What problem does it solve? Sensitive data like cryptographic keys, passwords, and tokens often remains in memory because developers forget to zeroize it or because compiler optimizations silently remove the wipe. This Skill audits source code, LLVM IR, and assembly to find these leaks with concrete evidence. ## Core Features & Use Cases - Multi-level analysis: Combines source scanning, LLVM IR diffing across optimization levels, assembly inspection for register spills and stack retention, and control-flow graph verification. - Evidence-backed findings: Emits 11 finding categories (e.g., OPTIMIZED_AWAY_ZEROIZE, STACK_RETENTION, SECRET_COPY) with confidence gating and mandatory compiler evidence for optimization-related claims. - PoC validation: Generates, compiles, and runs proof-of-concept programs to confirm each finding is actually exploitable. - Use Case: Ask it to audit a Rust crate handling API keys; it runs an 8-phase multi-agent pipeline and returns a report showing a memset wiped at O0 but eliminated at O2, plus a validated PoC. ## Quick Start Audit this repository for secrets left in memory and verify that all sensitive buffers are actually wiped at optimization level O2.
