Agent skill

Insecure Defaults

by waybarrios in waybarrios/opencode-power-pack

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production.

MITAuto-check passedDevOps & Cloud

Install Insecure Defaults

skills CLI

$ npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install waybarrios/opencode-power-pack insecure-defaults --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/insecure-defaults .claude/skills/insecure-defaults && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "insecure-defaults" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults into .claude/skills/insecure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "insecure-defaults", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install waybarrios/opencode-power-pack insecure-defaults --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/insecure-defaults .agents/skills/insecure-defaults && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "insecure-defaults" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults into .agents/skills/insecure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "insecure-defaults", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install waybarrios/opencode-power-pack insecure-defaults --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/insecure-defaults .cursor/skills/insecure-defaults && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "insecure-defaults" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults into .cursor/skills/insecure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "insecure-defaults", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/waybarrios/opencode-power-pack.git --path skills/insecure-defaults

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install waybarrios/opencode-power-pack insecure-defaults --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/insecure-defaults .gemini/skills/insecure-defaults && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "insecure-defaults" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults into .gemini/skills/insecure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "insecure-defaults", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install waybarrios/opencode-power-pack insecure-defaults

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/insecure-defaults .github/skills/insecure-defaults && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "insecure-defaults" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults into .github/skills/insecure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "insecure-defaults", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install waybarrios/opencode-power-pack insecure-defaults --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/insecure-defaults .opencode/skills/insecure-defaults && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "insecure-defaults" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/insecure-defaults into .opencode/skills/insecure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "insecure-defaults", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: insecure-defaults
GitHub stars: 533
Used in: 2 other repos
Token cost: ~1.3k tokens
SKILL.md length: 526 words
Files: 2 (incl. references)
Skills in repo: 32
Repo updated: Oct 6, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production.

Works in 4 steps: SEARCH: Perform Project Discovery and… → VERIFY: Actual Behavior → CONFIRM: Production Impact → …
Auditing security
SKILL.md covers When to Use, When NOT to Use, Rationalizations to Reject and Workflow, plus 1 more section
Needs JWT_SECRET

What it does

Insecure Defaults is an agent skill from waybarrios/opencode-power-pack. Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/examples.md`).

It sits in DevOps & Cloud, covering Secrets management. The repository describes itself as: 54 rigorous skills for Codex, OpenCode, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more. The licence is MIT.

When your agent uses it

Auditing security
Reviewing config management
Analyzing environment variable handling

Example prompts

“Use the insecure-defaults skill to detect fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run…”
“/insecure-defaults”

Requirements

Docker
A credential in JWT_SECRET

Workflow steps

4 steps, taken from the step headings in SKILL.md.

SEARCH: Perform Project Discovery and Find Insecure Defaults
VERIFY: Actual Behavior
CONFIRM: Production Impact
REPORT: with Evidence

What it can do on your machine

Read from SKILL.md and the folder at commit 9dccb6d. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- JWT_SECRET
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Insecure Defaults loads about 1.3k tokens when it runs, and up to ~4k if it reads all its reference files. Until then it costs about 64 tokens; SKILL.md has 526 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~64
When it runs · the whole SKILL.md, loaded when a task matches: ~1.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from waybarrios/opencode-power-pack at commit 9dccb6d, republished under its MIT licence (© waybarrios). 526 words, ~1,300 tokens.

Download SKILL.mdSave it as .claude/skills/insecure-defaults/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.

name: insecure-defaults
description: Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
license: MIT (modified; see UPSTREAMS.json)

Insecure Defaults Detection

Finds fail-open vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.

Fail-open (CRITICAL): SECRET = env.get('KEY') or 'default' → App runs with weak secret
Fail-secure (SAFE): SECRET = env['KEY'] → App crashes if missing

When to Use

Security audits of production applications (auth, crypto, API security)
Configuration review of deployment files, IaC templates, Docker configs
Code review of environment variable handling and secrets management
Pre-deployment checks for hardcoded credentials or weak defaults

When NOT to Use

Do not use this skill for:

Test fixtures explicitly scoped to test environments (files in test/, spec/, __tests__/)
Example/template files (.example, .template, .sample suffixes)
Development-only tools (local Docker Compose for dev, debug scripts)
Documentation examples in README.md or docs/ directories
Build-time configuration that gets replaced during deployment
Crash-on-missing behavior where app won't start without proper config (fail-secure)

When in doubt: trace the code path to determine if the app runs with the default or crashes.

Rationalizations to Reject

"It's just a development default" → If it reaches production code, it's a finding
"The production config overrides it" → Verify prod config exists; code-level vulnerability remains if not
"This would never run without proper config" → Prove it with code trace; many apps fail silently
"It's behind authentication" → Defense in depth; compromised session still exploits weak defaults
"We'll fix it before release" → Document now; "later" rarely comes

Workflow

Follow this workflow for every potential finding:

1. SEARCH: Perform Project Discovery and Find Insecure Defaults

Determine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.

Example Search for patterns in **/config/, **/auth/, **/database/, and env files:

Fallback secrets: getenv.*\) or ['"], process\.env\.[A-Z_]+ \|\| ['"], ENV\.fetch.*default:
Hardcoded credentials: password.*=.*['"][^'"]{8,}['"], api[_-]?key.*=.*['"][^'"]+['"]
Weak defaults: DEBUG.*=.*true, AUTH.*=.*false, CORS.*=.*\*
Crypto algorithms: MD5|SHA1|DES|RC4|ECB in security contexts

Tailor search approach based on discovery results.

Focus on production-reachable code, not test fixtures or example files.

Show full SKILL.md (197 more words)Show less

2. VERIFY: Actual Behavior

For each match, trace the code path to understand runtime behavior.

Questions to answer:

When is this code executed? (Startup vs. runtime)
What happens if a configuration variable is missing?
Is there validation that enforces secure configuration?

3. CONFIRM: Production Impact

Determine if this issue reaches production:

If production config provides the variable → Lower severity (but still a code-level vulnerability) If production config missing or uses default → CRITICAL

4. REPORT: with Evidence

Example report:

Finding: Hardcoded JWT Secret Fallback
Location: src/auth/jwt.ts:15
Pattern: const secret = process.env.JWT_SECRET || 'default';

Verification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42
Production Impact: Dockerfile missing JWT_SECRET
Exploitation: Attacker forges JWTs using 'default', gains unauthorized access

Quick Verification Checklist

Fallback Secrets: SECRET = env.get(X) or Y → Verify: App starts without env var? Secret used in crypto/auth? → Skip: Test fixtures, example files

Default Credentials: Hardcoded username/password pairs → Verify: Active in deployed config? No runtime override? → Skip: Disabled accounts, documentation examples

Fail-Open Security: AUTH_REQUIRED = env.get(X, 'false') → Verify: Default is insecure (false/disabled/permissive)? → Safe: App crashes or default is secure (true/enabled/restricted)

Weak Crypto: MD5/SHA1/DES/RC4/ECB in security contexts → Verify: Used for passwords, encryption, or tokens? → Skip: Checksums, non-security hashing

Permissive Access: CORS *, permissions 0777, public-by-default → Verify: Default allows unauthorized access? → Skip: Explicitly configured permissiveness with justification

Debug Features: Stack traces, introspection, verbose errors → Verify: Enabled by default? Exposed in responses? → Skip: Logging-only, not user-facing

For detailed examples and counter-examples, see examples.md.

Files

SKILL.md and 1 other file (references) in skills/insecure-defaults of waybarrios/opencode-power-pack.

SKILL.md
references/examples.md

Open the folder on GitHubat commit 9dccb6d

Used in 2 other repositories

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in waybarrios/opencode-power-pack, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Insecure Defaults next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Insecure Defaults compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Insecure Defaults this skillwaybarrios/opencode-power-pack	533	2 repos	~1.3k	Automated safety check: Pass	MIT	3 days ago
Iron Proxy Gateway for NanoClawnanocoai/nanoclaw	31k	—	~4.6k	Automated safety check: Notes	MIT	3 days ago
LangBot Deployment Guidelangbot-app/LangBot	18k	—	~1.2k	Automated safety check: Notes	Apache-2.0	yesterday
Env Var Conventionssgl-project/sglang	37k	2 repos	~2.9k	Automated safety check: Pass	Apache-2.0	today
Mac Fleet Maintenancesteipete/agent-scripts	7.3k	—	~4.8k	Automated safety check: Pass	MIT	5 days ago
Add Config Env Varbaserow/baserow	6.1k	—	~1.1k	Automated safety check: Pass	Custom licence	today

Similar skills

Iron Proxy Gateway for NanoClaw
nanocoai/nanoclaw
Installs or refreshes Iron Proxy and its Iron Control web console for NanoClaw, with a local Docker setup, database, credentials and a human approval bridge.
31k GitHub stars~4.6k tokensUpdated 3 days ago
DevOps & CloudAuto-check: notes
LangBot Deployment Guide
langbot-app/LangBot
Deploys and configures a LangBot instance with Docker Compose or Kubernetes, covering config.yaml, the Box sandbox runtime, the plugin runtime and the global API key.
18k GitHub stars~1.2k tokensUpdated yesterday
DevOps & CloudAuto-check: notes
Env Var Conventions
sgl-project/sglang
Conventions for SGLang environment variables — where to define, how to access, how to name, and how to deprecate.
37k GitHub starsUsed in 2 repos~2.9k tokens
DevOps & CloudAuto-check passed
Mac Fleet Maintenance
steipete/agent-scripts
Inventories and maintains a fleet of Macs from a desired-state file: package updates, repo and Xcode sync, and disk, backup and security health reports.
7.3k GitHub stars~4.8k tokensUpdated 5 days ago
DevOps & CloudAuto-check passed
Add Config Env Var
baserow/baserow
Add a Baserow configuration environment variable for the backend, frontend, or both, and propagate it through settings, Nuxt runtime config, Docker Compose, documentation, consumers, and tests as…
6.1k GitHub stars~1.1k tokensUpdated today
DevOps & CloudAuto-check passed
Edgeone Makers CLI
TencentEdgeOne/edgeone-makers-tools
EdgeOne Makers CLI command reference. An agent skill from TencentEdgeOne/edgeone-makers-tools.
1.9k GitHub starsUsed in 1 repo~739 tokens
DevOps & CloudAuto-check: notes

More from waybarrios/opencode-power-pack

All 32 skills in this repo

Hf Cloud Sagemaker Iam Preflight
waybarrios/opencode-power-pack
Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.
533 GitHub stars~1.6k tokensUpdated 3 days ago
Auto-check passed
Huggingface LLM Trainer
waybarrios/opencode-power-pack
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion.
533 GitHub stars~3k tokensUpdated 3 days ago
Auto-check passed
Huggingface Vision Trainer
waybarrios/opencode-power-pack
Train object-detection, image-classification, or SAM segmentation models on Hugging Face Jobs.
533 GitHub stars~2.7k tokensUpdated 3 days ago
Auto-check passed
Codeql
waybarrios/opencode-power-pack
Run CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF.
533 GitHub starsUsed in 2 repos~3.7k tokens
Auto-check passed
Semgrep
waybarrios/opencode-power-pack
Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis.
533 GitHub stars~2.4k tokensUpdated 3 days ago
Auto-check passed
Train Sentence Transformers
waybarrios/opencode-power-pack
Train or fine-tune SentenceTransformer bi-encoders, CrossEncoder rerankers, or SparseEncoder models, including losses, negatives, evaluation, distillation, LoRA, and Matryoshka.
533 GitHub stars~2.2k tokensUpdated 3 days ago
Auto-check passed

Questions about Insecure Defaults

What does Insecure Defaults do?

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Insecure Defaults is an agent skill from waybarrios/opencode-power-pack. Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production.

When should I use Insecure Defaults?

Insecure Defaults fits situations like: auditing security; reviewing config management; analyzing environment variable handling.

How do I install Insecure Defaults in Claude Code?

Run `npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a claude-code`. Or copy the skill folder (skills/insecure-defaults in waybarrios/opencode-power-pack) into .claude/skills/insecure-defaults in your project. Claude Code loads it when a task matches its description.

How do I install Insecure Defaults in Codex?

Run `npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a codex`. Or copy the skill folder (skills/insecure-defaults in waybarrios/opencode-power-pack) into .agents/skills/insecure-defaults in your project. Codex loads it when a task matches its description.

Can I use Insecure Defaults in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add waybarrios/opencode-power-pack --skill insecure-defaults -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/insecure-defaults, .gemini/skills/insecure-defaults, .github/skills/insecure-defaults and .opencode/skills/insecure-defaults in your project.

What does Insecure Defaults need to run?

Going by SKILL.md and its folder, Insecure Defaults needs credentials named JWT_SECRET. Our summary lists: Docker; A credential in JWT_SECRET.

Does Insecure Defaults access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Insecure Defaults safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Insecure Defaults use?

Insecure Defaults is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Insecure Defaults use?

About 1.3k tokens (SKILL.md is roughly 5.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.7k tokens, read only when the agent opens those files.

What are the alternatives to Insecure Defaults?

Skills that share tags, products or a category with Insecure Defaults: Iron Proxy Gateway for NanoClaw (nanocoai/nanoclaw, 31k stars), LangBot Deployment Guide (langbot-app/LangBot, 18k stars), Env Var Conventions (sgl-project/sglang, 37k stars) and Mac Fleet Maintenance (steipete/agent-scripts, 7.3k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Insecure Defaults?

waybarrios (a GitHub user) maintains it in waybarrios/opencode-power-pack, which has 533 GitHub stars. The repository holds 32 skills in this directory. The repository was last updated on October 6, 2026.

Source: waybarrios/opencode-power-pack on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Insecure Defaults

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Insecure Defaults Detection

When to Use

When NOT to Use

Rationalizations to Reject

Workflow

1. SEARCH: Perform Project Discovery and Find Insecure Defaults

2. VERIFY: Actual Behavior

3. CONFIRM: Production Impact

4. REPORT: with Evidence

Quick Verification Checklist

Files

Used in 2 other repositories

Compare with similar skills

Similar skills

More from waybarrios/opencode-power-pack

Related

Questions about Insecure Defaults