[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C5GY48Z9CT4GFP8CEFVFX0":3,"skill-same:01M6C5GY48Z9CT4GFP8CEFVFX0":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":14,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":48,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M6C5GY48Z9CT4GFP8CEFVFX0","insecure-defaults",null,"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.","CoralShades\u002Facm-ai","CoralShades","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F220297585?v=4","01M6C5211QSJHZ8HXSDDWCR507","Coral Shades AI Agency","01M6C52161FNQDRQ0FRR8DAA9D",0,"MIT","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Finsecure-defaults\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"insecure defaults","security","auth","config","run","analyzing","Production","secrets","open","Bash","grep","read","management","environment","use","2026-11-10 10:12:30",false,"---\nname: insecure-defaults\ndescription: \"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.\"\nallowed-tools:\n  - Read\n  - Grep\n  - Glob\n  - Bash\n---\n\n# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n","# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n",{"name":5,"description":7,"allowed-tools":39},[40,41,42,28],"Read","Grep","Glob","main","1ca81b0a7de199942400f965edd4d7544077ac5d",".claude\u002Fskills\u002Finsecure-defaults","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai","https:\u002F\u002Fgithub.com\u002FCoralShades","coralshades.com.au","2026-04-18 00:45:07",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add CoralShades\u002Facm-ai --skill insecure-defaults",{"tool":56,"command":57},"bunx","bunx skills add CoralShades\u002Facm-ai --skill insecure-defaults",{"tool":59,"command":60},"pnpm","pnpm dlx skills add CoralShades\u002Facm-ai --skill insecure-defaults","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Finsecure-defaults\u002FSKILL.md",true,[64],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Fexamples.md","REFERENCE","参考文档",10673,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Finsecure-defaults\u002Freferences\u002Fexamples.md",[71,94,106,122,144,154],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":82,"publishedAt":34},"01M6C63HKXA890HHV47WBAX0TB","uncodixfy","Prevents generic AI\u002FCodex UI patterns when generating frontend code. Use this skill whenever generating HTML, CSS, React, Vue, Svelte, or any frontend UI code to enforce clean, human-designed aesthetics inspired by Linear, Raycast, Stripe, and GitHub instead of typical AI-generated UI.","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Funcodixfy\u002FSKILL.md",[77],{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[73,83,84,85,86,87,88,89,90,91,92,33,93],"github","frontend","css","codex","react","code","linear","ui","vue","generated","html",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":34},"01M6C63FJ2GEBBGZ5XSMV40KXB","runpodctl","Runpod CLI to manage your GPU workloads.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Frunpodctl\u002FSKILL.md",[],[96,102,103,104,105,28],"macos","cli","linux","gpu",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":34},"01M6C63DPAV46TFVQ01SFYPJ7X","langgraph-persistence","INVOKE THIS SKILL when your LangGraph needs to persist state, remember conversations, travel through history, or configure subgraph checkpointer scoping. Covers checkpointers, thread_id, time travel, Store, and subgraph persistence modes.","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Flanggraph-persistence\u002FSKILL.md",[],[113,114,115,116,117,118,119,120,121],"langgraph persistence","langgraph","persistence","travel","history","scoping","remember","state","configure",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":133,"publishedAt":34},"01M6C63BNS9CQEBTB8RNSSBFPA","langgraph-human-in-the-loop","INVOKE THIS SKILL when implementing human-in-the-loop patterns, pausing for approval, or handling errors in LangGraph. Covers interrupt(), Command(resume=...), approval\u002Fvalidation workflows, and the 4-tier error handling strategy.","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Flanggraph-human-in-the-loop\u002FSKILL.md",[128],{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[134,135,114,136,137,138,139,140,141,142,143],"langgraph human in the loop","loop","workflows","error handling","validation","human-in-the-loop","command","strategy","approval","resume",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":34},"01M6C639GVYZFX3NFPV5FBDR4F","langgraph-fundamentals","INVOKE THIS SKILL when writing ANY LangGraph code. Covers StateGraph, state schemas, nodes, edges, Command, Send, invoke, streaming, and error handling.","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Flanggraph-fundamentals\u002FSKILL.md",[],[151,114,137,120,152,153,140,88],"langgraph fundamentals","streaming","writing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":34},"01M6C6375N34YX2GZ3SD3R7XR2","langchain-rag","INVOKE THIS SKILL when building ANY retrieval-augmented generation (RAG) system. Covers document loaders, RecursiveCharacterTextSplitter, embeddings (OpenAI), and vector stores (Chroma, FAISS, Pinecone).","https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Flangchain-rag\u002FSKILL.md",[],[161,162,163,164,165,166,167,168,169,170],"rag","langchain rag","langchain","embeddings","vector","openai","chroma","faiss","vector stores","system"]