zeroize-audit - Audit zeroization of sensitive data
Audits C, C++, and Rust code for missing or compiler-removed zeroization using source, IR, assembly, and control-flow analysis.
Tags
Updated: 2026-10-08Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Detect missing zeroization
- Track secret data copies
- Compare optimized IR
- Analyze assembly retention
- Verify cleanup control flow
- Generate runtime validation tests
- Generate finding proof-of-concepts
Inputs
- Repository root
- Compilation database
- Rust Cargo manifest
- Analysis configuration
- Optimization levels
- Target languages
- Translation unit limit
- MCP usage mode
- Finding categories
- PoC output directory
- Assembly analysis option
- Semantic IR analysis option
- Control-flow analysis option
- Runtime test option
Outputs
- Structured JSON report
- Finding files
- Analysis artifacts
- Generated proof-of-concepts
- Generated runtime test harnesses
Requirements
- Compilable C/C++ translation units
- compile_commands.json or Cargo.toml
- clang for C/C++ analysis
- Required analysis scripts
- LLVM IR emission tools
- Rust nightly toolchain
- cargo check success for Rust
- PoC generation tool
- Temporary working directory access