skills.rest
NOMARJ
NOMARJOFFICIAL
Explore all skills by this author →
WebsiteGitHub

insecure-defaults

Detect hardcoded credentials and insecure default configurations in source code and config files.

5|2|Updated Feb 15, 2026
Search Tags:#security#secrets#devsecops#code-scanning#insecure-defaults#config-audit#ast-analysis
One-click install
npx skills add https://github.com/NOMARJ/sigil --skill insecure-defaults-nomarj
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/NOMARJ/sigil/tree/main/packs/security/skills/owasp-security/insecure-defaults
Command: npx skills add https://github.com/NOMARJ/sigil --skill insecure-defaults-nomarj

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects hardcoded credentials, fail-open authentication/authorization patterns, and dangerous default configuration settings that can expose secrets or weaken security posture before they reach production.

Core Features & Use Cases

  • Hardcoded credential detection: Regex and pattern matching for API keys, tokens, private keys, base64-encoded secrets, and embedded connection strings.
  • Fail-open and dangerous default analysis: Identify auth/authorization code that defaults to allow, CORS set to wildcard in prod, debug flags enabled, permissive CSPs, and long session lifetimes.
  • Configuration audit across environments: Scan .env files, Docker Compose, Kubernetes manifests, CI configs, and application config files for insecure settings and secrets.
  • Outcome-driven reporting: Classify findings as CRITICAL, WARNING, or INFO and produce structured remediation steps to block or fix high-risk items automatically.

Quick Start

Run the insecure-defaults scanner on a code change to detect hardcoded credentials and risky configuration defaults and receive a structured findings report.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan source code for hardcoded secrets and API keys?▼

To scan source code for hardcoded secrets, apply regex and AST-based pattern matching to commits and configuration files to detect API keys, tokens, private keys, and base64-encoded credentials, producing structured findings classified by severity.

What are fail-open authentication patterns and how are they detected?▼

Fail-open authentication patterns are dangerous defaults that permit access when checks fail, detected by analyzing auth code to identify permissive settings that weaken security posture, classified as CRITICAL or WARNING findings.

Can I audit Docker Compose and Kubernetes manifests for insecure configuration settings?▼

Yes, you can audit Docker Compose, Kubernetes manifests, and CI configs for insecure configuration settings by scanning them to identify dangerous defaults like wildcard CORS, debug flags, and long session lifetimes.

Does this scanner detect base64-encoded secrets and embedded connection strings?▼

Yes, the scanner detects base64-encoded secrets and embedded connection strings using regex and pattern matching across source code and configuration files to locate embedded credentials before they reach production.

What is the best way to identify risky default configurations in a CI/CD pipeline?▼

The best way to identify risky default configurations in a CI/CD pipeline is to apply automated scanning to configuration changes to detect dangerous defaults, fail-open patterns, and hardcoded secrets, outputting actionable remediation guidance.

How are insecure configuration findings classified and reported?▼

Insecure configuration findings are classified as CRITICAL, WARNING, or INFO based on severity, producing structured, actionable remediation steps to automatically block or fix high-risk items.

Related Skills

Explore More Software Engineering Skills→
zhangzhang-111-izhangzhang-111-i
2

env-secrets-manager

Scan repositories for environment variable and secret leaks.

Community
Intermediate
hongmaple0820hongmaple0820
9

insecure-defaults

Identify insecure default configurations in source code, IaC templates, and deployment scripts.

Community
Intermediate
dreadnodedreadnode
11

insecure-defaults

Detect fail-open insecure default vulnerabilities in application code and configuration files.

Official
Intermediate
Avi977Avi977

insecure-defaults

Detect hardcoded secrets and insecure default configurations in source and config files.

Community
Intermediate