zeroize-audit
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
Profile →npx skills add sickn33/agentic-awesome-skills --skill zeroize-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Detects missing zeroization of sensitive data in source code and identifies zeroization removed or weakened by compiler optimizations, with assembly-level analysis and control-flow verification. Works on C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
How it works
- Analyzes source to identify sensitive objects and wipes via 2-source-analyzer (C/C++) or 2b-rust-source-analyzer (Rust).
- Performs per-translation-unit IR diff, assembly, semantic IR, and CFG analyses in 3-tu-compiler-analyzer (C/C++), or crate-level MIR/IR/assembly in 3b-rust-compiler-analyzer (Rust).
- Produces structured findings (e.g., MISSING_SOURCE_ZEROIZE, PARTIAL_WIPE, OPTIMIZED_AWAY_ZEROIZE, STACK_RETENTION, REGISTER_SPILL, MISSING_ON_ERROR_PATH, NOT_DOMINATING_EXITS, LOOP_UNROLLED_INCOMPLETE) with evidence files and organized outputs in a shared working directory.
- Generates a final JSON report in 4-report-assembler and can craft PoCs (via 5-poc-generator) and runtime tests (via 6-test-generator).
When to use it
Use when auditing cryptographic implementations, authentication systems, or code handling PII or sensitive credentials to verify proper zeroization and to catch wipe deficiencies or compiler optimizations that remove wipes.
What it can touch
- Tools: Read, Grep, Glob, Bash, Write, Task, and various mcp Serena components for symbol and reference analysis.
- Outputs: JSON reports, PoCs, and runtime tests written to designated work directories.
Caveats
- Shielded as offensive risk; requires explicit authorization and a read-only mode without target modification unless explicitly allowed.
- Requires build context (compile_commands.json or Cargo.toml) and compiler/toolchain prerequisites to generate IR/ASM evidence; findings rely on those evidences.
- Some findings depend on enabling optional analyses (assembly, semantic IR, CFG, runtime tests).
> **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. > **Mandatory confirmation gate** > Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: > 1. Ask the user to state the exact target URL, IP, account, or resource. > 2. Ask the user to confirm written authorization and the permitted scope. > 3. Show the exact command(s) and explain their expected effect. > 4. Wait for explicit confirmation in the current conversation. > > Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. # zeroize-audit — Claude Skill ## When to Use - Auditing cryptographic implementations (keys, seeds, nonces, secrets) - Reviewing authentication systems (passwords, tokens, session data) - Analyzing code that handles PII or sensitive credentials - Verifying secure cleanup in security-critical codebases - Investigating memory safety of sensitiv
- When to Use
- When NOT to Use
- Purpose
- Scope
- Inputs
- Prerequisites
- Approved Wipe APIs
- Finding Capabilities
- Agent Architecture
- Execution flow
- Cross-Reference Convention
- Detection Strategy
- Output Format
- Markdown Report Structure
What does the zeroize-audit skill do?
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill zeroize-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.