zeroize-audit
zeroize audit
What it does
- Auditing cryptographic implementations (keys, seeds, nonces, secrets)
- Reviewing authentication systems (passwords, tokens, session data)
- Analyzing code that handles PII or sensitive credentials
- Verifying secure cleanup in security-critical codebases
- Investigating memory safety of sensitive data handling
- General code review without security focus
- Performance optimization (unless related to secure wiping)
Requirements & configuration
- Requires valid build context (compilecommands.json) and compilable translation units.
- | mcpmode | no | prefer | off, prefer, or require — controls Serena MCP usage |
- | Prerequisite | Failure mode if missing |
- | uvx on PATH (for Serena) | If mcpmode=require: fail. If mcpmode=prefer: continue without MCP; downgrade affected findings per Confidence Gating rules. |
- Common prerequisite:
Configuration: SECRET_COPYMISSING_ON_ERROR_PATHNOT_DOMINATING_EXITSMISSING_SOURCE_ZEROIZEPARTIAL_WIPESTACK_RETENTIONREGISTER_SPILLLOOP_UNROLLED_INCOMPLETE
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
zeroize-audit FAQ
What does the zeroize-audit skill do?
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data. Auditing cryptographic implementations (keys, seeds, nonces, secrets) Reviewing authentication systems (passwords, tokens, session data)
What does zeroize-audit require?
Requires valid build context (compilecommands.json) and compilable translation units. | mcpmode | no | prefer | off, prefer, or require — controls Serena MCP usage | | Prerequisite | Failure mode if missing | | uvx on PATH (for Serena) | If mcpmode=require: fail. If mcpmode=prefer: continue without MCP; downgrade affected findings per Confidence Gating rules. | Common prerequisite: Configuration keys: SECRET_COPY, MISSING_ON_ERROR_PATH, NOT_DOMINATING_EXITS, MISSING_SOURCE_ZEROIZE, PARTIAL_WIPE, STACK_RETENTION, REGISTER_SPILL, LOOP_UNROLLED_INCOMPLETE.
How do I install zeroize-audit?
Run: npx -y skills add https://github.com/trailofbits/skills --skill zeroize-audit --agent claude-code — the source lives at github.com/trailofbits/skills.
Maintain zeroize-audit?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[zeroize-audit on getagentictools](https://getagentictools.com/skills/trailofbits-skills-zeroize-audit?ref=badge) npx agentictools info skills/trailofbits-skills-zeroize-audit The second line is the CLI lookup for this page — handy in READMEs and docs.
