菜单
Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | insecure-defaults-hunter |
| description | Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/insecure-defaults |
Math.random() / random.random() for security-critical valuesGrep seeds:
grep -rnEi "md5|sha-?1|DES|RC4|ECB|MD2|MD4" target --include='*.{js,ts,py,go,rs,java,php,rb,c,cpp}'
grep -rnE "Math\.random|random\.random\(|rand\(\)" target --include='*.{js,ts,py,c,cpp}'
rejectUnauthorized: false (Node)verify=False (requests), ssl._create_unverified_context (Python)InsecureSkipVerify: true (Go)X509TrustManager (Java)grep -rnE "rejectUnauthorized\s*:\s*false" target
grep -rnE "verify\s*=\s*False" target --include='*.py'
grep -rnE "InsecureSkipVerify.*true" target --include='*.go'
Access-Control-Allow-Origin: * + Allow-Credentials: truecors({ origin: true }) in Express@CrossOrigin without args in Springcsrf: false, @EnableWebSecurity without csrf)DEBUG=True in Django settingsapp.debug = True in FlaskNODE_ENV check missing; console.error(err.stack) to the clientyaml.load (Python, prefer safe_load)pickle.loads on untrusted inputunserialize (PHP) on user inputObjectInputStream (Java) without class allow-listJSON.parse(JSON.stringify(x)) used to "sanitize" — it doesn'tPublicAccessBlock missing or all false0.0.0.0/0 on 22/3389*:*USER root; ADD with remote URL; no HEALTHCHECKRun scanners:
checkov -d target --framework all --output sarif -o reports/iac-checkov.sarif
tfsec target --format sarif > reports/iac-tfsec.sarif
terrascan scan -d target -o sarif > reports/iac-terrascan.sarif
hadolint target/Dockerfile --format sarif > reports/iac-hadolint.sarif 2>/dev/null || true
httpOnly: false, secure: false, sameSite: 'None' without Securenone algorithm or with HS256 + hardcoded secretlogger.info(req.body))Each finding carries severity MEDIUM by default; upgrade to HIGH when the insecure default is on an authentication/authorization path or directly yields plaintext in flight.