zeroize-audit
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
npx skills add trailofbits/skills --skill zeroize-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# zeroize-audit — Claude Skill ## When to Use - Auditing cryptographic implementations (keys, seeds, nonces, secrets) - Reviewing authentication systems (passwords, tokens, session data) - Analyzing code that handles PII or sensitive credentials - Verifying secure cleanup in security-critical codebases - Investigating memory safety of sensitive data handling ## When NOT to Use - General code review without security focus - Performance optimization (unless related to secure wiping) - Refactoring tasks not related to sensitive data - Code without identifiable secrets or sensitive values --- ## Purpose Detect missing zeroization of sensitive data in source code and identify zeroization that is removed or weakened by compiler optimizations (e.g., dead-store elimination), with mandatory LLVM IR/asm evidence. Capabilities include: - Assembly-level analysis for register spills and stack retention - Data-flow tracking for secret copies - Heap allocator security warnings - Semantic IR analysis for loop unrolling and SSA form - Control-flow graph analysis for path coverage verification - Runtime validation test generation ## Scope - Read-only against the target codebase (does not modify audi
- When to Use
- When NOT to Use
- Purpose
- Scope
- Inputs
- Prerequisites
- Approved Wipe APIs
- Finding Capabilities
- Agent Architecture
- Execution flow
- Cross-Reference Convention
- Detection Strategy
- Output Format
- Markdown Report Structure
What does the zeroize-audit skill do?
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.
How do I install it?
Run `npx skills add trailofbits/skills --skill zeroize-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.