[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-insecure-defaults":3,"mdc-in4unk-key":35,"related-org-trail-of-bits-insecure-defaults":708,"related-repo-trail-of-bits-insecure-defaults":864},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"insecure-defaults","detect insecure production defaults","Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Configuration","configuration",{"name":21,"slug":22,"type":16},"Audit","audit",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:30.020656",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Finsecure-defaults\u002Fskills\u002Finsecure-defaults","---\nname: insecure-defaults\ndescription: \"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.\"\nallowed-tools: Read Grep Glob Bash\n---\n\n# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n",{"data":36,"body":38},{"name":4,"description":6,"allowed-tools":37},"Read Grep Glob Bash",{"type":39,"children":40},"root",[41,50,64,105,112,155,161,166,274,279,285,338,344,349,356,361,393,493,498,503,509,514,522,540,546,551,556,562,570,582,588,605,631,648,658,684,694],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"insecure-defaults-detection",[47],{"type":48,"value":49},"text","Insecure Defaults Detection",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,62],{"type":48,"value":55},"Finds ",{"type":42,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":48,"value":61},"fail-open",{"type":48,"value":63}," vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.",{"type":42,"tag":65,"props":66,"children":67},"ul",{},[68,88],{"type":42,"tag":69,"props":70,"children":71},"li",{},[72,77,79,86],{"type":42,"tag":57,"props":73,"children":74},{},[75],{"type":48,"value":76},"Fail-open (CRITICAL):",{"type":48,"value":78}," ",{"type":42,"tag":80,"props":81,"children":83},"code",{"className":82},[],[84],{"type":48,"value":85},"SECRET = env.get('KEY') or 'default'",{"type":48,"value":87}," → App runs with weak secret",{"type":42,"tag":69,"props":89,"children":90},{},[91,96,97,103],{"type":42,"tag":57,"props":92,"children":93},{},[94],{"type":48,"value":95},"Fail-secure (SAFE):",{"type":48,"value":78},{"type":42,"tag":80,"props":98,"children":100},{"className":99},[],[101],{"type":48,"value":102},"SECRET = env['KEY']",{"type":48,"value":104}," → App crashes if missing",{"type":42,"tag":106,"props":107,"children":109},"h2",{"id":108},"when-to-use",[110],{"type":48,"value":111},"When to Use",{"type":42,"tag":65,"props":113,"children":114},{},[115,125,135,145],{"type":42,"tag":69,"props":116,"children":117},{},[118,123],{"type":42,"tag":57,"props":119,"children":120},{},[121],{"type":48,"value":122},"Security audits",{"type":48,"value":124}," of production applications (auth, crypto, API security)",{"type":42,"tag":69,"props":126,"children":127},{},[128,133],{"type":42,"tag":57,"props":129,"children":130},{},[131],{"type":48,"value":132},"Configuration review",{"type":48,"value":134}," of deployment files, IaC templates, Docker configs",{"type":42,"tag":69,"props":136,"children":137},{},[138,143],{"type":42,"tag":57,"props":139,"children":140},{},[141],{"type":48,"value":142},"Code review",{"type":48,"value":144}," of environment variable handling and secrets management",{"type":42,"tag":69,"props":146,"children":147},{},[148,153],{"type":42,"tag":57,"props":149,"children":150},{},[151],{"type":48,"value":152},"Pre-deployment checks",{"type":48,"value":154}," for hardcoded credentials or weak defaults",{"type":42,"tag":106,"props":156,"children":158},{"id":157},"when-not-to-use",[159],{"type":48,"value":160},"When NOT to Use",{"type":42,"tag":51,"props":162,"children":163},{},[164],{"type":48,"value":165},"Do not use this skill for:",{"type":42,"tag":65,"props":167,"children":168},{},[169,202,234,244,254,264],{"type":42,"tag":69,"props":170,"children":171},{},[172,177,179,185,187,193,194,200],{"type":42,"tag":57,"props":173,"children":174},{},[175],{"type":48,"value":176},"Test fixtures",{"type":48,"value":178}," explicitly scoped to test environments (files in ",{"type":42,"tag":80,"props":180,"children":182},{"className":181},[],[183],{"type":48,"value":184},"test\u002F",{"type":48,"value":186},", ",{"type":42,"tag":80,"props":188,"children":190},{"className":189},[],[191],{"type":48,"value":192},"spec\u002F",{"type":48,"value":186},{"type":42,"tag":80,"props":195,"children":197},{"className":196},[],[198],{"type":48,"value":199},"__tests__\u002F",{"type":48,"value":201},")",{"type":42,"tag":69,"props":203,"children":204},{},[205,210,212,218,219,225,226,232],{"type":42,"tag":57,"props":206,"children":207},{},[208],{"type":48,"value":209},"Example\u002Ftemplate files",{"type":48,"value":211}," (",{"type":42,"tag":80,"props":213,"children":215},{"className":214},[],[216],{"type":48,"value":217},".example",{"type":48,"value":186},{"type":42,"tag":80,"props":220,"children":222},{"className":221},[],[223],{"type":48,"value":224},".template",{"type":48,"value":186},{"type":42,"tag":80,"props":227,"children":229},{"className":228},[],[230],{"type":48,"value":231},".sample",{"type":48,"value":233}," suffixes)",{"type":42,"tag":69,"props":235,"children":236},{},[237,242],{"type":42,"tag":57,"props":238,"children":239},{},[240],{"type":48,"value":241},"Development-only tools",{"type":48,"value":243}," (local Docker Compose for dev, debug scripts)",{"type":42,"tag":69,"props":245,"children":246},{},[247,252],{"type":42,"tag":57,"props":248,"children":249},{},[250],{"type":48,"value":251},"Documentation examples",{"type":48,"value":253}," in README.md or docs\u002F directories",{"type":42,"tag":69,"props":255,"children":256},{},[257,262],{"type":42,"tag":57,"props":258,"children":259},{},[260],{"type":48,"value":261},"Build-time configuration",{"type":48,"value":263}," that gets replaced during deployment",{"type":42,"tag":69,"props":265,"children":266},{},[267,272],{"type":42,"tag":57,"props":268,"children":269},{},[270],{"type":48,"value":271},"Crash-on-missing behavior",{"type":48,"value":273}," where app won't start without proper config (fail-secure)",{"type":42,"tag":51,"props":275,"children":276},{},[277],{"type":48,"value":278},"When in doubt: trace the code path to determine if the app runs with the default or crashes.",{"type":42,"tag":106,"props":280,"children":282},{"id":281},"rationalizations-to-reject",[283],{"type":48,"value":284},"Rationalizations to Reject",{"type":42,"tag":65,"props":286,"children":287},{},[288,298,308,318,328],{"type":42,"tag":69,"props":289,"children":290},{},[291,296],{"type":42,"tag":57,"props":292,"children":293},{},[294],{"type":48,"value":295},"\"It's just a development default\"",{"type":48,"value":297}," → If it reaches production code, it's a finding",{"type":42,"tag":69,"props":299,"children":300},{},[301,306],{"type":42,"tag":57,"props":302,"children":303},{},[304],{"type":48,"value":305},"\"The production config overrides it\"",{"type":48,"value":307}," → Verify prod config exists; code-level vulnerability remains if not",{"type":42,"tag":69,"props":309,"children":310},{},[311,316],{"type":42,"tag":57,"props":312,"children":313},{},[314],{"type":48,"value":315},"\"This would never run without proper config\"",{"type":48,"value":317}," → Prove it with code trace; many apps fail silently",{"type":42,"tag":69,"props":319,"children":320},{},[321,326],{"type":42,"tag":57,"props":322,"children":323},{},[324],{"type":48,"value":325},"\"It's behind authentication\"",{"type":48,"value":327}," → Defense in depth; compromised session still exploits weak defaults",{"type":42,"tag":69,"props":329,"children":330},{},[331,336],{"type":42,"tag":57,"props":332,"children":333},{},[334],{"type":48,"value":335},"\"We'll fix it before release\"",{"type":48,"value":337}," → Document now; \"later\" rarely comes",{"type":42,"tag":106,"props":339,"children":341},{"id":340},"workflow",[342],{"type":48,"value":343},"Workflow",{"type":42,"tag":51,"props":345,"children":346},{},[347],{"type":48,"value":348},"Follow this workflow for every potential finding:",{"type":42,"tag":350,"props":351,"children":353},"h3",{"id":352},"_1-search-perform-project-discovery-and-find-insecure-defaults",[354],{"type":48,"value":355},"1. SEARCH: Perform Project Discovery and Find Insecure Defaults",{"type":42,"tag":51,"props":357,"children":358},{},[359],{"type":48,"value":360},"Determine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.",{"type":42,"tag":51,"props":362,"children":363},{},[364,369,371,377,378,384,385,391],{"type":42,"tag":57,"props":365,"children":366},{},[367],{"type":48,"value":368},"Example",{"type":48,"value":370},"\nSearch for patterns in ",{"type":42,"tag":80,"props":372,"children":374},{"className":373},[],[375],{"type":48,"value":376},"**\u002Fconfig\u002F",{"type":48,"value":186},{"type":42,"tag":80,"props":379,"children":381},{"className":380},[],[382],{"type":48,"value":383},"**\u002Fauth\u002F",{"type":48,"value":186},{"type":42,"tag":80,"props":386,"children":388},{"className":387},[],[389],{"type":48,"value":390},"**\u002Fdatabase\u002F",{"type":48,"value":392},", and env files:",{"type":42,"tag":65,"props":394,"children":395},{},[396,425,447,476],{"type":42,"tag":69,"props":397,"children":398},{},[399,404,405,411,412,418,419],{"type":42,"tag":57,"props":400,"children":401},{},[402],{"type":48,"value":403},"Fallback secrets:",{"type":48,"value":78},{"type":42,"tag":80,"props":406,"children":408},{"className":407},[],[409],{"type":48,"value":410},"getenv.*\\) or ['\"]",{"type":48,"value":186},{"type":42,"tag":80,"props":413,"children":415},{"className":414},[],[416],{"type":48,"value":417},"process\\.env\\.[A-Z_]+ \\|\\| ['\"]",{"type":48,"value":186},{"type":42,"tag":80,"props":420,"children":422},{"className":421},[],[423],{"type":48,"value":424},"ENV\\.fetch.*default:",{"type":42,"tag":69,"props":426,"children":427},{},[428,433,434,440,441],{"type":42,"tag":57,"props":429,"children":430},{},[431],{"type":48,"value":432},"Hardcoded credentials:",{"type":48,"value":78},{"type":42,"tag":80,"props":435,"children":437},{"className":436},[],[438],{"type":48,"value":439},"password.*=.*['\"][^'\"]{8,}['\"]",{"type":48,"value":186},{"type":42,"tag":80,"props":442,"children":444},{"className":443},[],[445],{"type":48,"value":446},"api[_-]?key.*=.*['\"][^'\"]+['\"]",{"type":42,"tag":69,"props":448,"children":449},{},[450,455,456,462,463,469,470],{"type":42,"tag":57,"props":451,"children":452},{},[453],{"type":48,"value":454},"Weak defaults:",{"type":48,"value":78},{"type":42,"tag":80,"props":457,"children":459},{"className":458},[],[460],{"type":48,"value":461},"DEBUG.*=.*true",{"type":48,"value":186},{"type":42,"tag":80,"props":464,"children":466},{"className":465},[],[467],{"type":48,"value":468},"AUTH.*=.*false",{"type":48,"value":186},{"type":42,"tag":80,"props":471,"children":473},{"className":472},[],[474],{"type":48,"value":475},"CORS.*=.*\\*",{"type":42,"tag":69,"props":477,"children":478},{},[479,484,485,491],{"type":42,"tag":57,"props":480,"children":481},{},[482],{"type":48,"value":483},"Crypto algorithms:",{"type":48,"value":78},{"type":42,"tag":80,"props":486,"children":488},{"className":487},[],[489],{"type":48,"value":490},"MD5|SHA1|DES|RC4|ECB",{"type":48,"value":492}," in security contexts",{"type":42,"tag":51,"props":494,"children":495},{},[496],{"type":48,"value":497},"Tailor search approach based on discovery results.",{"type":42,"tag":51,"props":499,"children":500},{},[501],{"type":48,"value":502},"Focus on production-reachable code, not test fixtures or example files.",{"type":42,"tag":350,"props":504,"children":506},{"id":505},"_2-verify-actual-behavior",[507],{"type":48,"value":508},"2. VERIFY: Actual Behavior",{"type":42,"tag":51,"props":510,"children":511},{},[512],{"type":48,"value":513},"For each match, trace the code path to understand runtime behavior.",{"type":42,"tag":51,"props":515,"children":516},{},[517],{"type":42,"tag":57,"props":518,"children":519},{},[520],{"type":48,"value":521},"Questions to answer:",{"type":42,"tag":65,"props":523,"children":524},{},[525,530,535],{"type":42,"tag":69,"props":526,"children":527},{},[528],{"type":48,"value":529},"When is this code executed? (Startup vs. runtime)",{"type":42,"tag":69,"props":531,"children":532},{},[533],{"type":48,"value":534},"What happens if a configuration variable is missing?",{"type":42,"tag":69,"props":536,"children":537},{},[538],{"type":48,"value":539},"Is there validation that enforces secure configuration?",{"type":42,"tag":350,"props":541,"children":543},{"id":542},"_3-confirm-production-impact",[544],{"type":48,"value":545},"3. CONFIRM: Production Impact",{"type":42,"tag":51,"props":547,"children":548},{},[549],{"type":48,"value":550},"Determine if this issue reaches production:",{"type":42,"tag":51,"props":552,"children":553},{},[554],{"type":48,"value":555},"If production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL",{"type":42,"tag":350,"props":557,"children":559},{"id":558},"_4-report-with-evidence",[560],{"type":48,"value":561},"4. REPORT: with Evidence",{"type":42,"tag":51,"props":563,"children":564},{},[565],{"type":42,"tag":57,"props":566,"children":567},{},[568],{"type":48,"value":569},"Example report:",{"type":42,"tag":571,"props":572,"children":576},"pre",{"className":573,"code":575,"language":48},[574],"language-text","Finding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n",[577],{"type":42,"tag":80,"props":578,"children":580},{"__ignoreMap":579},"",[581],{"type":48,"value":575},{"type":42,"tag":106,"props":583,"children":585},{"id":584},"quick-verification-checklist",[586],{"type":48,"value":587},"Quick Verification Checklist",{"type":42,"tag":51,"props":589,"children":590},{},[591,596,597,603],{"type":42,"tag":57,"props":592,"children":593},{},[594],{"type":48,"value":595},"Fallback Secrets:",{"type":48,"value":78},{"type":42,"tag":80,"props":598,"children":600},{"className":599},[],[601],{"type":48,"value":602},"SECRET = env.get(X) or Y",{"type":48,"value":604},"\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files",{"type":42,"tag":51,"props":606,"children":607},{},[608,613,615,621,623,629],{"type":42,"tag":57,"props":609,"children":610},{},[611],{"type":48,"value":612},"Default Credentials:",{"type":48,"value":614}," Hardcoded ",{"type":42,"tag":80,"props":616,"children":618},{"className":617},[],[619],{"type":48,"value":620},"username",{"type":48,"value":622},"\u002F",{"type":42,"tag":80,"props":624,"children":626},{"className":625},[],[627],{"type":48,"value":628},"password",{"type":48,"value":630}," pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples",{"type":42,"tag":51,"props":632,"children":633},{},[634,639,640,646],{"type":42,"tag":57,"props":635,"children":636},{},[637],{"type":48,"value":638},"Fail-Open Security:",{"type":48,"value":78},{"type":42,"tag":80,"props":641,"children":643},{"className":642},[],[644],{"type":48,"value":645},"AUTH_REQUIRED = env.get(X, 'false')",{"type":48,"value":647},"\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)",{"type":42,"tag":51,"props":649,"children":650},{},[651,656],{"type":42,"tag":57,"props":652,"children":653},{},[654],{"type":48,"value":655},"Weak Crypto:",{"type":48,"value":657}," MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing",{"type":42,"tag":51,"props":659,"children":660},{},[661,666,668,674,676,682],{"type":42,"tag":57,"props":662,"children":663},{},[664],{"type":48,"value":665},"Permissive Access:",{"type":48,"value":667}," CORS ",{"type":42,"tag":80,"props":669,"children":671},{"className":670},[],[672],{"type":48,"value":673},"*",{"type":48,"value":675},", permissions ",{"type":42,"tag":80,"props":677,"children":679},{"className":678},[],[680],{"type":48,"value":681},"0777",{"type":48,"value":683},", public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification",{"type":42,"tag":51,"props":685,"children":686},{},[687,692],{"type":42,"tag":57,"props":688,"children":689},{},[690],{"type":48,"value":691},"Debug Features:",{"type":48,"value":693}," Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing",{"type":42,"tag":51,"props":695,"children":696},{},[697,699,706],{"type":48,"value":698},"For detailed examples and counter-examples, see ",{"type":42,"tag":700,"props":701,"children":703},"a",{"href":702},"references\u002Fexamples.md",[704],{"type":48,"value":705},"examples.md",{"type":48,"value":707},".",{"items":709,"total":863},[710,727,737,757,770,783,795,805,818,829,841,852],{"slug":711,"name":711,"fn":712,"description":713,"org":714,"tags":715,"stars":23,"repoUrl":24,"updatedAt":726},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[716,719,722,723],{"name":717,"slug":718,"type":16},"C#","c",{"name":720,"slug":721,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":724,"slug":725,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":728,"name":728,"fn":729,"description":730,"org":731,"tags":732,"stars":23,"repoUrl":24,"updatedAt":736},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[733,734,735],{"name":717,"slug":718,"type":16},{"name":14,"slug":15,"type":16},{"name":724,"slug":725,"type":16},"2026-07-17T06:05:12.433192",{"slug":738,"name":738,"fn":739,"description":740,"org":741,"tags":742,"stars":23,"repoUrl":24,"updatedAt":756},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[743,746,749,752,755],{"name":744,"slug":745,"type":16},"Agents","agents",{"name":747,"slug":748,"type":16},"CI\u002FCD","ci-cd",{"name":750,"slug":751,"type":16},"Code Analysis","code-analysis",{"name":753,"slug":754,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":758,"name":758,"fn":759,"description":760,"org":761,"tags":762,"stars":23,"repoUrl":24,"updatedAt":769},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[763,764,765,766],{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":14,"slug":15,"type":16},{"name":767,"slug":768,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":771,"name":771,"fn":772,"description":773,"org":774,"tags":775,"stars":23,"repoUrl":24,"updatedAt":782},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[776,779],{"name":777,"slug":778,"type":16},"Engineering","engineering",{"name":780,"slug":781,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":784,"name":784,"fn":785,"description":786,"org":787,"tags":788,"stars":23,"repoUrl":24,"updatedAt":794},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[789,792,793],{"name":790,"slug":791,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":724,"slug":725,"type":16},"2026-07-17T06:05:14.575191",{"slug":796,"name":796,"fn":797,"description":798,"org":799,"tags":800,"stars":23,"repoUrl":24,"updatedAt":804},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[801,802,803],{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":806,"name":806,"fn":807,"description":808,"org":809,"tags":810,"stars":23,"repoUrl":24,"updatedAt":817},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[811,814,815,816],{"name":812,"slug":813,"type":16},"Architecture","architecture",{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":777,"slug":778,"type":16},"2026-07-18T05:47:40.122449",{"slug":819,"name":819,"fn":820,"description":821,"org":822,"tags":823,"stars":23,"repoUrl":24,"updatedAt":828},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[824,825,826,827],{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":777,"slug":778,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":830,"name":830,"fn":831,"description":832,"org":833,"tags":834,"stars":23,"repoUrl":24,"updatedAt":840},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[835,836,839],{"name":21,"slug":22,"type":16},{"name":837,"slug":838,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":842,"name":842,"fn":843,"description":844,"org":845,"tags":846,"stars":23,"repoUrl":24,"updatedAt":851},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[847,848,849,850],{"name":21,"slug":22,"type":16},{"name":717,"slug":718,"type":16},{"name":750,"slug":751,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":853,"name":853,"fn":854,"description":855,"org":856,"tags":857,"stars":23,"repoUrl":24,"updatedAt":862},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[858,859,860,861],{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":14,"slug":15,"type":16},{"name":767,"slug":768,"type":16},"2026-07-18T05:47:42.84568",111,{"items":865,"total":911},[866,873,879,887,894,899,905],{"slug":711,"name":711,"fn":712,"description":713,"org":867,"tags":868,"stars":23,"repoUrl":24,"updatedAt":726},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[869,870,871,872],{"name":717,"slug":718,"type":16},{"name":720,"slug":721,"type":16},{"name":14,"slug":15,"type":16},{"name":724,"slug":725,"type":16},{"slug":728,"name":728,"fn":729,"description":730,"org":874,"tags":875,"stars":23,"repoUrl":24,"updatedAt":736},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[876,877,878],{"name":717,"slug":718,"type":16},{"name":14,"slug":15,"type":16},{"name":724,"slug":725,"type":16},{"slug":738,"name":738,"fn":739,"description":740,"org":880,"tags":881,"stars":23,"repoUrl":24,"updatedAt":756},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[882,883,884,885,886],{"name":744,"slug":745,"type":16},{"name":747,"slug":748,"type":16},{"name":750,"slug":751,"type":16},{"name":753,"slug":754,"type":16},{"name":14,"slug":15,"type":16},{"slug":758,"name":758,"fn":759,"description":760,"org":888,"tags":889,"stars":23,"repoUrl":24,"updatedAt":769},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[890,891,892,893],{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":14,"slug":15,"type":16},{"name":767,"slug":768,"type":16},{"slug":771,"name":771,"fn":772,"description":773,"org":895,"tags":896,"stars":23,"repoUrl":24,"updatedAt":782},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[897,898],{"name":777,"slug":778,"type":16},{"name":780,"slug":781,"type":16},{"slug":784,"name":784,"fn":785,"description":786,"org":900,"tags":901,"stars":23,"repoUrl":24,"updatedAt":794},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[902,903,904],{"name":790,"slug":791,"type":16},{"name":14,"slug":15,"type":16},{"name":724,"slug":725,"type":16},{"slug":796,"name":796,"fn":797,"description":798,"org":906,"tags":907,"stars":23,"repoUrl":24,"updatedAt":804},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[908,909,910],{"name":21,"slug":22,"type":16},{"name":750,"slug":751,"type":16},{"name":14,"slug":15,"type":16},77]