# insecure-defaults

Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production

- **Kind:** plugin (installs as one bundle)
- **Owner:** trailofbits
- **Source:** https://github.com/trailofbits/skills (`plugins/insecure-defaults`)
- **Pinned commit:** `d3323cefbcf645678b8dc481de204b02ad3d02dc`
- **Page:** https://forefy.com/plugins/4a4b6194-0a76-5e98-9aa3-22e0d1eb888c
- **API (JSON):** https://forefy.com/api/asr/plugins/4a4b6194-0a76-5e98-9aa3-22e0d1eb888c

## Install

Ask your agent: `Install the insecure-defaults plugin securely from: https://forefy.com/plugins/4a4b6194-0a76-5e98-9aa3-22e0d1eb888c globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/4a4b6194-0a76-5e98-9aa3-22e0d1eb888c/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (1)

- [audit-pipeline](https://forefy.com/skills/2850e358-404f-46c4-adc3-8c4b4193f157): Pipeline behind /insecure-defaults:audit. Invoke the command, not this.