misconfig
Skill159 starsChanged 52 days agoMITView on GitHub
Test deployment, configuration, and observability weaknesses.
In this repository7 other files it gives its agents.
- AGENTS.mdAGENTS.md
- api-testingSkill
- business-logicSkill
- identity-authSkill
- llm-securitySkill
- pentestSkill
- web-appSkill
The file
We split this skill into the rules it gives an agent
2 rules. About 0 are common, 2 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 22
Do not use for injection, authz, API protocol, or workflow flaws.
- Distinctive: line 36
Read the playbook stop conditions before probing management interfaces or default credentials.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Configuration, Deployment, and Observability Testing
On-demand skill for weaknesses that arise from how an application is deployed and operated rather than from its code logic: security misconfiguration, information leakage via obscurity, and observability failures (missing logging, monitoring, and error-handling disclosure). It does not contain injection payloads.
When to Use
- Verbose errors, default credentials, exposed management interfaces, or permissive headers/CORS are observed.
- A finding depends on deployment posture, hidden-but-guessable naming, or missing logging/monitoring.
- Do not use for injection, authz, API protocol, or workflow flaws; route those classes to the appropriate specialist skill.
Playbook Routing
| Class | Playbook |
| Security misconfiguration | playbooks/security-misconfiguration.md |
| Security through obscurity | playbooks/security-through-obscurity.md |
| Observability failures | playbooks/observability-failures.md |
Common Pitfalls
- Separate deployment posture from code defects; a misconfiguration is a configuration fix, not a code fix.
- Preserve the exact header, error body, or default credential as decisive evidence.
- Read the playbook stop conditions before probing management interfaces or default credentials.
Verification Checklist
- Engagement bootstrap and scope validation succeeded.
- The matched playbook alone was loaded and bound to the PTT task.
- Evidence captures the exact misconfigured value or missing control.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.