insecure-defaults
Detects fail-open vulnerabilities in configuration and environment variable handling.
Install
mkdir -p .claude/skills/insecure-defaults && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/1135" && unzip -o skill.zip -d .claude/skills/insecure-defaults && rm skill.zipInstalls to .claude/skills/insecure-defaults
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.Key capabilities
- →Scans source code for environment variable defaults
- →Distinguishes fail-open defaults from fail-secure crash-on-error patterns
- →Identifies hardcoded credentials or weak authentication fallbacks
- →Reviews IaC templates for overly permissive security settings
How it works
Uses recursive scanning to flag occurrences of fallback values in environment configurations where an explicit assignment should exist.
Inputs & outputs
When to use insecure-defaults
- →Audit production environment variable handling
- →Check configuration files for hardcoded credentials
- →Review IaC templates for permissive defaults
About insecure-defaults
Scans code and configuration files for patterns that permit insecure defaults in production. It identifies instances where applications proceed with insecure fallback values instead of failing securely.
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
When not to use it
- →Analyzing test fixtures in test directories
- →Reviewing documentation or sample config templates
- →Analyzing dev-only debug scripts
Prerequisites
Limitations
- →May flag false positives if the application has alternative safe guards not visible to the tool
- →Static analysis can miss dynamic overrides
How it compares
It specifically differentiates between safe coding patterns (fail-secure) and dangerous ones (fail-open), reducing false positives.
Compared to similar skills
insecure-defaults side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| insecure-defaults (this skill) | 3 | 2mo | Review | Intermediate |
| software-security | 21 | 6mo | No flags | Intermediate |
| fix-dependabot-alerts | 18 | 6mo | Review | Intermediate |
| backend-security-coder | 24 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by trailofbits
View all by trailofbits →You might also like
software-security
project-codeguard
A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
equilateral-agents
Equilateral-AI
22 production-ready AI agents with database-driven orchestration for security reviews, code quality analysis, deployment validation, infrastructure checks, and compliance. Auto-activates for security concerns, deployment tasks, code reviews, quality checks, and compliance questions. Includes upgrade paths to enterprise features (GDPR, HIPAA, multi-account AWS, ML-based optimization).
top-100-web-vulnerabilities-reference
davila7
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
differential-review
trailofbits
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.