mirror of
https://github.com/trailofbits/skills.git
synced 2026-09-14 14:28:48 +08:00
Julius Alexandre
293fb74c31
* Add modern-cpp plugin for C++20/23/26 best practices
Modern C++ skill guiding Claude toward modern idioms with a security
emphasis. Mirrors modern-python in spirit but focuses on language
standards rather than toolchain.
Features tiered by practical usability:
- Tier 1 (Use Today): C++20/23 features with solid compiler support
- Tier 2 (Deploy Now): Compiler hardening, sanitizers, hardened libc++
- Tier 3 (Plan For): C++26 reflection
- Tier 4 (Watch): Contracts, std::execution
Includes SKILL.md entry point + 6 reference docs:
- anti-patterns.md (30+ legacy-to-modern swaps)
- cpp20-features.md (concepts, ranges, span, format, coroutines)
- cpp23-features.md (expected, print, deducing this, flat_map)
- cpp26-features.md (reflection, contracts, memory safety)
- compiler-hardening.md (flags, sanitizers, hardened libc++)
- safe-idioms.md (security patterns by vulnerability class)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Remove .codex/ sidecar
AGENTS.md bans runtime sidecars: Claude marketplace metadata is the single
canonical source and Codex reads it through that compatibility. The rule landed
in f09e5c7 (#173) on 2026-06-05, after this PR opened.
* modern-cpp: address review feedback
Use std::forward_like for the deducing-this example. vector::operator[]
is not ref-qualified, so forwarding the object dropped the rvalue case
and the example did not collapse all four overloads it claimed to.
Move the custom-awaiter note out of the 'When NOT to Use' list, where it
read as a contradiction.
* modern-cpp: fix two standard-version errors
- Four rows in the anti-patterns Standard column said C++11 for
features that shipped in C++98: std::copy, std::fill, static_cast,
and explicit. The column exists so a reader on a pinned toolchain
knows the minimum standard, so a wrong cell sends them upgrading for
something they already have.
- The span example called data.at(0), which does not exist until C++26
(P2821), so the snippet did not compile under the C++20 the doc is
scoped to. The comment also credited hardened libc++ for checking
.at() when hardening actually checks operator[], front and back.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
modern-cpp
Modern C++ best practices plugin for Claude Code, guiding AI-assisted development toward C++20/23/26 idioms with a security emphasis from Trail of Bits.
When to Use
- Writing new C++ code (functions, classes, libraries)
- Modernizing legacy C++ patterns (pre-C++20)
- Working on security-critical C++ code
- Reviewing C++ code for modern idiom adoption
- Choosing between legacy and modern approaches to a problem
What It Covers
Language Features (Tiered by Usability)
| Tier | Standard | What |
|---|---|---|
| Use Today | C++20 | Concepts, ranges, std::span, std::format, coroutines, <=> |
| Use Today | C++23 | std::expected, std::print, deducing this, std::flat_map |
| Deploy Now | Any | Compiler hardening flags, sanitizers, hardened libc++ |
| Plan For | C++26 | Reflection (eliminates serialization boilerplate and code generators) |
| Watch | C++26 | Contracts, std::execution (promising but needs compiler maturity) |
Security
- Compiler hardening flags (GCC + Clang, per OpenSSF guidelines)
- Hardened libc++ modes (bounds-checking with ~0.3% overhead)
- Sanitizer setup (ASan, UBSan, TSan, MSan)
- Safe idioms organized by vulnerability class (memory, type, integer, concurrency)
Anti-Patterns
30+ legacy-to-modern pattern replacements with rationale, covering memory management, type safety, error handling, concurrency, and metaprogramming.
Installation
/plugin marketplace add trailofbits/skills
/plugin install modern-cpp