSSL clients that never turn on SSL_VERIFY_PEER or never check the host name, Boost.Asio clients without verify_peer or host name verification, Qt ignoreSslErrors() with no list, and switch-offs behind a setting
• C17: memset, bzero or ZeroMemory clearing a password or crypto-key buffer, which the compiler may remove
• C18: CMake FetchContent, ExternalProject and CPM dependencies on a branch or with no tag, URL downloads without URL_HASH, and file(DOWNLOAD) without EXPECTED_HASH
• C19: literals that only a password, token or key name marks as secret, password comparisons with a fixed value, and credentials in a git-ignored secrets header such as arduino_secrets.h
• C20: system(), popen() or sh -c with a command from a parameter, member or function result the scanner cannot follow

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and documentation link (SEI CERT C, OpenSSF, libcurl, OpenSSL, OWASP, CMake) for each rule
• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file as text, without running the preprocessor: macros are not expanded, every #if branch except #if 0 is read, and buffer sizes and values built in other functions or files are not known; commands are followed only through local and file-level variables. Compiler flags set outside the scanned files (CI scripts, CMake presets, environment variables) are not seen. Objective-C and CUDA files are not read. curl's own https.c example is reported for review, because its SKIP_PEER_VERIFICATION build switch can turn the checks off. NOT FLAGGED is not a guarantee; keep compiler warnings, sanitizers and a full static analyzer in your build as well.

Contents

One ZIP file with 27 files: SKILL.md, the scanner in scripts/ (9 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (15 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.