insecure-defaults

Detects fail-open insecure default configurations in code.

1|Updated Sep 25, 2025

Search Tags:#code review #security #secrets management #vulnerability detection #configuration audit #insecure defaults

Ready to run

npx skills add https://github.com/arroschaves/brandaocontador-site --skill insecure-defaults-arroschaves

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/arroschaves/brandaocontador-site/tree/main/.agent/skills/trailofbits-insecure-defaults
Command: npx skills add https://github.com/arroschaves/brandaocontador-site --skill insecure-defaults-arroschaves

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies critical security vulnerabilities where applications might run with insecure default configurations, such as hardcoded secrets or weak authentication, which could be exploited in production environments.

Core Features & Use Cases

Detect Fail-Open Vulnerabilities: Pinpoints configurations that allow an application to run insecurely when a proper setting is missing, distinguishing them from fail-secure patterns that cause a safe crash.
Security Audits & Code Review: Essential for auditing production applications, reviewing configuration management, analyzing environment variable handling, and performing code reviews focused on secrets management.
Use Case: Automatically scan a codebase for instances where API keys or database passwords have fallback values that are insecure and could be exposed if environment variables are not correctly set in production.

Quick Start

Scan the current directory for insecure default configurations in Python and JavaScript files.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for hardcoded secrets and default credentials?▼

To detect insecure default configurations, the Skill searches for fail-open vulnerabilities, disabled security features, and weak cryptography. It validates these findings by tracing code paths to confirm whether the application runs insecurely in production when settings are missing.

What are fail-open vulnerabilities in application configuration?▼

Fail-open vulnerabilities are insecure default configurations that allow an application to run insecurely when a proper setting is missing. The Skill pinpoints these patterns, distinguishing them from fail-secure configurations that cause a safe crash.

Can I audit environment variable handling for weak authentication settings?▼

Yes, you can audit environment variable handling for weak authentication settings. The Skill reviews configuration management to find instances where API keys or database passwords have insecure fallback values exposed if environment variables are not set.

How does code review for secrets management identify exposed debug modes?▼

Code review for secrets management identifies exposed debug modes by analyzing code for permissive security settings and disabled security features. It validates findings by tracing code paths to confirm the actual runtime behavior and production impact.

Does this configuration audit work with Python and JavaScript files?▼

Yes, the configuration audit works with Python and JavaScript files. It scans the current directory to detect weak cryptography, hardcoded secrets, and insecure defaults, tracing code paths to validate runtime behavior across these languages.