domains / families / security / zeroize-audit

zeroize-audit

combined

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

When to use

• Auditing cryptographic implementations (keys, seeds, nonces, secrets)
• Reviewing authentication systems (passwords, tokens, session data)
• Analyzing code that handles PII or sensitive credentials
• Verifying secure cleanup in security-critical codebases
• Investigating memory safety of sensitive data handling
• Assembly-level analysis for register spills and stack retention
• Data-flow tracking for secret copies
• Heap allocator security warnings

When not to use

• General code review without security focus
• Performance optimization (unless related to secure wiping)
• Refactoring tasks not related to sensitive data
• Code without identifiable secrets or sensitive values
• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Skill page

Conflict

The trailofbits copy is the operational source: it defines the Execution Contract, the phase loop (Phases 0-8), the orchestrator prompt, and the worker dispatch model. The sickn33 copy is a catalog mirror that omits the execution engine but adds a detailed Inputs table, a Prerequisites section, and a mandatory authorization gate. Because the trailofbits copy is truncated before the Inputs table and the sickn33 copy lacks the phase execution logic, neither is a complete reproduction of the other; combining them is necessary to preserve both the execution procedure and the input/authorization constraints.