- Installs
- 50
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/gmh5225/awesome-llvm-security --skill llvm-security- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads llvm-security automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
LLVM Security Skill
This skill covers LLVM-based security features, sanitizers, hardening mechanisms, and secure software development practices.
Sanitizers
AddressSanitizer (ASan)
Detects memory errors: buffer overflow, use-after-free, use-after-scope.
# Compile with ASan
clang -fsanitize=address -g program.c -o program
# Key features
# - Stack buffer overflow detection
# - Heap buffer overflow detection
# - Use-after-free detection
# - Memory leak detection
MemorySanitizer (MSan)
Detects uninitialized memory reads.
clang -fsanitize=memory -g program.c -o program
ThreadSanitizer (TSan)
Detects data races in multithreaded programs.
clang -fsanitize=thread -g program.c -o program
UndefinedBehaviorSanitizer (UBSan)
Detects undefined behavior at runtime.
clang -fsanitize=undefined -g program.c -o program
# Specific checks
clang -fsanitize=signed-integer-overflow,null program.c
Custom Sanitizer Development
// Implementing custom memory tracking
extern "C" void __asan_poison_memory_region(void const volatile *addr, size_t size);
extern "C" void __asan_unpoison_memory_region(void const volatile *addr, size_t size);
class SecureAllocator {
public:
void* allocate(size_t size) {
// Add red zones around allocation
void* ptr = malloc(size + 2 * REDZONE_SIZE);
__asan_poison_memory_region(ptr, REDZONE_SIZE);
__asan_poison_memory_region((char*)ptr + REDZONE_SIZE + size, REDZONE_SIZE);
return (char*)ptr + REDZONE_SIZE;
}
};
Hardening Techniques
Stack Protection
# Stack canaries
clang -fstack-protector-strong program.c
# Stack clash protection
clang -fstack-clash-protection program.c
# Safe stack (separate stacks for safe/unsafe data)
clang -fsanitize=safe-stack program.c
Control Flow Integrity (CFI)
# Forward-edge CFI
clang -fsanitize=cfi -flto program.c
# Specific CFI schemes
clang -fsanitize=cfi-vcall # Virtual call checks
clang -fsanitize=cfi-nvcall # Non-virtual member call checks
clang -fsanitize=cfi-icall # Indirect call checks
Shadow Call Stack
# Backward-edge protection (return address protection)
clang -fsanitize=shadow-call-stack program.c
Position Independent Executables
# Full ASLR support
clang -fPIE -pie program.c
# Position independent code for shared libraries
clang -fPIC -shared library.c -o library.so
Symbolic Execution
Integration with KLEE
// Mark symbolic inputs
#include <klee/klee.h>
int main() {
int input;
klee_make_symbolic(&input, sizeof(input), "input");
if (input > 0) {
// Path 1
} else {
// Path 2
}
return 0;
}
SymCC (Symbolic Execution via Compilation)
Compile-time instrumentation for symbolic execution:
- Faster than IR interpretation
- Supports complex real-world programs
- Integrates with fuzzing workflows
Symbolic Analysis Tools
- Caffeine: LLVM-based symbolic executor
- SymSan: Symbolic execution + sanitizers
- Haybale: Rust-based LLVM symbolic executor
Security-Focused Analysis
Type Checking at Runtime
// LLVM TypeSanitizer concepts
// Track type information through allocations
struct TypeInfo {
const char* typeName;
size_t typeSize;
uint64_t typeHash;
};
void checkType(void* ptr, TypeInfo expected) {
TypeInfo* actual = getTypeInfo(ptr);
if (actual->typeHash != expected.typeHash) {
reportTypeMismatch(ptr, actual, expected);
}
}
Memory Leak Detection
// LeakSanitizer integration
extern "C" void __lsan_do_leak_check();
extern "C" void __lsan_disable();
extern "C" void __lsan_enable();
// Custom leak tracking
class PreciseLeakSanitizer {
std::unordered_map<void*, AllocationInfo> allocations;
public:
void recordAlloc(void* ptr, size_t size, const char* file, int line) {
allocations[ptr] = {size, file, line, getStackTrace()};
}
void recordFree(void* ptr) {
allocations.erase(ptr);
}
void reportLeaks() {
for (auto& [ptr, info] : allocations) {
fprintf(stderr, "Leak: %zu bytes at %s:%d\n",
info.size, info.file, info.line);
}
}
};
Exploit Mitigation Implementation
Return Address Protection
; Shadow stack concept in LLVM IR
define void @protected_function() {
entry:
%return_addr = call ptr @llvm.returnaddress(i32 0)
call void @shadow_stack_push(ptr %return_addr)
; Function body...
%saved_addr = call ptr @shadow_stack_pop()
%current_addr = call ptr @llvm.returnaddress(i32 0)
%match = icmp eq ptr %saved_addr, %current_addr
br i1 %match, label %safe_return, label %attack_detected
safe_return:
ret void
attack_detected:
call void @abort()
unreachable
}
Pointer Authentication (ARM)
// Using pointer authentication on ARM64
__attribute__((target("sign-return-address")))
void signed_function() {
// Return address is cryptographically signed
}
Secure Compilation Pipeline
Build Flags Checklist
# Comprehensive hardening
CFLAGS="-O2 \
-fstack-protector-strong \
-fstack-clash-protection \
-fcf-protection=full \
-fPIE \
-D_FORTIFY_SOURCE=2 \
-Wformat -Wformat-security \
-fsanitize=cfi -flto"
LDFLAGS="-pie \
-Wl,-z,relro \
-Wl,-z,now \
-Wl,-z,noexecstack"
Compiler Security Checks
-Wformat-security: Format string vulnerabilities-Warray-bounds: Array bounds violations-Wshift-overflow: Shift operation overflows-Wnull-dereference: Null pointer dereferences
Fuzzing Integration
libFuzzer
// Fuzz target template
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
// Parse/process Data
processInput(Data, Size);
return 0;
}
Sanitizer + Fuzzer Combination
# Comprehensive fuzzing setup
clang -fsanitize=fuzzer,address,undefined \
-fno-omit-frame-pointer \
-g fuzz_target.c -o fuzzer
Windows-Specific Security
Control Flow Guard (CFG)
clang-cl /guard:cf program.c
SEH (Structured Exception Handling)
- LLVM supports Windows SEH
- Use for secure exception handling
- Integrate with security monitoring
Resources
See Security Features, Sanitizer, and Symbolic Execution sections in README.md for comprehensive tool listings.
Getting Detailed Information
When you need detailed and up-to-date resource links, tool lists, or project references, fetch the latest data from:
https://raw.githubusercontent.com/gmh5225/awesome-llvm-security/refs/heads/main/README.md
This README contains comprehensive curated lists of:
- Security features and hardening (Security Features section)
- Sanitizers and memory safety tools (Sanitizer section)
- Symbolic execution frameworks (Symbolic Execution section)
- Memory leak detectors and runtime checkers
FAQ
What does the llvm-security skill do?
Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation. Use this skill when implementing security-focused compiler features, analyzing vulnerabilities, or hardening applications.
How do I install llvm-security?
Run npx skills add https://github.com/gmh5225/awesome-llvm-security --skill llvm-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/llvm-security/ (personal) or .claude/skills/llvm-security/ (project).
Which AI agents can use llvm-security?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is llvm-security safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains llvm-security?
It is published by gmh5225 in gmh5225/awesome-llvm-security. It has 50 recorded installs.
More from gmh5225/awesome-llvm-security
llvm-obfuscation
gmh5225/awesome-llvm-security
Open the skill to read its SKILL.md instructions.
compiler-development
gmh5225/awesome-llvm-security
Expertise in compiler development using LLVM infrastructure including frontend design, IR generation, optimization passes, and code generation. Use this skill when building custom programming languages, implementing DSL compilers, or working on compiler internals.
binary-lifting
gmh5225/awesome-llvm-security
Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations.
llvm-optimization
gmh5225/awesome-llvm-security
Expertise in LLVM optimization passes, performance tuning, and code transformation techniques. Use this skill when implementing custom optimizations, analyzing pass behavior, improving generated code quality, or understanding LLVM's optimization pipeline.
llvm-learning
gmh5225/awesome-llvm-security
Comprehensive learning resources and tutorials for LLVM, Clang, and compiler development. Use this skill when helping users learn LLVM internals, find educational resources, or understand compiler concepts.
static-analysis
gmh5225/awesome-llvm-security
Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.