skills.rest
vigolium
vigoliumOFFICIAL
Explore all skills by this author →
Website𝕏@VigoliumGitHub

zeroize-audit

Detect missing or compiler-optimized-away zeroization of sensitive data in C/C++/Rust.

965|142|Updated Mar 8, 2026
Search Tags:#secure coding#proof of concept#memory safety#vulnerability scanning#zeroization#assembly analysis#llvm ir
One-click install
npx skills add https://github.com/vigolium/vigolium --skill zeroize-audit-vigolium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zeroize-audit
Source: https://github.com/vigolium/vigolium/tree/main/platform/vigolium-audit/src/content/skills/zeroize-audit
Command: npx skills add https://github.com/vigolium/vigolium --skill zeroize-audit-vigolium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, and includes references (resource) components.

What problem does it solve?

This Skill identifies cases where sensitive data is not reliably zeroized in C/C++/Rust code, including situations where cleanup looks correct in source but is removed by compiler optimizations.

Core Features & Use Cases

  • Detect missing zeroization in source: Finds sensitive objects (keys, tokens, secrets) without approved wipe calls or cleanup on all relevant paths.
  • Catch optimized-away wipes: Uses LLVM IR comparison across optimization levels to detect wipes eliminated by dead-store elimination and related transformations.
  • Confirm evidence with compiler artifacts: Uses assembly and (optionally) semantic IR and CFG analysis to validate stack retention, register spills, and path dominance.
  • Generate and validate PoCs: Produces proof-of-concept programs that demonstrate whether the secret persists after the audited operation.

Use cases include auditing cryptographic code, authentication/session handling, and security-critical cleanup routines for secrets stored in stack memory, heap memory, or intermediate copies.

Quick Start

Run zeroize-audit against the repository at the provided path with a build context by supplying your compile_commands.json (for C/C++) or Cargo.toml (for Rust), and generate an evidentiary report plus validated PoCs.

Frequently Asked Questions about zeroize-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect missing zeroization of sensitive data in C/C++/Rust code?▼

Detect missing zeroization by scanning source code for sensitive objects like keys and tokens lacking approved wipe calls across all execution paths, including error and early-return flows. It identifies secrets in stack, heap, or intermediate memory without proper cleanup.

Why does the compiler optimize away my secure memory zeroization wipes?▼

Compilers eliminate zeroization wipes via dead-store elimination. Comparing LLVM IR across optimization levels catches these optimized-away wipes by detecting when cleanup instructions are removed during compilation.

What build context do I need to audit sensitive data cleanup in my project?▼

Auditing sensitive data cleanup requires a build context: a compile_commands.json file for C/C++ projects or a Cargo.toml manifest for Rust projects. This context enables LLVM IR comparison and assembly analysis to validate wipe behavior.

Can I generate a proof of concept to verify if a secret persists in memory after execution?▼

Generating a proof of concept is mandatory for verification. The Skill produces PoC programs that demonstrate whether a secret persists in memory after the audited operation, validating findings that depend on IR or assembly artifacts.

How does LLVM IR analysis confirm stack retention and register spills of sensitive data?▼

LLVM IR analysis confirms stack retention and register spills by using assembly and semantic IR to validate path dominance. This compiler artifact evidence gates findings to ensure wipes are not eliminated by optimization transformations.

Does this approach work for auditing cryptographic code and authentication session handling?▼

This approach works for auditing cryptographic code, authentication, session handling, and security-critical cleanup routines. It targets secrets stored in stack memory, heap memory, or intermediate copies across C, C++, and Rust codebases.

Related Skills

Explore More Software Engineering Skills→
ayehiaaayehiaa

zeroize-audit

Detect missing or optimized-away zeroization in C/C++ and Rust using LLVM IR and assembly evidence.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
truongnattruongnat

senior-security

Perform STRIDE threat analysis and OWASP-guided vulnerability assessments.

Community
Advanced
gmh5225gmh5225
868

dynamic-instrumentation

Instrument LLVM-based binaries at runtime to observe and analyze behavior.

Community
Advanced