Identify and remediate fail-open vulnerabilities, hardcoded secrets, and permissive security settings before they reach production.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install insecure-defaults
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install insecure-defaults using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Insecure Defaults Detection?
Insecure Defaults Detection is a specialized tool designed to identify critical fail-open vulnerabilities in your application. Unlike basic linters, this skill distinguishes between safe fail-secure patterns and dangerous defaults that allow applications to run with weak security if configurations are missing. By integrating this into your Openclaw Skills library, you can automate the discovery of hardcoded secrets, weak cryptographic algorithms, and permissive access controls that often slip through standard code reviews.
The core value of this skill lies in its ability to trace runtime behavior. It doesn't just flag a string; it helps determine if a missing environment variable causes an application to crash safely or proceed with a default 'secret' key that an attacker could easily exploit. It is an essential component for teams looking to bolster their security posture through automated Openclaw Skills workflows.
Insecure Defaults Detection Use Cases
- Security audits of production-bound applications covering auth, crypto, and API security
- Reviewing Infrastructure as Code (IaC) templates and Docker configurations for hardcoded credentials
- Analyzing environment variable handling during code reviews to ensure fail-secure logic
- Pre-deployment checks to identify weak CORS settings, debug features, or permissive file permissions
How Insecure Defaults Detection Works
- Project Discovery: The skill identifies the language, framework, and project conventions to locate secret storage and configuration patterns.
- Targeted Search: It uses Grep and Glob to find patterns like hardcoded passwords, fallback secrets (e.g.,
getenv() or 'default'), and weak crypto algorithms. - Behavioral Verification: For every match, the skill traces the code path to understand if the default is actually reachable at runtime.
- Production Impact Confirmation: It evaluates whether production deployment configurations provide the necessary overrides to mitigate the identified risk.
- Detailed Reporting: A structured report is generated containing the location, pattern, verification steps, and exploitation impact.
Insecure Defaults Detection Setup
To use this capability within your Openclaw Skills environment, ensure the agent has access to the codebase and the following tools: Read, Grep, Glob, and Bash.
# Example of running a discovery search for insecure defaults
openclaw run insecure-defaults --path ./src/config
Insecure Defaults Detection Data Schema & Taxonomy
The skill organizes findings into a structured evidence format to facilitate rapid remediation:
| Attribute | Description |
|---|---|
| Finding | A descriptive title of the security risk (e.g., Hardcoded JWT Secret) |
| Location | The specific file path and line number of the vulnerability |
| Pattern | The code snippet identified as a potential fail-open default |
| Verification | Analysis of what happens when a configuration variable is missing |
| Production Impact | Assessment of whether the issue reaches the live environment |
| Exploitation | A brief explanation of how an attacker could leverage the default |
Insecure Defaults Detection Advanced Features
- Intelligent filtering to exclude test fixtures, documentation examples, and development-only tools
- Context-aware cryptographic analysis to distinguish between security hashes and simple checksums
- Support for multiple environment variable fetching patterns across various languages (Node.js, Python, Ruby)
- Automated production impact assessment by checking Dockerfiles and deployment manifests
SKILL.md
Loading
Related Openclaw Skills
Kaspa News
A comprehensive intelligence aggregator for Openclaw Skills providing real-time updates on Kaspa development, community activity, and ecosystem milestones.
IQAir Air Quality Checker
A powerful real-time air quality monitoring skill that retrieves AQI data and pollution levels for any global location via the IQAir API.
Claude Code CLI
A powerful integration that delegates complex coding, refactoring, and codebase exploration tasks to the Claude Code CLI.
Niri IPC
A comprehensive toolset to control the Niri Wayland compositor via IPC, enabling window management, workspace navigation, and event streaming.
stripfeed
stripfeed is a specialized utility that fetches web content and converts it into clean, AI-optimized Markdown while providing precise token counts.
OpenClaw Security Action
A specialized GitHub Action that automatically scans agent workspaces and Openclaw Skills for security vulnerabilities like exposed secrets and prompt injection.
Featured*
