agentsclimarketplace

Cors auditor

Skill Starr-del/ShipSafe/skills/cors-auditor

Offline deploy-safety skills for Claude Code. Zero credentials, zero network, zero dependencies.

Install
npx -y skills add Starr-del/ShipSafe --skill cors-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit CORS configuration in Express, Next.js, FastAPI, or Flask code for security misconfigurations. Use whenever the user mentions CORS errors, 'blocked by CORS policy', cross-origin issues, configures an API for a frontend, or asks why credentials/cookies aren't being sent cross-origin. Also run it before deploying any API. Runs fully offline — no API keys, no network, no credentials.

SKILL.md

1.8 KB, as published. Nobody here has run it

cors-auditor

Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.

python3 scripts/audit_cors.py <project_root> [--json]

Checks, in severity order:

  • WILDCARD_WITH_CREDENTIALS (critical) — browsers reject * + credentials outright, and the tempting 'fix' of reflecting the Origin header turns the API into an account-takeover vector. The correct fix is always an explicit allowlist.
  • REFLECTED_ORIGIN (critical) — req.headers.origin echoed back unvalidated = every website can make authenticated calls as your users.
  • NULL_ORIGIN_ALLOWED (high) — sandboxed iframes can claim Origin: null.
  • WILDCARD_PROD (medium) — legitimate only for truly public read-only APIs; confirm intent with the user.
  • LOCALHOST_IN_LIST (low) — dev config shipped to prod.

Important nuance when interpreting: the user's actual complaint is usually 'CORS is blocking me' and the most common bad advice on the internet is to widen the policy. Diagnose what origin they actually need, and produce the narrowest config that unblocks them — never suggest origin: '*' plus credentials, and never suggest reflecting the request origin without an allowlist check.

Exit codes: 0 clean, 1 findings.

All paths below are relative to this skill's directory (cors-auditor/).

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.