skills.rest
trailofbits
trailofbitsOFFICIAL
Explore all skills by this author →
Website𝕏@trailofbitsGitHub

zeroize-audit

Detect missing zeroization of sensitive data in C/C++/Rust code.

6.5k|561|Updated Jan 14, 2026
Search Tags:#security#code audit#memory safety#Rust#C/C++#zeroization
One-click install
npx skills add https://github.com/trailofbits/skills --skill zeroize-audit-trailofbits
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zeroize-audit
Source: https://github.com/trailofbits/skills/tree/main/plugins/zeroize-audit/skills/zeroize-audit
Command: npx skills add https://github.com/trailofbits/skills --skill zeroize-audit-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires llvm, clang, rustc, python, pypdf, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the detection of missing zeroization of sensitive data in source code, identifying potential vulnerabilities related to memory safety and secure data handling.

Core Features & Use Cases

  • Zeroization Detection: Identifies missing zeroization in C/C++/Rust code, helping prevent sensitive data leaks.
  • Assembly-Level Analysis: Provides detailed analysis of assembly code to detect register spills and stack retention.
  • Data-Flow Tracking: Tracks secret copies and heap allocator security warnings.
  • Semantic IR Analysis: Analyzes LLVM IR to detect optimizations that may remove zeroization.
  • Control-Flow Graph Analysis: Verifies that zeroization dominates all exit paths in the code.
  • Runtime Validation Test Generation: Generates tests to validate the effectiveness of zeroization.

Quick Start

Use the zeroize-audit skill to audit the code in the current directory for missing zeroization.

Frequently Asked Questions about zeroize-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect missing zeroization of sensitive data in C/C++/Rust code?▼

You can detect missing zeroization of sensitive data by automating C/C++/Rust code analysis with data-flow tracking and control-flow graph verification to ensure secure data handling across all exit paths.

What is assembly-level analysis for memory safety and how does it detect register spills?▼

Assembly-level analysis for memory safety inspects compiled code to detect register spills and stack retention, ensuring sensitive data is not left exposed in memory after operations complete.

Do I need LLVM and Clang installed to audit Rust code for secure data handling?▼

Yes, you need LLVM, Clang, and rustc installed to perform semantic IR analysis and assembly-level code audits for detecting missing zeroization of sensitive data.

How to generate runtime validation tests for zeroization in C/C++ code?▼

You can generate runtime validation tests for zeroization by analyzing LLVM IR and control-flow graphs, which produces automated tests to verify the effectiveness of secure data handling.

Why does LLVM IR optimization remove zeroization and how can I analyze it?▼

LLVM IR optimization can remove zeroization operations during compilation, but semantic IR analysis detects these optimizations to prevent sensitive data from remaining in memory.

Can I track secret copies and heap allocator warnings during a code audit?▼

Yes, data-flow tracking during a code audit identifies secret copies and generates heap allocator security warnings to prevent sensitive data leaks in C/C++/Rust applications.

Related Skills

Explore More Software Engineering Skills→
randrand
126

discover-ir

Discover relevant IR skills during LLVM IR and compiler development workflows.

Community
Basic
hffmnnjhffmnnj
39

security-audit

Audit code for security vulnerabilities and generate a structured security report.

Community
Advanced
Ramprasad4121Ramprasad4121
1

zeroize-audit

Audits C, C++ and Rust codebases for zeroization vulnerabilities using LLVM IR and assembly analysis.

Community
Advanced
manuelbrandner85manuelbrandner85

zeroize-audit

Detect missing or compiler-optimized zeroization in C, C++, and Rust source code.

Community
Advanced