Zeroize Audit — Security skill for Claude Code

zeroize-audit (Claude Skill)

Audits C/C++/Rust code for missing zeroization and compiler-removed wipes. Pipeline: source scan → MCP/LSP semantic context → IR diff → assembly/MIR checks.

Findings

• MISSING_SOURCE_ZEROIZE, PARTIAL_WIPE, NOT_ON_ALL_PATHS
• OPTIMIZED_AWAY_ZEROIZE (IR evidence required)
• REGISTER_SPILL, STACK_RETENTION (assembly evidence required for C/C++; LLVM IR evidence for Rust + optional assembly corroboration)
• SECRET_COPY, INSECURE_HEAP_ALLOC
• MISSING_ON_ERROR_PATH, NOT_DOMINATING_EXITS, LOOP_UNROLLED_INCOMPLETE

Prerequisites

C/C++

• compile_commands.json is required (compile_db input field).
• Codebase must be buildable with commands from the compile DB.
• Required tools: clang, uvx (for Serena MCP server), python3.

which clang uvx python3

Rust

• Cargo.toml path is required (cargo_manifest input field).
• Crate must be buildable (cargo check passes).
• Required tools: cargo +nightly toolchain, uv.

# Quick check
cargo +nightly --version
uv --version

# Full preflight validation (checks all tools, scripts, and optionally crate build)
tools/validate_rust_toolchain.sh --manifest path/to/Cargo.toml
tools/validate_rust_toolchain.sh --manifest path/to/Cargo.toml --json  # machine-readable

Generate compile_commands.json (C/C++)

**CMake**

cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON

**Make/Bear**

bear -- make -j$(nproc)

Usage

**C/C++ only:**

{ "path": ".", "compile_db": "compile_commands.json" }

**Rust only:**

{ "path": ".", "cargo_manifest": "Cargo.toml" }

**Mixed C/C++ + Rust:**

{
  "path": ".",
  "compile_db": "compile_commands.json",
  "cargo_manifest": "Cargo.toml",
  "opt_levels": ["O0", "O1", "O2"],
  "mcp_mode": "prefer"
}

**Full C/C++ input:**

{
  "path": ".",
  "compile_db": "compile_commands.json",
  "opt_levels": ["O0", "O1", "O2"],
  "languages": ["c", "cpp"],

...