Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vigolium/piolium/zeroize-auditnpx skills add vigolium/piolium --skill zeroize-auditgit clone --depth 1 https://github.com/vigolium/pioliumWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vigolium/piolium/zeroize-audit)<a href="https://agentmods.dev/skills/vigolium/piolium/zeroize-audit"><img src="https://agentmods.dev/badge/skills/vigolium/piolium/zeroize-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.05497 |
| Opus 5 | $0.00028 | $0.02749 |
| Sonnet 5 | $0.00011 | $0.01099 |
| Haiku 4.5 | $0.00006 | $0.00550 |
Grade A, and why
zeroize-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 372 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zeroize-audit — Claude Skill
When to Use
- Auditing cryptographic implementations (keys, seeds, nonces, secrets)
- Reviewing authentication systems (passwords, tokens, session data)
- Analyzing code that handles PII or sensitive credentials
- Verifying secure cleanup in security-critical codebases
- Investigating memory safety of sensitive data handling
When NOT to Use
- General code review without security focus
- Performance optimization (unless related to secure wiping)
- Refactoring tasks not related to sensitive data
- Code without identifiable secrets or sensitive values
Purpose
Detect missing zeroization of sensitive data in source code and identify zeroization that is removed or weakened by compiler optimizations (e.g., dead-store elimination), with mandatory LLVM IR/asm evidence. Capabilities include:
- Assembly-level analysis for register spills and stack retention
- Data-flow tracking for secret copies
- Heap allocator security warnings
- Semantic IR analysis for loop unrolling and SSA form
- Control-flow graph analysis for path coverage verification
- Runtime validation test generation
Scope
- Read-only against the target codebase (does not modify audited code; writes analysis artifacts to a temporary working directory).
- Produces a structured report (JSON).
- Requires valid build context (
compile_commands.json) and compilable translation units. - "Optimized away" findings only allowed with compiler evidence (IR/asm diff).
Inputs
See {baseDir}/schemas/input.json for the full schema. Key fields:
| Field | Required | Default | Description |
|---|---|---|---|
path |
yes | — | Repo root |
compile_db |
no | null |
Path to compile_commands.json for C/C++ analysis. Required if cargo_manifest is not set. |
cargo_manifest |
no | null |
Path to Cargo.toml for Rust crate analysis. Required if compile_db is not set. |
config |
no | — | YAML defining heuristics and approved wipes |
opt_levels |
no | ["O0","O1","O2"] |
Optimization levels for IR comparison. O1 is the diagnostic level: if a wipe disappears at O1 it is simple DSE; O2 catches more aggressive eliminations. |
languages |
no | ["c","cpp","rust"] |
Languages to analyze |
max_tus |
no | — | Limit on translation units processed from compile DB |
mcp_mode |
no | prefer |
off, prefer, or require — controls Serena MCP usage |
mcp_required_for_advanced |
no | true |
Downgrade SECRET_COPY, MISSING_ON_ERROR_PATH, and NOT_DOMINATING_EXITS to needs_review when MCP is unavailable |
mcp_timeout_ms |
no | — | Timeout budget for MCP semantic queries |
poc_categories |
no | all 11 exploitable | Finding categories for which to generate PoCs. C/C++ findings: all 11 categories supported. Rust findings: only MISSING_SOURCE_ZEROIZE, SECRET_COPY, and PARTIAL_WIPE are supported; other Rust categories are marked poc_supported=false. |
poc_output_dir |
no | generated_pocs/ |
Output directory for generated PoCs |
enable_asm |
no | true |
Enable assembly emission and analysis (Step 8); produces STACK_RETENTION, REGISTER_SPILL. Auto-disabled if emit_asm.sh is missing. |
enable_semantic_ir |
no | false |
Enable semantic LLVM IR analysis (Step 9); produces LOOP_UNROLLED_INCOMPLETE |
enable_cfg |
no | false |
Enable control-flow graph analysis (Step 10); produces MISSING_ON_ERROR_PATH, NOT_DOMINATING_EXITS |
enable_runtime_tests |
no | false |
Enable runtime test harness generation (Step 11) |
What ships with it
47 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- configs/c.yaml 456 B
- configs/default.yaml 3.9 KB
- configs/rust.yaml 3.2 KB
- prompts/report_template.md 6.5 KB
- prompts/system.md 7.9 KB
- prompts/task.md 4.3 KB
- references/compile-commands.md 9.9 KB
- references/detection-strategy.md 9.9 KB
- references/ir-analysis.md 11 KB
- references/mcp-analysis.md 9.0 KB
- references/poc-generation.md 21 KB
- references/rust-zeroization-patterns.md 35 KB
- schemas/input.json 3.1 KB
- schemas/output.json 5.9 KB
- tools/analyze_asm.sh 5.2 KB runs code
- tools/analyze_cfg.py 13 KB runs code
- tools/analyze_heap.sh 5.4 KB runs code
- tools/analyze_ir_semantic.py 15 KB runs code
- tools/diff_ir.sh 4.0 KB runs code
- tools/diff_rust_mir.sh 6.2 KB runs code
- tools/emit_asm.sh 1.0 KB runs code
- tools/emit_ir.sh 1.3 KB runs code
- tools/emit_rust_asm.sh 4.2 KB runs code
- tools/emit_rust_ir.sh 3.3 KB runs code
- tools/emit_rust_mir.sh 3.5 KB runs code
- tools/extract_compile_flags.py 8.6 KB runs code
- tools/generate_poc.py 47 KB runs code
- tools/mcp/apply_confidence_gates.py 3.3 KB runs code
- tools/mcp/check_mcp.sh 1.2 KB runs code
- tools/mcp/normalize_mcp_evidence.py 3.8 KB runs code
- tools/scripts/check_llvm_patterns.py 17 KB runs code
- tools/scripts/check_mir_patterns.py 19 KB runs code
- tools/scripts/check_rust_asm_aarch64.py 10 KB runs code
- tools/scripts/check_rust_asm_x86.py 9.4 KB runs code
- tools/scripts/check_rust_asm.py 16 KB runs code
- tools/scripts/find_dangerous_apis.py 14 KB runs code
- tools/scripts/semantic_audit.py 32 KB runs code
- tools/track_dataflow.sh 5.1 KB runs code
- tools/validate_rust_toolchain.sh 8.2 KB runs code
- workflows/phase-0-preflight.md 7.3 KB
- workflows/phase-1-source-analysis.md 4.7 KB
- workflows/phase-2-compiler-analysis.md 5.3 KB
- workflows/phase-3-interim-report.md 1.0 KB
- workflows/phase-4-poc-generation.md 1.2 KB
- workflows/phase-5-poc-validation.md 4.0 KB
- workflows/phase-6-final-report.md 1.0 KB
- workflows/phase-7-test-generation.md 769 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 372 lines · 57 tokens per session scan A 5fcd131e2509
zeroize-audit is a skill published in the GitHub repository vigolium/piolium (132 stars, last pushed 1mo ago), licensed MIT. It adds 57 tokens to every session and 5,497 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…