zeroize-audit - Audit sensitive-data zeroization in native code
Audits C, C++, and Rust code for missing or compiler-removed zeroization using source, IR, assembly, and control-flow evidence.
Tags
Updated: 2026-10-08Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Detect missing zeroization
- Identify optimized-away wipes
- Analyze assembly retention
- Track sensitive-data copies
- Analyze allocator usage
- Analyze semantic LLVM IR
- Verify control-flow coverage
- Generate validation tests
- Generate finding PoCs
Inputs
- Repository root
- Compilation database
- Rust Cargo manifest
- Analysis configuration
- Optimization levels
- Target languages
- Translation-unit limit
- MCP mode
- PoC categories
- PoC output directory
- Assembly-analysis setting
- Semantic-IR setting
- CFG-analysis setting
- Runtime-test setting
Outputs
- Structured JSON report
- Temporary analysis artifacts
- Generated proof-of-concept files
- Generated runtime test harnesses
Requirements
- Compilable C/C++ translation units
- compile_commands.json or Cargo.toml
- Clang toolchain
- Required analysis scripts
- LLVM IR emission support
- Rust nightly toolchain for Rust analysis
- Cargo build success for Rust crates
- Python or uv tooling
- Temporary working-directory access
- MCP tooling for MCP-enabled analysis