Skip to content
SkillsBundleby SANTACONCHA
ES EN

Individual AI skill · AI for Inteligencia e Investigación

insecure-defaults

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Source content · review pending Source language: EN

Choose how you use AI

Agent format only: this skill needs tools or scripts that web projects cannot execute.

Free ZIP · One canonical method · Usage example · Installation guide · Licence notices

From file to useful result

How to ask with this skill installed

Installing the skill gives your AI a method. Your request still has to provide the case-specific facts, constraints and expected output.

1Name the real task

Describe the decision or deliverable, not just the topic.

2Provide the evidence

Add source material, audience, limits and known facts.

3Define done

Set format, quality criteria and checks.

Adaptable starting prompt Replace the brackets with your case

When to use it

  • Security audits of production applications (auth, crypto, API security)
  • Configuration review of deployment files, IaC templates, Docker configs
  • Code review of environment variable handling and secrets management
  • Pre-deployment checks for hardcoded credentials or weak defaults

When not to use it

Do not use this skill for:

  • Test fixtures explicitly scoped to test environments (files in test/, spec/, __tests__/)
  • Example/template files (.example, .template, .sample suffixes)
  • Development-only tools (local Docker Compose for dev, debug scripts)
  • Documentation examples in README.md or docs/ directories
  • Build-time configuration that gets replaced during deployment
  • Crash-on-missing behavior where app won't start without proper config (fail-secure)

When in doubt: trace the code path to determine if the app runs with the default or crashes.

Choose the right scope

Packs that include this skill

Download only this method or take it together with the rest of its professional area.

This page

Individual skill

The smallest useful download, prepared for a web project or an agent.

Choose format →
Professional pack

AI for Inteligencia e Investigación

This skill plus the other methods selected for this professional area.

Same method, different setup

Where will you use it?

We do not duplicate the skill for every platform. We keep one canonical method and explain the correct installation route.

Traceable by design

Source and licence travel with the file.

SkillsBundle catalogues material of its own and from third parties. Inclusion does not claim original authorship. The individual ZIP preserves the canonical catalogue path and includes the applicable licence notices.

Catalogue path
skills/transversal/knowledge/trailofbits-skills/plugins/insecure-defaults/skills/insecure-defaults
Ficha origin
Extracted from SKILL.md
Read terms and licence policy →

Start with one real task

Install the method. Keep your judgement.

Choose format