What do you look for when reviewing C code for errors that might seem benign in a small project but are risky in production?
Implement a lightweight analyzer for a C source string. Return each applicable risk category at most once, ordered by the first occurrence of that category in the source. Ignore code inside // and /* ... */ comments. Treat an allocation as checked when its assigned variable is later compared with NULL or 0.
Input: one C source string. Output: a list of risk labels.
def analyze_c_risks(code):