Screened · automated checks passed
insecure-defaults
What the author says it does
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
Quoted from the skill's own SKILL.md trigger description — this is what tells
Claude when to activate it. Not yet verified by us.
Automated screening
100/100 validator score
Scored by the same rules as our free SKILL.md validator: trigger description quality, body substance, structure. Automated — a human bench test is the next step in the pipeline.
Install (unverified — review first)
git clone https://github.com/trailofbits/skills # skill lives at: plugins/insecure-defaults/skills/insecure-defaults/SKILL.md
SkillProof status
This skill is in our test queue. We install every skill in a clean environment, run a trigger battery and score output against a baseline before it earns a catalog page — the full protocol is public. Until then, treat it like any unreviewed dependency: read the SKILL.md and any scripts before installing.
Already tested in Productivity & Workflow
- Fetch URL As Markdown Local trafilatura-first URL-to-Markdown fetcher with a clean exit-code contract for when to fall back to Exa.
- Refresh Context Map Rebuilds the AIDEV-anchor/AGENTS.md/ADR manifest that powers claude-leverage's PreToolUse context hook.
- Video Vision Local ffmpeg+Whisper pipeline that lets Claude actually watch and transcribe video files
- YT Digest Turns a YouTube URL into a timestamped, screenshotted markdown research note via real yt-dlp + ffmpeg.