insecure-defaults
Detect fail-open configurations, hardcoded secrets, weak authentication defaults, permissive CORS, disabled security features, and other insecure-by-default patterns. Adapted from Trail of Bits. Use during security review or when auditing configuration and initialization code.
npx skills add vibeeval/vibecosystem --skill insecure-defaults --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Insecure Defaults Detection Systematic detection of security misconfigurations where the default behavior is insecure. These are the bugs that ship because "it worked in development." ## Detection Categories ### 1. Fail-Open Configurations Code that defaults to allowing access when a security check fails. ```typescript // BAD: Fail-open -- if auth service is down, everyone gets in async function checkAuth(token: string): Promise<boolean> { try { return await authService.verify(token) } catch { return true // INSECURE: fails open } } // GOOD: Fail-closed -- if auth service is down, deny access async function checkAuth(token: string): Promise<boolean> { try { return await authService.verify(token) } catch { return false // SECURE: fails closed } } ``` **Detection pattern**: Look for `catch` blocks that return truthy/permissive values in auth/authz code. ### 2. Hardcoded Secrets ```typescript // BAD patterns -- detect ALL of these const API_KEY = "sk-proj-abc123" const DB_PASSWORD = "admin123" const JWT_SECRET = "super-secret-key" const ENCRYPTION_KEY = Buffer.from("0123456789abcdef") // GOOD const API_KEY = process.env.API_KEY if (!API_KEY) throw new Error('API_KEY environment vari
- Detection Categories
- 1. Fail-Open Configurations
- 2. Hardcoded Secrets
- 3. Weak Authentication Defaults
- 4. Permissive CORS
- 5. Disabled Security Features
- 6. Debug Mode in Production
- 7. Overly Permissive File/Directory Permissions
- 8. Missing Rate Limiting
- 9. Insecure Deserialization
- 10. Missing Security Headers
- Audit Checklist
- Rationalizations to Reject
- Integration with vibecosystem
BAD chmod 777 /app/config chmod 666 /app/.env GOOD chmod 600 /app/.env chmod 700 /app/config
What does the insecure-defaults skill do?
Detect fail-open configurations, hardcoded secrets, weak authentication defaults, permissive CORS, disabled security features, and other insecure-by-default patterns. Adapted from Trail of Bits. Use during security review or when auditing configuration and initialization code.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill insecure-defaults --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.