insecure-defaults

Detect insecure default configurations in production deployments and report remediation steps.

15|5|Updated May 17, 2026

Search Tags:#configuration #error-handling #cors #csrf #security-audit #fail-open #insecure-defaults

Ready to run

npx skills add https://github.com/cropsgg/skills --skill insecure-defaults-cropsgg

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/cropsgg/skills/tree/main/skills/engineering/insecure-defaults
Command: npx skills add https://github.com/cropsgg/skills --skill insecure-defaults-cropsgg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Insecure defaults in configurations create production risk. This skill helps teams detect and remediate patterns such as debug mode in production, permissive CORS, disabled CSRF, default admin credentials, verbose error messages, and unauthenticated health endpoints.

Core Features & Use Cases

Configuration-wide audit across environment files, manifests, and service settings to surface insecure defaults.
Prioritized findings with secure defaults and actionable remediation guidance for security engineers and DevOps.
Use Case: Before go-live, run the audit to surface all fail-open patterns and apply fixes.

Quick Start

Run an insecure-defaults audit against the production configuration to surface insecure defaults and recommended fixes.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit configuration files for insecure defaults before production deployment?▼

Audit configuration files for insecure defaults by scanning environment settings and deployed services to detect debug flags, permissive CORS, disabled CSRF, and default admin credentials. The skill generates a prioritized findings report with secure defaults and concrete remediation steps to apply before go-live.

What insecure default configurations create production risk in deployed services?▼

Insecure default configurations creating production risk include debug mode in production, permissive CORS, disabled CSRF, default admin credentials, verbose error messages, and unauthenticated health endpoints. Identifying these fail-open patterns across manifests and service settings hardens deployments against unauthorized access and information leakage.

How do I detect permissive CORS and disabled CSRF in environment settings?▼

Detect permissive CORS and disabled CSRF by running a configuration-wide audit across environment files, manifests, and service settings. The skill surfaces these insecure defaults and provides actionable remediation guidance with secure default values for security engineers and DevOps teams to implement.

Does this security audit work for pre-existing production deployments or only pre-launch configurations?▼

This security audit works for both pre-existing production deployments and pre-launch configurations. It applies across configuration files, environment settings, and deployed services to identify insecure defaults like verbose error messages and unauthenticated health endpoints, providing prioritized findings with secure defaults at any stage.

What's the best way to remediate default admin credentials and unauthenticated health endpoints?▼

The best way to remediate default admin credentials and unauthenticated health endpoints is to run an insecure-defaults audit that surfaces these vulnerabilities. The skill provides a prioritized findings report containing secure defaults and concrete remediation steps to replace credentials and secure endpoints.

When should I run an insecure defaults audit during the deployment lifecycle?▼

Run an insecure defaults audit before go-live to surface all fail-open patterns and apply fixes. The audit identifies insecure default configurations across environment files, manifests, and service settings, delivering a prioritized findings report with secure defaults and actionable remediation guidance for hardening deployments.