There are different approaches, and which one you want to use depends on your goals.

You'll get the fastest results by using an existing tool such as lint or one of the million other static souce code checkers.

If you want to invest much time, you could write your own tool like that, but the fact that you asked that question in the first place likely means that it's not the solution your are looking for. There has been quite some research in that area, it's worth looking at the results before writing your own tool.

Finally you can just use a bunch or regexes to search for potentially dangerous stuff (search for system for example).

But it all depends on what you want to achieve. If you tell us, we can help you better.