zeroize-audit

The zeroize-audit skill is a security-focused auditing tool designed to identify improper handling of sensitive data in C, C++, and Rust codebases. Its primary purpose is to detect missing zeroization of secrets such as cryptographic keys, passwords, tokens, seeds, nonces, credentials, and other confidential values. In addition to finding absent cleanup operations, it analyzes whether intended zeroization routines have been removed or weakened by compiler optimizations, such as dead-store elimination. Findings related to optimization-induced removal require supporting compiler evidence from LLVM IR or assembly analysis.

The skill provides multiple layers of analysis to verify secure memory cleanup. Its capabilities include assembly-level inspection for stack retention and register spills, data-flow tracking of secret copies, heap allocator security warnings, semantic LLVM IR analysis for optimization effects such as loop unrolling, and control-flow graph analysis to verify cleanup coverage across execution paths. It can also generate runtime validation tests and produces structured JSON reports. Advanced analyses can be enabled selectively, including assembly analysis, semantic IR analysis, and control-flow verification. The skill operates in a read-only manner against the target codebase and writes analysis artifacts only to a temporary working directory.

This skill is intended for security engineers, cryptography developers, auditors, and teams maintaining security-critical software. Common use cases include auditing cryptographic implementations, reviewing authentication systems, validating secure handling of personally identifiable information (PII), investigating memory safety concerns involving secrets, and verifying that sensitive data is consistently wiped across normal and error-handling paths. It is best suited for projects with a valid build context and compilable translation units.