--- title: "Zeroize audit: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-zeroize-audit/ description: "Looks for secrets that source claims to wipe but the compiler deleted." --- # Zeroize audit: review, setup & limitations · Undominated.ai > Looks for secrets that source claims to wipe but the compiler deleted. [← Explore all skills](/skills/) SECURITY REVIEW / Trail of Bits # Zeroize audit Looks for secrets that source claims to wipe but the compiler deleted. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/zeroize-audit/skills/zeroize-audit) SOURCE REVIEW Reviewed 2026-10-14 Evidence 3 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Revision 82fe82262526 [Read what was—and wasn’t—checked ↓](#review) “Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/zeroize-audit/skills/zeroize-audit/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The description names compiler-removed zeroization, not only a missing function call. - Headings include When NOT to Use and a stated Scope. ### A good fit for - Auditing C, C++ or Rust that handles keys - Refusing a source-only claim that a secret was wiped - Trace secret copies and compare wipe behavior across compiler optimization levels ### Weigh up before choosing - CC-BY-SA-4.0 applies to adaptations you redistribute. - No binary was disassembled in this review. - Missing compile context blocks meaningful analysis. Translation-unit limits and unsupported Rust proof-of-concept categories restrict coverage. - Claims that a wipe was optimized away require IR or assembly evidence; source-level intent alone cannot establish it. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/zeroize-audit/skills/zeroize-audit/SKILL.md - README.md - LICENSE ### Our findings - Description covers C, C++ and Rust secrets, keys and passwords. - Headings include How to Run and Inputs. - The input/prerequisite tables require build context, bound translation units and distinguish supported Rust PoC categories; advanced findings are downgraded when required semantic support is absent. - The hard-evidence table ties OPTIMIZED_AWAY_ZEROIZE, STACK_RETENTION, and REGISTER_SPILL to IR or assembly excerpts, not to a source-level impression. ### Not established by this review - The skill was not executed inside a host agent. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md) DOCUMENTED COMMAND /plugin marketplace add trailofbits/skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - In Claude Code, add the upstream marketplace, then use /plugin menu to select the zeroize-audit plugin. Adding a marketplace alone does not install a plugin. - The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow. - Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task. ### Before you start - The complete zeroize-audit plugin; Clang/compile_commands.json for C/C++ or a buildable Cargo crate and nightly Rust, plus uv for Rust helpers. ### Compatibility Claude Code plugin workflow · Other hosts require compatible plugin/tool support ### Local Markdown instructions - Read the installed skill files - Read target source; invoke compiler tools and analysis workers; write intermediate IR, assembly, reports and optional generated runtime tests. ### Cost model Source is free to read under the stated licence. A host agent may charge for use. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/zeroize-audit/skills/zeroize-audit/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/zeroize-audit/skills/zeroize-audit/SKILL.md Supports: Workflow and stated scope - [Repository licence ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Checked 2026-10-07 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE Supports: Redistribution terms - [Install instructions ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md) Checked 2026-10-07 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md Supports: Documented install path KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Constant-time analysis ↗ Routes a timing review by language and says when not to use the analyzer.](/skills/trailofbits-constant-time-analysis/)[### Project Wycheproof ↗ Loads Project Wycheproof vectors and maps valid, invalid, and acceptable results onto pass, fail, and warning, instead of treating a custom algorithm as in scope.](/skills/trailofbits-wycheproof/)[### Algorand vulnerability scanner ↗ Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.](/skills/trailofbits-algorand-vulnerability-scanner/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)