Skip to main content
Back to registry

insecure-defaults

trailofbits/skills

Finds fail-open vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.

Installs716
Install command
npx skills add https://github.com/trailofbits/skills --skill insecure-defaults
Security audits
Gen Agent Trust HubFAIL
SocketPASS
SnykFAIL
About this skill
Finds fail-open vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely. Do not use this skill for: When in doubt: trace the code path to determine if the app runs with the default or crashes. Follow this workflow for every potential finding: Determine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations. Example Search for patterns in **/config/ , **/auth/ , **/database/ , and env files: Tailor search approach based on discovery results. Focus on production-reachable code, not test fixtures or example files.

Source description provided by the upstream skill listing. Community reviews and install context appear in the sections below.

Community Reviews

Latest reviews

Sign in to review

No community reviews yet. Be the first to review.

Browse this skill in context
FAQ
What does insecure-defaults do?

Finds fail-open vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.

Is insecure-defaults good?

insecure-defaults does not have approved reviews yet, so SkillJury cannot publish a community verdict.

What agent does insecure-defaults work with?

insecure-defaults currently lists compatibility with codex, gemini-cli, opencode, cursor, github-copilot, claude-code.

What are alternatives to insecure-defaults?

Skills in the same category include telegram-bot-builder, flutter-app-size, sharp-edges, iterative-retrieval.

How do I install insecure-defaults?

npx skills add https://github.com/trailofbits/skills --skill insecure-defaults

Related skills

More from trailofbits/skills

Related skills

Alternatives in Software Engineering