SECURITY REVIEW / Trail of Bits
Zeroize audit
Looks for secrets that source claims to wipe but the compiler deleted.
“Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.”
01 / THE REASONING
Why this made the selection.
- The description names compiler-removed zeroization, not only a missing function call.
- Headings include When NOT to Use and a stated Scope.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/zeroize-audit/skills/zeroize-audit/SKILL.md
- README.md
- LICENSE
Our findings
- Description covers C, C++ and Rust secrets, keys and passwords.
- Headings include How to Run and Inputs.
- The input/prerequisite tables require build context, bound translation units and distinguish supported Rust PoC categories; advanced findings are downgraded when required semantic support is absent.
- The hard-evidence table ties OPTIMIZED_AWAY_ZEROIZE, STACK_RETENTION, and REGISTER_SPILL to IR or assembly excerpts, not to a source-level impression.
Not established by this review
- The skill was not executed inside a host agent.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- In Claude Code, add the upstream marketplace, then use /plugin menu to select the zeroize-audit plugin. Adding a marketplace alone does not install a plugin.
- The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow.
- Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task.
Before you start
- The complete zeroize-audit plugin; Clang/compile_commands.json for C/C++ or a buildable Cargo crate and nightly Rust, plus uv for Rust helpers.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/zeroize-audit/skills/zeroize-audit/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: Redistribution terms
- Install instructions ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md
Supports: Documented install path