[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSP8R3TYW49A4627DXSTQB":3,"skill-same:01M6DSP8R3TYW49A4627DXSTQB":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6DSP8R3TYW49A4627DXSTQB","insecure-defaults",null,"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Finsecure-defaults\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"insecure defaults","Bash","apps","config management","use","environment","management","read","grep","security","open","secrets","Production","analyzing","run","config","auth","2026-11-10 10:12:30",false,"---\nname: insecure-defaults\ndescription: \"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.\"\nallowed-tools:\n  - Read\n  - Grep\n  - Glob\n  - Bash\n---\n\n# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n","# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n",{"name":5,"description":7,"allowed-tools":40},[41,42,43,19],"Read","Grep","Glob","master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Finsecure-defaults",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill insecure-defaults",{"tool":57,"command":58},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill insecure-defaults",{"tool":60,"command":61},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill insecure-defaults","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Finsecure-defaults\u002FSKILL.md",true,[65],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"references\u002Fexamples.md","REFERENCE","参考文档",10673,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Finsecure-defaults\u002Freferences\u002Fexamples.md",[72,97,112,126,139,152],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":91,"publishedAt":35},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[78,83,86],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":84,"categoryName":85,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[92,93,22,94,95,96],"writing skills","writing","editing","work","deployment",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":105,"publishedAt":35},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[103,104],{"categoryNo":84,"categoryName":85,"taxonomyType":81,"taxonomyTypeDesc":82},{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},[106,107,93,108,109,22,110,111],"plans","writing plans","requirements","task","code","spec",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":120,"publishedAt":35},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[118,119],{"categoryNo":84,"categoryName":85,"taxonomyType":81,"taxonomyTypeDesc":82},{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},[121,122,123,25,124,125,93],"docs:write concisely","write","docs","Rules","documentation",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":35},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[128,133,134,135,136,137,138],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":35},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[146,147,148,149,110,150,151],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":35},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[159,147,160,95,22,161,162,163],"verification before completion","commands","evidence","claim","complete"]