IN

insecure-defaults

Detects fail-open vulnerabilities in configuration and environment variable handling.

Install

mkdir -p .claude/skills/insecure-defaults && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/1135" && unzip -o skill.zip -d .claude/skills/insecure-defaults && rm skill.zip

Installs to .claude/skills/insecure-defaults

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
237 chars✓ has a “when” trigger
Intermediate

Key capabilities

  • Scans source code for environment variable defaults
  • Distinguishes fail-open defaults from fail-secure crash-on-error patterns
  • Identifies hardcoded credentials or weak authentication fallbacks
  • Reviews IaC templates for overly permissive security settings

How it works

Uses recursive scanning to flag occurrences of fallback values in environment configurations where an explicit assignment should exist.

Inputs & outputs

You give it
Source code directory or config file
You get back
List of insecure default occurrences and associated risk level

When to use insecure-defaults

  • Audit production environment variable handling
  • Check configuration files for hardcoded credentials
  • Review IaC templates for permissive defaults

About insecure-defaults

Scans code and configuration files for patterns that permit insecure defaults in production. It identifies instances where applications proceed with insecure fallback values instead of failing securely.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

When not to use it

  • Analyzing test fixtures in test directories
  • Reviewing documentation or sample config templates
  • Analyzing dev-only debug scripts

Prerequisites

grep

Limitations

  • May flag false positives if the application has alternative safe guards not visible to the tool
  • Static analysis can miss dynamic overrides

How it compares

It specifically differentiates between safe coding patterns (fail-secure) and dangerous ones (fail-open), reducing false positives.

Compared to similar skills

insecure-defaults side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
insecure-defaults (this skill)32moReviewIntermediate
software-security216moNo flagsIntermediate
fix-dependabot-alerts186moReviewIntermediate
backend-security-coder244moNo flagsIntermediate

Try saying

Example prompts that trigger this skill in your AI assistant.

More by trailofbits

View all by trailofbits

differential-review

trailofbits

Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.

3115

code-maturity-assessor

trailofbits

Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing. Produces professional scorecard with evidence-based ratings and actionable recommendations.

416

modern-python

trailofbits

Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.

427

semgrep-rule-creator

trailofbits

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

416

ton-vulnerability-scanner

trailofbits

Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.

410

cosmos-vulnerability-scanner

trailofbits

Scans Cosmos SDK blockchains for 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. Use when auditing Cosmos chains or CosmWasm contracts.

32

You might also like

software-security

project-codeguard

A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

2186

fix-dependabot-alerts

microsoft

Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.

1872

backend-security-coder

sickn33

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

2446

equilateral-agents

Equilateral-AI

22 production-ready AI agents with database-driven orchestration for security reviews, code quality analysis, deployment validation, infrastructure checks, and compliance. Auto-activates for security concerns, deployment tasks, code reviews, quality checks, and compliance questions. Includes upgrade paths to enterprise features (GDPR, HIPAA, multi-account AWS, ML-based optimization).

564

top-100-web-vulnerabilities-reference

davila7

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

547

differential-review

trailofbits

Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.

3115

Search skills

Search the agent skills registry