cpp-pro
Analysis
This instruction-only C++ skill is mostly aligned with programming help, but it includes a canned completion message that could falsely claim major performance and safety results.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Implement solutions following C++ Core Guidelines and modern best practices
The skill is intended to modify or produce C++ project code, which is expected for a developer skill but should be reviewed before applying changes to a real codebase.
AddressSanitizer and UBSan clean; Test coverage with gcov/llvm-cov; Static analysis with cppcheck; Valgrind memory check passed
These quality checks are normal for C++ development, but running builds, tests, sanitizers, coverage, or Valgrind can execute project code if the host agent has command access.
Delivery notification: "C++ implementation completed. Delivered high-performance system achieving 10x throughput improvement... All sanitizers pass, zero undefined behavior."
The skill prescribes a highly specific success message, including benchmark and safety claims, regardless of whether those results were actually achieved.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Query context manager for existing C++ project structure and build configuration
The skill relies on retrieved project context. That is useful and purpose-aligned, but stale or poisoned context could influence code recommendations.