insecure-defaults

Identify insecure default configurations in source code, IaC templates, and deployment scripts.

9|2|Updated Mar 12, 2026

Search Tags:#devsecops #security-audit #risk-analysis #config-validation #secret-management #insecure-defaults

Ready to run

npx skills add https://github.com/hongmaple0820/agent-academy --skill insecure-defaults-hongmaple0820

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/hongmaple0820/agent-academy/tree/main/skills/security-testing/insecure-defaults/skills/insecure-defaults
Command: npx skills add https://github.com/hongmaple0820/agent-academy --skill insecure-defaults-hongmaple0820

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Insecure defaults allow applications to run with weak or no protections, leading to production vulnerabilities. This skill identifies fail-open insecure defaults such as hardcoded secrets, weak authentication, and overly permissive security settings, enabling teams to discover and remediate risky configurations before deployment.

Core Features & Use Cases

Detects fail-open patterns (e.g., environment fallback secrets, permissive access controls) and differentiates them from fail-secure fallbacks.
Evaluates configuration coverage across code, IaC, and deployment scripts to surface high-risk findings and recommended mitigations.
Provides evidence and remediation guidance to support security reviews, policy compliance, and secure defaults implementation.

Quick Start

Run this skill on your project to locate insecure defaults and generate a prioritized findings report.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find hardcoded secrets and insecure defaults in source code?▼

To find insecure defaults in source code, scan your project for hardcoded secrets, weak authentication, and permissive security settings. This process locates fail-open patterns and generates a prioritized findings report with evidence and remediation guidance.

What are insecure default configurations in software projects?▼

Insecure default configurations are fail-open settings like environment fallback secrets and permissive access controls that allow applications to run with weak or no protections, leading to production vulnerabilities if left unremediated before deployment.

Can I scan IaC templates and deployment scripts for weak authentication settings?▼

Yes, you can scan IaC templates and deployment scripts for weak authentication settings. The security audit evaluates configuration coverage across code and infrastructure files to surface high-risk findings and recommended mitigations.

Does this insecure defaults scan work across multiple programming languages?▼

Yes, the insecure defaults scan works across multiple programming languages. It applies explicit detection patterns, risk scoring, and behavioral verification to source code, configuration files, and IaC templates to produce actionable remediation guidance.

How are insecure configuration findings prioritized during a security audit?▼

Insecure configuration findings are prioritized using risk scoring and behavioral verification. This security audit differentiates fail-open patterns from fail-secure fallbacks and outputs a prioritized list with evidence to support policy compliance.

What is the best way to detect permissive access controls in configuration files?▼

The best way to detect permissive access controls in configuration files is to apply explicit pattern matching and risk scoring to your project. This identifies overly permissive security settings and provides actionable remediation guidance to harden apps.