skills.rest
ashwnn
ashwnnCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

insecure-defaults

Scan codebases for hardcoded secrets, weak cryptography, permissive policies, and debug flags.

Updated Aug 23, 2026
Search Tags:#debug#secrets#credentials#security-review#code-scan#detect#insecure-defaults
One-click install
npx skills add https://github.com/ashwnn/agent-config --skill insecure-defaults-ashwnn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/ashwnn/agent-config/tree/main/skills/insecure-defaults
Command: npx skills add https://github.com/ashwnn/agent-config --skill insecure-defaults-ashwnn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Systematically surfaces configurations that are insecure by default: hardcoded credentials, weak crypto, permissive policies, and debug modes left enabled. Run this on any new codebase or before a release.

Core Features & Use Cases

  • Detect hardcoded secrets and credentials across common languages and config files
  • Flag weak cryptographic patterns and insecure TLS settings
  • Identify overly permissive policies and debug modes in production-ready code
  • Produce triage-ready findings with clear remediation guidance for developers and security teams

Quick Start

Run the insecure-defaults skill on a repository to automatically scan for insecure defaults and generate a findings report.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a codebase for hardcoded secrets and insecure defaults?▼

Scan codebases for hardcoded secrets by running an automated security review that detects insecure default configurations, weak cryptography, and debug flags, returning a structured findings report with remediation guidance.

Does insecure defaults detection work with Go, TypeScript, Python, and YAML configurations?▼

Insecure defaults detection supports Go, TypeScript, Python, C#, YAML, and environment configurations, systematically surfacing hardcoded credentials, weak crypto, and permissive policies across these languages and config files.

How do I detect weak cryptography and debug flags before a release?▼

Detect weak cryptography and debug flags by running a pre-release code scan that flags insecure TLS settings and debug modes, producing triage-ready findings with concrete remediation recommendations for security teams.

What is the best way to generate triage-ready findings for a security review?▼

Generate triage-ready findings by scanning for insecure defaults across new projects, which automatically produces a structured report detailing hits, triage guidance, and concrete remediation recommendations for developers.

Why should I check for overly permissive policies in production-ready code?▼

Check for overly permissive policies to prevent security vulnerabilities caused by insecure default configurations, ensuring that debug modes and permissive access controls are disabled before code reaches production.

Related Skills

Explore More Software Engineering Skills→
riftzen-bitriftzen-bit

configure-ecc

Install and configure Everything Gemini Code components with verification and optional optimization.

Community
Advanced
psd401psd401
2

review-pr

Aggregate pull request feedback into a structured remediation plan.

Official
Advanced
icartshicartsh
4

code-analyze

Analyze .NET solutions for code quality, security, and dependency issues.

Community
Advanced
lciaccilciacci

cpg-analysis

Analyze control flow, data flow, and security vulnerabilities using Joern or CodeQL.

Community
Advanced