insecure-defaults

Name: insecure-defaults
Availability: InStock
Author: ashwnn

Scan codebases for hardcoded secrets, weak cryptography, permissive policies, and debug flags.

Updated Aug 23, 2026

Search Tags:#debug #secrets #credentials #security-review #code-scan #detect #insecure-defaults

Ready to run

npx skills add https://github.com/ashwnn/agent-config --skill insecure-defaults-ashwnn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/ashwnn/agent-config/tree/main/skills/insecure-defaults
Command: npx skills add https://github.com/ashwnn/agent-config --skill insecure-defaults-ashwnn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Systematically surfaces configurations that are insecure by default: hardcoded credentials, weak crypto, permissive policies, and debug modes left enabled. Run this on any new codebase or before a release.

Core Features & Use Cases

Detect hardcoded secrets and credentials across common languages and config files
Flag weak cryptographic patterns and insecure TLS settings
Identify overly permissive policies and debug modes in production-ready code
Produce triage-ready findings with clear remediation guidance for developers and security teams

Quick Start

Run the insecure-defaults skill on a repository to automatically scan for insecure defaults and generate a findings report.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a codebase for hardcoded secrets and insecure defaults?▼

Scan codebases for hardcoded secrets by running an automated security review that detects insecure default configurations, weak cryptography, and debug flags, returning a structured findings report with remediation guidance.

Does insecure defaults detection work with Go, TypeScript, Python, and YAML configurations?▼

Insecure defaults detection supports Go, TypeScript, Python, C#, YAML, and environment configurations, systematically surfacing hardcoded credentials, weak crypto, and permissive policies across these languages and config files.

How do I detect weak cryptography and debug flags before a release?▼

Detect weak cryptography and debug flags by running a pre-release code scan that flags insecure TLS settings and debug modes, producing triage-ready findings with concrete remediation recommendations for security teams.

What is the best way to generate triage-ready findings for a security review?▼

Generate triage-ready findings by scanning for insecure defaults across new projects, which automatically produces a structured report detailing hits, triage guidance, and concrete remediation recommendations for developers.

Why should I check for overly permissive policies in production-ready code?▼

Check for overly permissive policies to prevent security vulnerabilities caused by insecure default configurations, ensuring that debug modes and permissive access controls are disabled before code reaches production.