sickn33/antigravity-awesome-skills/zeroize-audit

Supporting material availability

This catalog copy contains the inline guidance below, but does not include the referenced supporting paths, including tools/, schemas/, configs/, prompts/, workflows/ and references/detection-strategy.md. They are external prerequisites, not bundled files:

Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.

⚠️ AUTHORIZED USE ONLY

This skill is for educational purposes or authorized security assessments only.

You must have explicit, written permission from the system owner before using this tool.

Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate

Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.

2. Ask the user to confirm written authorization and the permitted scope.

3. Show the exact command(s) and explain their expected effect.

4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

zeroize-audit — Claude Skill

When to Use

• Auditing cryptographic implementations (keys, seeds, nonces, secrets)
• Reviewing authentication systems (passwords, tokens, session data)
• Analyzing code that handles PII or sensitive credentials
• Verifying secure cleanup in security-critical codebases
• Investigating memory safety of sensitive data handling

When NOT to Use

• General code review without security focus
• Performance optimization (unless related to secure wiping)
• Refactoring tasks not related to sensitive data
• Code without identifiable secrets or sensitive values

Purpose

Detect missing zeroization of sensitive data in source code and identify zeroization that is removed or weakened by compiler optimizations (e.g., dead-store elimination), with mandatory LLVM IR/asm evidence. Capabilities include:

• Assembly-level analysis for register spills and stack retention
• Data-flow tracking for secret copies
• Heap allocator security warnings
• Semantic IR analysis for loop unrolling and SSA form
• Control-flow graph analysis for path coverage verification
• Runtime validation test generation

Scope

• Read-only against the target codebase (does not modify audited code; writes analysis artifacts to a temporary working directory).
• Produces a structured report (JSON).
• Requires valid build context (compile_commands.json) and compilable translation units.
• "Optimized away" findings only allowed with compiler evidence (IR/asm diff).

Inputs

See {baseDir}/schemas/input.json for the full schema. Key fields:

Prerequisites

Before running, verify the following. Each has a defined failure mode.

C/C++ prerequisites:

Rust prerequisites:

Common prerequisite:

Approved Wipe APIs

The following are recognized as valid zeroization. Configure additional entries in {baseDir}/configs/.

C/C++

• explicit_bzero
• memset_s
• SecureZeroMemory
• OPENSSL_cleanse
• sodium_memzero
• Volatile wipe loops (pattern-based; see volatile_wipe_patterns in {baseDir}/configs/default.yaml)
• In IR: llvm.memset with volatile flag, volatile stores, or non-elidable wipe call

Rust

• zeroize::Zeroize trait (zeroize() method)
• Zeroizing<T> wrapper (drop-based)
• ZeroizeOnDrop derive macro

Finding Capabilities

Findings are grouped by required evidence. Only attempt findings for which the required tooling is available.

Agent Architecture

The analysis pipeline uses 11 agents across 8 phases, invoked by the orchestrator ({baseDir}/prompts/task.md) via Task. Agents write persistent finding files to a shared working directory (/tmp/zeroize-audit-{run_id}/), enabling parallel execution and protecting against context pressure.