zeroize-audit — Claude Code skill: audit secret wiping
Finds passwords, keys and tokens left in memory across C, C++ and Rust, and checks whether the compiler threw their wiping away.
npx skills add trailofbits/skills --skill zeroize-audit -a claude-codeWhat zeroize-audit does
The skill walks the source tree looking for sensitive values that never get cleared after use. It also checks whether the compiler removed the wipe itself, and it only reports an optimized-away finding when there is evidence from IR or assembly. To get that evidence it compares builds at several optimization levels, O0, O1 and O2 by default. O1 is the diagnostic one: a wipe that vanishes there is plain dead-store elimination, while O2 catches more aggressive cases.
Execution runs through phases 0 to 7, each driven by its own workflow file, with the author's prompt defining the orchestrator role. There is control-flow verification, tracking of secret copies, heap allocator warnings, and generation of runtime tests. Analysis is read-only against your codebase; artifacts go to a temporary working directory. The output is a JSON report.
You need the repo root plus at least one of compile_commands.json for C and C++ or Cargo.toml for Rust. Preflight stops the run without one, so have the compile database path ready. The skill also leans on the serena MCP server: no symbol or reference lookup without it. An interrupted run can resume from its saved phase when the working directory is known.
What it helps with
- find keys and passwords still sitting in memory after use
- check whether the compiler dropped a secret wipe
- back an optimized-away finding with IR or assembly evidence
- trace where copies of secret values end up
- generate a runtime test that catches the leak
Example prompts for the agent
- Audit this crate for secrets left in memory
- Check that this C library actually wipes its keys
- Run zeroize-audit against
compile_commands.jsonand show me the report
How to install zeroize-audit
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill zeroize-audit -a claude-code2Manually: put the files in place
~/.claude/skills/zeroize-audit/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/zeroize-audit/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill zeroize-audit -a codex2Manually: put the files in place
.agents/skills/zeroize-audit/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill zeroize-audit -a cursor2Manually: put the files in place
.cursor/skills/zeroize-audit/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills zeroize-audit2Manually: put the files in place
.github/skills/zeroize-audit/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill zeroize-audit -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/zeroize-audit/skills/zeroize-auditManually: put the files in place
.devin/skills/zeroize-audit/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill zeroize-audit -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about zeroize-audit
How do I install zeroize-audit in Claude Code?
Run npx skills add trailofbits/skills --skill zeroize-audit -a claude-code. The skill lands in ~/.claude/skills/zeroize-audit/SKILL.md.
What does zeroize-audit do?
It detects missing zeroization of sensitive data in C, C++ and Rust and checks whether compiler optimizations removed it. An optimized-away finding requires IR or assembly evidence.
What do I need before running it?
The repo root and a path to compile_commands.json for C and C++ or to Cargo.toml for Rust. Preflight halts the run without one of them.
