Static Analysis

mohitmishra786/low-level-dev-skills/skills/build-systems/static-analysis

by mohitmishra786bdc58472fa9fNo license253 starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 3 months ago

Static analysis skill for C/C++ codebases. Use when hardening code quality, triaging noisy builds, running clang-tidy, cppcheck, or scan-build, interpreting check categories, suppressing false positives, or integrating static analysis into CI. Activates on queries about clang-tidy checks, cppcheck, scan-build, compile_commands.json, code hardening, or static analysis warnings.

Instructions onlySoftware Development Security

AI-generated overview

Guides agents through running and triaging C/C++ static analysis tools such as clang-tidy, cppcheck and scan-build.

What it does: This skill provides instructions for selecting, running and triaging static analysis tools for C/C++ codebases, covering clang-tidy, cppcheck and scan-build. It explains generating compile_commands.json, choosing check categories, writing .clang-tidy configuration, suppressing false positives, and integrating analysis into CI. It also includes a reference file on clang-tidy checks.
When to use it: Use it when hardening C/C++ code quality, triaging noisy static analysis builds, or configuring clang-tidy, cppcheck or scan-build. It also fits questions about check categories, false-positive suppression, compile_commands.json, or adding static analysis to CI.
Requirements: No scripts are shipped; it is instructions only. Running the described tools requires clang-tidy, cppcheck and scan-build to be installed, plus a compilation database such as compile_commands.json.

Static Analysis

Purpose

Guide agents through selecting, running, and triaging static analysis tools for C/C++ — clang-tidy, cppcheck, and scan-build — including suppression strategies and CI integration.

Triggers

"How do I run clang-tidy on my project?"
"What clang-tidy checks should I enable?"
"cppcheck is reporting false positives — how do I suppress them?"
"How do I set up scan-build for deeper analysis?"
"My build is noisy with static analysis warnings"
"How do I generate compile_commands.json for clang-tidy?"

Workflow

1. Generate compile_commands.json

clang-tidy requires a compilation database:

bash

# CMake (preferred)cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ONln -s build/compile_commands.json .
# Bear (for Make-based projects)bear -- make
# compiledb (alternative for Make)pip install compiledbcompiledb make

# CMake (preferred)cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ONln -s build/compile_commands.json .
# Bear (for Make-based projects)bear -- make
# compiledb (alternative for Make)pip install compiledbcompiledb make

2. Run clang-tidy

bash

# Single fileclang-tidy src/foo.c -- -std=c11 -I include/
# Whole project via compile_commands.jsonrun-clang-tidy -p build/ -j$(nproc)
# With specific checks enabledclang-tidy -checks='bugprone-*,modernize-*,performance-*' src/foo.cpp
# Apply auto-fixesclang-tidy -checks='modernize-use-nullptr' -fix src/foo.cpp

# Single fileclang-tidy src/foo.c -- -std=c11 -I include/
# Whole project via compile_commands.jsonrun-clang-tidy -p build/ -j$(nproc)
# With specific checks enabledclang-tidy -checks='bugprone-*,modernize-*,performance-*' src/foo.cpp
# Apply auto-fixesclang-tidy -checks='modernize-use-nullptr' -fix src/foo.cpp

3. Check category decision tree

text

Goal?├── Find real bugs            → bugprone-*, clang-analyzer-*├── Modernise C++ code        → modernize-*├── Follow core guidelines    → cppcoreguidelines-*├── Catch performance issues  → performance-*├── Security hardening        → cert-*, hicpp-*└── Readability / style       → readability-*, llvm-*

Goal?├── Find real bugs            → bugprone-*, clang-analyzer-*├── Modernise C++ code        → modernize-*├── Follow core guidelines    → cppcoreguidelines-*├── Catch performance issues  → performance-*├── Security hardening        → cert-*, hicpp-*└── Readability / style       → readability-*, llvm-*

Category	Key checks	What it catches
`bugprone-*`	`use-after-move`, `integer-division`, `suspicious-memset-usage`	Likely bugs
`modernize-*`	`use-nullptr`, `use-override`, `use-auto`	C++11/14/17 idioms
`cppcoreguidelines-*`	`avoid-goto`, `pro-bounds-*`, `no-malloc`	C++ Core Guidelines
`performance-*`	`unnecessary-copy-initialization`, `avoid-endl`	Performance regressions
`clang-analyzer-*`	`core.`, `unix.`, `security.*`	Path-sensitive bugs
`cert-*`	`err34-c`, `str51-cpp`	CERT coding standard

4. .clang-tidy configuration file

yaml

# .clang-tidy — place at project rootChecks: >  bugprone-*,  modernize-*,  performance-*,  -modernize-use-trailing-return-type,  -bugprone-easily-swappable-parametersWarningsAsErrors: 'bugprone-*,clang-analyzer-*'HeaderFilterRegex: '^(src|include)/.*'CheckOptions:  - key: modernize-loop-convert.MinConfidence    value: reasonable  - key: readability-identifier-naming.VariableCase    value: camelCase

# .clang-tidy — place at project rootChecks: >  bugprone-*,  modernize-*,  performance-*,  -modernize-use-trailing-return-type,  -bugprone-easily-swappable-parametersWarningsAsErrors: 'bugprone-*,clang-analyzer-*'HeaderFilterRegex: '^(src|include)/.*'CheckOptions:  - key: modernize-loop-convert.MinConfidence    value: reasonable  - key: readability-identifier-naming.VariableCase    value: camelCase

5. Suppress false positives

cpp

// Suppress a single lineint result = riskyOp(); // NOLINT(bugprone-signed-char-misuse)
// Suppress a block// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers)constexpr int BUFFER_SIZE = 4096;
// Suppress whole function[[clang::suppress("bugprone-*")]]void legacy_code() { /* ... */ }

// Suppress a single lineint result = riskyOp(); // NOLINT(bugprone-signed-char-misuse)
// Suppress a block// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers)constexpr int BUFFER_SIZE = 4096;
// Suppress whole function[[clang::suppress("bugprone-*")]]void legacy_code() { /* ... */ }

Or in .clang-tidy:

yaml

# Exclude third-party directoriesHeaderFilterRegex: '^(src|include)/.*'# Disable specific checksChecks: '-bugprone-easily-swappable-parameters'

# Exclude third-party directoriesHeaderFilterRegex: '^(src|include)/.*'# Disable specific checksChecks: '-bugprone-easily-swappable-parameters'

6. Run cppcheck

bash

# Basic runcppcheck --enable=all --std=c11 src/
# With compile_commands.jsoncppcheck --project=build/compile_commands.json
# Include specific checks and suppress noisecppcheck --enable=warning,performance,portability \         --suppress=missingIncludeSystem \         --suppress=unmatchedSuppression \         --error-exitcode=1 \         src/
# Generate XML report for CIcppcheck --xml --xml-version=2 src/ 2> cppcheck-report.xml

# Basic runcppcheck --enable=all --std=c11 src/
# With compile_commands.jsoncppcheck --project=build/compile_commands.json
# Include specific checks and suppress noisecppcheck --enable=warning,performance,portability \         --suppress=missingIncludeSystem \         --suppress=unmatchedSuppression \         --error-exitcode=1 \         src/
# Generate XML report for CIcppcheck --xml --xml-version=2 src/ 2> cppcheck-report.xml

`--enable=` value	What it checks
`warning`	Undefined behaviour, bad practices
`performance`	Redundant operations, inefficient patterns
`portability`	Non-portable constructs
`information`	Configuration and usage notes
`all`	Everything above

7. Path-sensitive analysis with scan-build

bash

# Intercept a Make buildscan-build make
# Intercept CMake buildscan-build cmake --build build/
# Show HTML reportscan-view /tmp/scan-build-*/
# With specific checkersscan-build -enable-checker security.insecureAPI.gets \           -enable-checker alpha.unix.cstring.BufferOverlap \           make

# Intercept a Make buildscan-build make
# Intercept CMake buildscan-build cmake --build build/
# Show HTML reportscan-view /tmp/scan-build-*/
# With specific checkersscan-build -enable-checker security.insecureAPI.gets \           -enable-checker alpha.unix.cstring.BufferOverlap \           make

scan-build finds deeper bugs than clang-tidy: use-after-free across functions, dead stores from logic errors, null dereferences on complex paths.

8. CI integration

yaml

# GitHub Actions- name: Static analysis  run: |    cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON    run-clang-tidy -p build -j$(nproc) -warnings-as-errors '*'
- name: cppcheck  run: |    cppcheck --enable=warning,performance \             --suppress=missingIncludeSystem \             --error-exitcode=1 \             src/

# GitHub Actions- name: Static analysis  run: |    cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON    run-clang-tidy -p build -j$(nproc) -warnings-as-errors '*'
- name: cppcheck  run: |    cppcheck --enable=warning,performance \             --suppress=missingIncludeSystem \             --error-exitcode=1 \             src/

For clang-tidy check details, see references/clang-tidy-checks.md [blocked].

Related skills

Use skills/compilers/clang for Clang toolchain and diagnostic flags
Use skills/compilers/gcc for GCC warnings as complementary analysis
Use skills/runtimes/sanitizers for runtime bug detection alongside static analysis
Use skills/build-systems/cmake for CMAKE_EXPORT_COMPILE_COMMANDS setup

Source and attribution

Source:mohitmishra786/low-level-dev-skillsinskills/build-systems/static-analysisat commitbdc5847

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Static Analysis

Static Analysis

Purpose

Triggers

Workflow

1. Generate compile_commands.json

2. Run clang-tidy

3. Check category decision tree

4. .clang-tidy configuration file

5. Suppress false positives

6. Run cppcheck

7. Path-sensitive analysis with scan-build

8. CI integration

Related skills

Source and attribution

More from mohitmishra786/low-level-dev-skills

Zig Debugging

Simd Intrinsics

Zig Cross

Rustc Basics

Zig Cinterop

Zig Build System

More in Software Development

Playground

M5 Onboard

Cardputer Buddy

Web Design Guidelines

Vercel React Native Skills

Vercel React Best Practices