zeroize-audit

Detect missing zeroization of sensitive data in C/C++/Rust code.

6.5k|561|Updated Jan 14, 2026

Search Tags:#security #code audit #memory safety #Rust #C/C++#zeroization

Ready to run

npx skills add https://github.com/trailofbits/skills --skill zeroize-audit-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: zeroize-audit
Source: https://github.com/trailofbits/skills/tree/main/plugins/zeroize-audit/skills/zeroize-audit
Command: npx skills add https://github.com/trailofbits/skills --skill zeroize-audit-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires llvm, clang, rustc, python, pypdf, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the detection of missing zeroization of sensitive data in source code, identifying potential vulnerabilities related to memory safety and secure data handling.

Core Features & Use Cases

Zeroization Detection: Identifies missing zeroization in C/C++/Rust code, helping prevent sensitive data leaks.
Assembly-Level Analysis: Provides detailed analysis of assembly code to detect register spills and stack retention.
Data-Flow Tracking: Tracks secret copies and heap allocator security warnings.
Semantic IR Analysis: Analyzes LLVM IR to detect optimizations that may remove zeroization.
Control-Flow Graph Analysis: Verifies that zeroization dominates all exit paths in the code.
Runtime Validation Test Generation: Generates tests to validate the effectiveness of zeroization.

Quick Start

Use the zeroize-audit skill to audit the code in the current directory for missing zeroization.

Frequently Asked Questions about zeroize-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect missing zeroization of sensitive data in C/C++/Rust code?▼

You can detect missing zeroization of sensitive data by automating C/C++/Rust code analysis with data-flow tracking and control-flow graph verification to ensure secure data handling across all exit paths.

What is assembly-level analysis for memory safety and how does it detect register spills?▼

Assembly-level analysis for memory safety inspects compiled code to detect register spills and stack retention, ensuring sensitive data is not left exposed in memory after operations complete.

Do I need LLVM and Clang installed to audit Rust code for secure data handling?▼

Yes, you need LLVM, Clang, and rustc installed to perform semantic IR analysis and assembly-level code audits for detecting missing zeroization of sensitive data.

How to generate runtime validation tests for zeroization in C/C++ code?▼

You can generate runtime validation tests for zeroization by analyzing LLVM IR and control-flow graphs, which produces automated tests to verify the effectiveness of secure data handling.

Why does LLVM IR optimization remove zeroization and how can I analyze it?▼

LLVM IR optimization can remove zeroization operations during compilation, but semantic IR analysis detects these optimizations to prevent sensitive data from remaining in memory.

Can I track secret copies and heap allocator warnings during a code audit?▼

Yes, data-flow tracking during a code audit identifies secret copies and generates heap allocator security warnings to prevent sensitive data leaks in C/C++/Rust applications.