insecure-defaults
Identifies fail-open vulnerabilities, hardcoded secrets, and weak configuration defaults in production-reachable code.
Install
npx skills add https://github.com/trailofbits/skills --skill insecure-defaultsStats
| Total installs | 1,211 |
| Weekly installs | 1.2K |
| GitHub stars | 4.0K |
| First seen | Jan 28, 2026 |
| Source | @trailofbits/skills |
Summary
- Identifies hardcoded secrets, weak authentication defaults, permissive access controls, and weak cryptography that allow apps to start and operate without proper configuration
- Distinguishes between fail-open vulnerabilities (app runs insecurely with defaults) and fail-secure patterns (app crashes if config is missing)
- Focuses on production-reachable code; automatically excludes test fixtures, example files, documentation, and development-only configurations
- Includes verification workflow to trace code paths, confirm runtime behavior, and assess production impact before reporting findings
Tags
nodepythonrubydockerterraformsecuritycode-qualitydevopsbackendarchitecturebest-practicesreviewagent-skill
Related skills
| Skill | Installs | vs insecure-defaults |
|---|---|---|
| springboot-verification | 1,315 | +104 |
| guidelines-advisor | 1,289 | +78 |
| monitoring-operations | 1,223 | +12 |
| constant-time-analysis | 1,194 | -17 |
| audit-prep-assistant | 1,254 | +43 |
FAQ
- How many installs does insecure-defaults have?
- insecure-defaults has 1,211 total installs and 1.2K installs this week.
- Where is insecure-defaults hosted?
- insecure-defaults is published by @trailofbits/skills at https://github.com/trailofbits/skills.
- How many GitHub stars does insecure-defaults have?
- insecure-defaults has 4.0K GitHub stars.
- When was insecure-defaults first indexed?
- OrangeBot.AI first indexed insecure-defaults on Jan 28, 2026.
- How do I install insecure-defaults?
- Run: npx skills add https://github.com/trailofbits/skills --skill insecure-defaults