agentsclimarketplace
Sign in

Cors auditor

Skill NovaCode37/claude-security-skills/skills/cors-auditor

Audit a site's Cross-Origin Resource Sharing (CORS) configuration for misconfigurations — wildcard origin with credentials, reflected arbitrary Origin, the 'null' origin, overly broad allowed methods, and risky credentialed CORS. Use when the user asks to "check my CORS config", "is my API's CORS safe", "test for CORS misconfiguration", or "why can any site call my API".From its SKILL.md

Install
npx -y skills add NovaCode37/claude-security-skills --skill cors-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 3 commands, including `python skills/cors-auditor/auditor.py https://api.example.com` and 2 more.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.4 KB, 471 tokens by cl100k_base, as published. Nobody here has run it

CORS Misconfiguration Auditor

Inspects CORS response headers and reports exploitable misconfigurations with fixes. The analysis core is pure and offline-testable; live probing uses only stdlib urllib and sends a throwaway Origin header to detect origin reflection.

When to use this skill

  • "Audit the CORS configuration of https://api.example.com."
  • "Is it safe that my API returns Access-Control-Allow-Origin: *?"
  • "Does my server reflect any Origin back?"

What it checks

  • Wildcard + credentials — Allow-Origin: * with Allow-Credentials: true (cors-wildcard-credentials).
  • Reflected origin — server echoes the request Origin back (cors-reflected-origin); critical when combined with credentials.
  • Null origin — Allow-Origin: null (cors-null-origin).
  • Wildcard origin — Allow-Origin: * without credentials (cors-wildcard).
  • Credentialed CORS — informational note when credentials are enabled (cors-credentials-enabled).
  • Wildcard methods — Allow-Methods: * (cors-methods-wildcard).

How to run it

# Live probe (sends a throwaway Origin to test reflection)
python skills/cors-auditor/auditor.py https://api.example.com

# Probe with a specific origin
python skills/cors-auditor/auditor.py https://api.example.com --origin https://evil.example

# Offline: audit a captured header block; pass --origin to test reflection
python skills/cors-auditor/auditor.py --headers-file resp.txt --origin https://evil.example

Exit codes: 0 no high issues · 1 critical/high findings · 2 fetch/usage error.

Recommended workflow for Claude

  1. Probe the endpoint (live) or audit captured headers (offline).
  2. Explain each finding and why it is exploitable (e.g. reflected origin + credentials = cross-origin data theft).
  3. Recommend an explicit origin allowlist and dropping credentials where not needed.
  4. Only test APIs the user owns or is authorized to test.

What ships with it: 2 files

9.2 KB alongside SKILL.md, 2 of them executable

tests/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.