insecure-defaults

What this skill does

Scans source code for insecure default configurations across five risk categories: weak cryptographic algorithms, hardcoded or default credentials, fail-open error handling patterns, unsafe framework defaults, and insecure TLS/SSL settings. For each finding it reports the file location, explains the risk, and recommends a secure replacement.

When to use

• During code reviews to catch insecure defaults before they reach production
• As part of security audits on new or unfamiliar codebases
• Before deploying a service to check framework and runtime settings
• When reviewing third-party or legacy code inherited by the team

Prerequisites

• grep (standard, always available)
• semgrep (optional, improves accuracy with structural matching):

  pip install semgrep
  # verify
  semgrep --version
  

• Environment variable SECSKILL_SCAN_PATH: root directory of the codebase to scan

Inputs

Variable	Required	Description
SECSKILL_SCAN_PATH	required	Root directory of the codebase to scan
SECSKILL_OUTPUT_DIR	optional	Output directory for results (default: ./output)
SECSKILL_EXTENSIONS	optional	Comma-separated file extensions to include (default: py,js,ts,java,go,rb,php,cs,cpp,c,yaml,yml,toml,env,cfg,conf,ini,properties)
SECSKILL_USE_SEMGREP	optional	Set to false to skip semgrep even if installed (default: auto-detect)

Workflow

Step 1: Environment setup

export SCAN_PATH="${SECSKILL_SCAN_PATH:?Set SECSKILL_SCAN_PATH to the codebase root}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export EXTENSIONS="${SECSKILL_EXTENSIONS:-py,js,ts,java,go,rb,php,cs,cpp,c,yaml,yml,toml,env,cfg,conf,ini,properties}"
mkdir -p "$OUTDIR"

if [ ! -d "$SCAN_PATH" ]; then
  echo "[-] Directory not found: $SCAN_PATH"
  exit 1
fi

SAFE_NAME=$(basename "$SCAN_PATH")
TIMESTAMP=$(date -u '+%Y%m%dT%H%M%SZ')
REPORT="$OUTDIR/insecure_defaults_${SAFE_NAME}_${TIMESTAMP}.txt"

# Build grep include flags from extension list
GREP_INCLUDES=$(echo "$EXTENSIONS" | tr ',' '\n' | sed 's/^/--include=*./' | tr '\n' ' ')

USE_SEMGREP=false
if [ "${SECSKILL_USE_SEMGREP:-auto}" != "false" ] && command -v semgrep >/dev/null 2>&1; then
  USE_SEMGREP=true
fi

echo "===== Insecure Defaults Scan =====" | tee "$REPORT"
echo "Target : $SCAN_PATH"                | tee -a "$REPORT"
echo "Time   : $TIMESTAMP"               | tee -a "$REPORT"
echo "Semgrep: $USE_SEMGREP"             | tee -a "$REPORT"
echo ""                                   | tee -a "$REPORT"