skills.rest
tedtv1007-ctrl
tedtv1007-ctrlCOMMUNITY
Explore all skills by this author →
GitHub

insecure-defaults

Detect insecure defaults, hardcoded credentials, and fail-open patterns in code and manifests.

Updated Mar 26, 2026
Search Tags:#security#vulnerability#audit#compliance#configuration#devsecops
One-click install
npx skills add https://github.com/tedtv1007-ctrl/milk-skills-library --skill insecure-defaults-tedtv1007-ctrl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-defaults
Source: https://github.com/tedtv1007-ctrl/milk-skills-library/tree/main/insecure-defaults
Command: npx skills add https://github.com/tedtv1007-ctrl/milk-skills-library --skill insecure-defaults-tedtv1007-ctrl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill identifies common security misconfigurations and dangerous coding patterns that leave systems exposed to exploitation by default.

Core Features & Use Cases

  • Configuration Auditing: Scans YAML, JSON, and Docker files for permissive network settings, debug modes, and privileged execution.
  • Credential & Auth Analysis: Detects hardcoded secrets, default passwords, and weak cryptographic implementations.
  • Security Header Verification: Checks for missing web security headers and insecure CORS policies.
  • Use Case: Use this during a pull request review to automatically flag a container configuration that is missing CPU limits or has privileged access enabled.

Quick Start

Use the insecure-defaults skill to audit the current directory for hardcoded credentials and permissive network configurations.

Frequently Asked Questions about insecure-defaults

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit infrastructure manifests for insecure default configurations?▼

To audit insecure default configurations, scan YAML, JSON, and Docker files to detect permissive network settings, debug modes, and privileged execution that leave systems exposed by default.

How do I scan a codebase for hardcoded credentials and weak cryptographic implementations?▼

Scanning for hardcoded credentials involves analyzing application codebases to detect hardcoded secrets, default passwords, and weak cryptographic implementations that fail security compliance checks.

Can I use this to check for missing web security headers and insecure CORS policies?▼

Yes, you can check for missing web security headers and insecure CORS policies by validating API implementations against security best practices during initial triage.

What is the best way to automate a security review for a pull request?▼

The best way to automate a security review for a pull request is to audit containerized environments and API code, flagging missing CPU limits or privileged access enabled.

Does this security audit support validating resource limits and authentication attributes?▼

Yes, this security audit supports validating compliance with security best practices by specifically checking infrastructure manifests for resource limits and authentication attributes.

Related Skills

Explore More Software Engineering Skills→
microwindmicrowind
65

YAML验证器

Validate YAML configuration files for syntax, structure, and security issues.

Official
Advanced
idchain-worldidchain-world
16

insecure-defaults

Detect fail-open insecure defaults in config files and deployment templates.

Official
Intermediate
snoodleboot-iosnoodleboot-io
2

container-security-hardening-minimal

Scan container images and enforce runtime security and network policies.

Official
Intermediate
AcczdyAcczdy
2

implementing-devsecops-security-scanning

Automate SAST, DAST, and SCA security scanning across CI/CD pipelines.

Community
Advanced