SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsdsoftbus_safety_guard

dsoftbus_safety_guard

Security & auditing

View repository

Updated 10-15 16:45

About this skill

Soft Bus Security Guard - Code Review Skill

Trigger Conditions

⚠️ This skill is invoked only when user input contains "软总线安全卫士"

Trigger Examples：

  • 软总线安全卫士 请审查这个文件：D:\code\example.c
  • 请使用软总线安全卫士检查这个目录
  • 软总线安全卫士 检视lnn_lane_dfx.c文件

Skill Overview

This skill is a dedicated code review tool for the OpenHarmony distributed soft bus (dsoftbus) communication component, covering:

  • Logging Standards Check: 1 core rule
  • Secure Coding Check: 40+ rules, covering 11 major categories
  • General Code Quality Check: code complexity, readability, concurrency safety, etc.
  • Cross-file Call Analysis: call chain tracing, resource passing, data flow analysis
  • Control Flow Analysis: path-sensitive analysis, unreachable code detection

⚠️ Core Principle: This skill is aread-only code review tool, only analyzes code and generates reports,does not modify any source files。

Applicable Scenarios

  • OpenHarmony dsoftbus component code
  • C/C++ system-level communication code
  • Code involving IPC, network communication, and multithreading
  • Code requiring strict logging standards and secure coding

Quick Reference: Key Rule Index

Quickly locate relevant rules based on code characteristics:

Code Characteristic Related Rules
Function returns SOFTBUS_ERR Logging Standards-1
Pointer bitwise operation (&, |, ^, ~, <<, >>) Pointer Safety-1, Integer Operations-2
*ptr or ptr-> used Pointer Safety-3, Temporary Variables-1
arr[index] access Array Subscript-1,2
SoftBusMutexLock/SoftBusMutexUnlock Lock Management-1,2,3
SoftBusSocketCreate/SoftBusSocketClose fd Management-1,2
malloc/free, new/delete Memory Management-1~11
HILOG_INFO print sensitive information Sensitive Information-1,2,3
- Unsigned number decrement (i--)
memcpy_s, strcpy_s etc. Safe Functions-1,2
Path operations (., ..) External Input-1
IPC interface added Permission Check-1

📚 Detailed Rule Descriptions

For detailed explanations, code examples, and remediation solutions for each rule, see：

  • Detailed Rule Explanations and Examples - Complete documentation of 40+ rules
    • Problem description, risk level, problem example, remediation solution, and inspection points for each rule
    • Includes complete code examples and best practices
    • Includes a formatted print type matching table and a list of commonly used safe functions

🏷️ Rule Categories (Quick Index)

💡 Quick Locate: Click the link after each rule to view detailed explanations and code examples

1. Logging Standards (1 item)

2. Pointer safety (4 items)

3. Temporary variables (3 items)

4. Array subscripts (2 items)

5. Lock management (3 items)

6. fd management (2 items)

7. Memory management (11 items)

8. Sensitive information (3 items)

9. Integer operations (2 items)

10. Loop variables (2 items)

11. Secure functions (2 items)

12. Permission verification (1 item)

13. External input validation (4 items)

14. External Data Validity (3 items)

  • Addition/subtraction based on external input / memory allocation validation → See details
  • Default length validation → See details
  • TLV format length validation → See details

15. Common Issues (5 items)

Code Review Workflow

Step 1: Interactively select the review scope

Scenario A: User specifies a path

  1. Check whether there are modifications under this path:git status --porcelain <path>
  2. If there are modifications, provide options:
    • Perform a full review of all code under this path
    • Perform an incremental review of the modified code (N files in total)
  3. If there are no modifications, directly perform a full review

Scenario B: User does not specify a path

  1. Check whether the current repository has modifications:git status --porcelain
  2. Provide options:
    • Review the code of the entire repository
    • Specify a review path
    • Review the locally modified code (N files in total)
  3. Execute according to the user's choice

Step 2: Code specification check

Check item by item according to the 40+ rules, refer to:

  • Detailed rule documentation - Detailed description and code examples for each rule
  • Use the Grep tool to search for violation patterns
  • Analyze in context to avoid false positives

Step 3: Cross-file call analysis

Core capability: Analyze function call chains, and trace cross-file data flow and resource transfer

  • Call graph construction
  • Cross-file resource tracking (malloc/free separation)
  • Cross-file data flow analysis
  • Cross-file error handling
  • Cross-file access to global variables

Step 4: Control flow analysis

Core capability: Analyze code execution paths, and identify unreachable code and path-sensitive issues

  • Control flow graph construction
  • Unreachable code detection
  • Path-sensitive analysis
  • Uninitialized variable analysis
  • Resource release path analysis

Step 5: Generate repair suggestions

⚠️ Important limitation：Only generate repair suggestion code into the report; modifying source files directly is strictly prohibited

For each issue, provide:

  • Complete function or code block repair example
  • Comments explaining the reason for the modification
  • Multiple repair solutions (if any)

Step 6: Generate a review report

Create a report directory:d:/code-review-YYYYMMDD-HHMMSS/

Report file：

  • code_review_report.md - Complete review report
  • code_fixes.patch - All repair code (Git patch format)
  • statistics.json - Statistical data

Common Error Quick Reference Table

💡 Detailed inspection method: For detailed inspection methods, code examples, and remediation plans for each error pattern, see Checklist

Error Pattern Severity Level Quick Detection See Section
Null Pointer Dereference 🔴 Critical *ptr or ptr-> no NULL check before Pointer Safety-3
Lock Not Released 🔴 Critical Unlock not called before return Lock Management-1
Memory Leak 🔴 Critical malloc not paired with free Memory Management-2
Sensitive Information Leak 🔴 Critical Key/udid printed in logs Sensitive Information-1
Array Out of Bounds 🔴 Critical arr[index] range not verified Array Index-1
Unsigned Infinite Loop 🔴 Critical uint32_t i-- Loop Variable-1
Pointer Bitwise Operation 🟡 Warning ptr & mask Pointer Safety-1
Integer Overflow 🟡 Warning size + offset not checked Integer Operation-1
Returns SOFTBUS_ERR 🟡 Warning return SOFTBUS_ERR Logging Standards-1
Uninitialized Variable 🟡 Warning Declared without initial value Temporary Variable-1

Inspection Principles

Context Analysis

  • When inspecting, look at the context to confirm whether protective measures already exist
  • Avoid false positives (e.g., global variables may be initialized elsewhere)

Apply Flexibly

  • In addition to the 40+ clearly defined rules, general code quality checks are also required
  • Code complexity, readability, concurrency safety, performance issues, etc.

Key Focus Areas

  • Code paths that handle external input
  • Resource usage in macro definitions
  • Problematic code in conditional compilation
  • High-risk security issues (null pointers, memory leaks, sensitive information leaks)

Prioritization

安全编码问题 > 日志规范问题
严重问题 > 警告问题 > 提示问题

Core Restrictions

⚠️ Modifying source code is strictly prohibited：

  • This skillonly reads and analyzes code
  • Generate remediation suggestionsfor reporting only
  • Never directly modify any source file
  • Read-only operations: use only read-only tools such as Read, Grep, Glob

📖 Reference Documentation

Detailed rule descriptions

  • Rule details and examples - Detailed explanations and code examples for the 40+ rules
    • Problem description, risk level, problem example, remediation plan, and inspection points for each rule
    • Includes complete code examples and best practices
    • Includes a formatted print type matching table and a list of commonly used safe functions

Additional Resources

  • Common Error Quick Reference - Quickly locate error patterns
  • Usage Tips - How to effectively use this skill

Usage Tips

  1. Quickly locate issues: Use the "Quick Reference" table to find relevant rules based on code characteristics
  2. Learn rules in depth: Read references/security_rules_explained.md to understand detailed explanations and code examples for each rule
  3. Categorized review: Check item by item by category according to "Rule Categories" to avoid omissions
  4. Prioritize serious issues: Refer to the "Common Errors Quick Reference Table" to prioritize fixing high-risk issues
  5. Use the workflow: Conduct the review systematically according to the "Code Review Workflow"

Report requirements

  • Automatic report generation: After the review is completed, automatically generate the report in the d:/code-review-时间戳/ directory
  • Report directory format: Use YYYYMMDD-HHMMSS format timestamps
  • File encoding: Report files use UTF-8 encoding to ensure Chinese displays correctly
  • Fix code is for reference only: All fix code appears only in code blocks in the report file and is not written to the source code directory