# zeroize-audit

Finds passwords, keys and tokens left in memory across C, C++ and Rust, and checks whether the compiler threw their wiping away.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 4700 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/zeroize-audit/skills/zeroize-audit/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/zeroize-audit

## What it does

The skill walks the source tree looking for sensitive values that never get cleared after use. It also checks whether the compiler removed the wipe itself, and it only reports an optimized-away finding when there is evidence from IR or assembly. To get that evidence it compares builds at several optimization levels, `O0`, `O1` and `O2` by default. `O1` is the diagnostic one: a wipe that vanishes there is plain dead-store elimination, while `O2` catches more aggressive cases.

Execution runs through phases 0 to 7, each driven by its own workflow file, with the author's prompt defining the orchestrator role. There is control-flow verification, tracking of secret copies, heap allocator warnings, and generation of runtime tests. Analysis is read-only against your codebase; artifacts go to a temporary working directory. The output is a JSON report.

You need the repo root plus at least one of `compile_commands.json` for C and C++ or `Cargo.toml` for Rust. Preflight stops the run without one, so have the compile database path ready. The skill also leans on the serena MCP server: no symbol or reference lookup without it. An interrupted run can resume from its saved phase when the working directory is known.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill zeroize-audit -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/zeroize-audit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/zeroize-audit/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill zeroize-audit -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/zeroize-audit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill zeroize-audit -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/zeroize-audit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills zeroize-audit
```

2. **Manually: put the files in place**
- File: `.github/skills/zeroize-audit/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill zeroize-audit -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/zeroize-audit/skills/zeroize-audit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/zeroize-audit/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill zeroize-audit -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/zeroize-audit/skills/zeroize-audit/SKILL.md

## When to use it
- find keys and passwords still sitting in memory after use
- check whether the compiler dropped a secret wipe
- back an optimized-away finding with IR or assembly evidence
- trace where copies of secret values end up
- generate a runtime test that catches the leak

## Example prompts
- Audit this crate for secrets left in memory
- Check that this C library actually wipes its keys
- Run zeroize-audit against `compile_commands.json` and show me the report

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md