insecure-defaults
insecure defaults
What it does
- Fail-open (CRITICAL): SECRET = env.get('KEY') or 'default' → App runs with weak secret
- Fail-secure (SAFE): SECRET = env['KEY'] → App crashes if missing
- Security audits of production applications (auth, crypto, API security)
- Configuration review of deployment files, IaC templates, Docker configs
- Code review of environment variable handling and secrets management
- Pre-deployment checks for hardcoded credentials or weak defaults
- Test fixtures explicitly scoped to test environments (files in test/, spec/, tests/)
Requirements & configuration
Configuration: SECRETDEBUGAUTHCORSAUTH_REQUIRED
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
insecure-defaults FAQ
What does the insecure-defaults skill do?
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling. Fail-open (CRITICAL): SECRET = env.get('KEY') or 'default' → App runs with weak secret Fail-secure (SAFE): SECRET = env['KEY'] → App crashes if missing
What does insecure-defaults require?
Configuration keys: SECRET, DEBUG, AUTH, CORS, AUTH_REQUIRED.
How do I install insecure-defaults?
Run: npx -y skills add https://github.com/trailofbits/skills --skill insecure-defaults --agent claude-code — the source lives at github.com/trailofbits/skills.
Maintain insecure-defaults?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/trailofbits-skills-insecure-defaults?ref=badge) npx agentictools info skills/trailofbits-skills-insecure-defaults The second line is the CLI lookup for this page — handy in READMEs and docs.
