c-bounds-safety

c-bounds-safety is a skill for Claude Code from aduermael/herm. It costs 48 tokens per session (638 once invoked), scanned A, original, MIT.

A guide to -fbounds-safety, a C language extension that checks whether memory access stays within declared limits. It covers pointer annotations, compiler settings, adoption, and debugging.

In plain words
What is it for?
Adding bounds checks to existing C code, annotating pointers, configuring builds, and investigating bounds violations.
Why use it?
It helps prevent out-of-bounds memory access, a common source of crashes and security vulnerabilities.

Skill for Claude Code

Written for Claude Code: when-to-use in frontmatter.

Good fit Adding bounds checks to existing C code, annotating pointers, configuring builds, and investigating bounds violations.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/aduermael/herm/c-bounds-safety
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add aduermael/herm --skill c-bounds-safety
Clone the repo
git clone --depth 1 https://github.com/aduermael/herm

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for c-bounds-safety

README.md
[![agentmods](https://agentmods.dev/badge/skills/aduermael/herm/c-bounds-safety/github.svg)](https://agentmods.dev/skills/aduermael/herm/c-bounds-safety)
Your own site
<a href="https://agentmods.dev/skills/aduermael/herm/c-bounds-safety"><img src="https://agentmods.dev/badge/skills/aduermael/herm/c-bounds-safety/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for c-bounds-safety

Your own site · 80×15
<a href="https://agentmods.dev/skills/aduermael/herm/c-bounds-safety"><img src="https://agentmods.dev/badge/skills/aduermael/herm/c-bounds-safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 48 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 638 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00048 $0.00638
Opus 5 $0.00024 $0.00319
Sonnet 5 $0.00010 $0.00128
Haiku 4.5 $0.00005 $0.00064

Measured 11d ago against content hash ae145c10d0cc, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

c-bounds-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

skills/c-bounds-safety/SKILL.md · 31 lines

What it actually says

How to Use This Skill

When helping with -fbounds-safety adoption or code changes, ask clarifying questions about the user's codebase and goals before suggesting changes. For complex tasks involving multiple files or non-trivial annotation decisions, use plan mode to propose an approach before implementing.

-fbounds-safety Language Extension

-fbounds-safety is a C language extension that prevents out-of-bounds memory access by enforcing bounds safety at the language level. It inserts automatic bounds checks at runtime, rejects unsafe pointer operations at compile time, and requires programmers to provide bounds annotations so the compiler can guarantee safety. Out-of-bounds accesses become deterministic traps instead of exploitable vulnerabilities.

Detailed Documentation

Required reading before adoption work

You MUST have fully read the following three documents (via the Read tool) at the start of an adoption task, and re-read them via the Read tool before any source-modifying step in the adoption workflow unless their content is verifiably fresh in your active context:

Other references (read on demand)

For compiler flags, Xcode build settings, soft trap mode, and ptrcheck.h configuration, read build-settings.md.

For debugging bounds violations at runtime — trap behavior, LLDB commands, wide pointer inspection, watchpoints, crash log analysis, and soft trap debugging, read runtime-debugging.md.

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 31 lines · 48 tokens per session scan A ae145c10d0cc

Subscribe to this mod's changes

c-bounds-safety is a skill published in the GitHub repository aduermael/herm (232 stars, last pushed 29d ago), licensed MIT. It adds 48 tokens to every session and 638 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

pi

Use when needing a minimal, extensible terminal AI coding agent harness in TypeScript with plugin architecture. Pi: minimalist terminal AI coding agent emphasizing simplicity and composability.

znlgis/opengis-skills · 35 tokens

implementing-jsc-classes-cpp

Implements JavaScript classes in C++ using JavaScriptCore. Use when creating new JS classes with C++ bindings, prototypes, or constructors.

twaldin/hone · 38 tokens

native-runtime-debug

Diagnose native C/C++ crashes, hangs/deadlocks, bad runtime state, and crash dumps with qwen-dap-mcp and DAP. Use for crashes, minidumps/core dumps, processes that stop making progress, lock/wait triage, unexpected variable changes, differential good-versus-bad runtime comparison, bounded value/write tracing…

SLP-DEV1/qwen-dap-mcp · 95 tokens

zoom-meeting-sdk-unreal

Zoom Meeting SDK for Unreal Engine wrapper integrations. Use when building Unreal projects that embed Zoom meetings with C++ and Blueprint wrappers, including wrapper-to-SDK mapping concerns.

anthropics/knowledge-work-plugins · 41 tokens

doca-argp

Use this skill for hands-on DOCA Arg Parser CLI work on a shipped sample or new DOCA-using app — adding / removing / renaming flags; wiring docaargpinit → register params → docaargpstart → docaargpdestroy in order; picking a parameter type from the full public enum (DOCAARGPTYPESTRING, INT, BOOLEAN, DEVICE, DEVICEREP…

NVIDIA/skills · 267 tokens

cpu-kernels

Provides guidance for writing, optimizing, and benchmarking C++ CPU kernels with SIMD intrinsics (AVX2/AVX512) for the Hugging Face kernels ecosystem. Includes a two-phase workflow: Phase 1 correctness (generic → AVX2) and Phase 2 performance exploration (AVX512 with branching trial loop), runtime CPU dispatch, OpenMP…

huggingface/kernels · 89 tokens