insecure-defaults
Installation
SKILL.md
What this skill does
Scans source code for insecure default configurations across five risk categories: weak cryptographic algorithms, hardcoded or default credentials, fail-open error handling patterns, unsafe framework defaults, and insecure TLS/SSL settings. For each finding it reports the file location, explains the risk, and recommends a secure replacement.
When to use
- During code reviews to catch insecure defaults before they reach production
- As part of security audits on new or unfamiliar codebases
- Before deploying a service to check framework and runtime settings
- When reviewing third-party or legacy code inherited by the team