cors-auditor

Estrellas12

Forks5

Actualizado23 de junio de 2026 a las 07:55

Audit a site's Cross-Origin Resource Sharing (CORS) configuration for misconfigurations — wildcard origin with credentials, reflected arbitrary Origin, the 'null' origin, overly broad allowed methods, and risky credentialed CORS. Use when the user asks to "check my CORS config", "is my API's CORS safe", "test for CORS misconfiguration", or "why can any site call my API".

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Fuente

NovaCode37

NovaCode37/claude-security-skills

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

Explorador de archivos

3 archivos

SKILL.md

readonly

name	cors-auditor
description	Audit a site's Cross-Origin Resource Sharing (CORS) configuration for misconfigurations — wildcard origin with credentials, reflected arbitrary Origin, the 'null' origin, overly broad allowed methods, and risky credentialed CORS. Use when the user asks to "check my CORS config", "is my API's CORS safe", "test for CORS misconfiguration", or "why can any site call my API".
license	MIT

CORS Misconfiguration Auditor

Inspects CORS response headers and reports exploitable misconfigurations with fixes. The analysis core is pure and offline-testable; live probing uses only stdlib urllib and sends a throwaway Origin header to detect origin reflection.

When to use this skill

"Audit the CORS configuration of https://api.example.com."
"Is it safe that my API returns Access-Control-Allow-Origin: *?"
"Does my server reflect any Origin back?"

What it checks

Wildcard + credentials — Allow-Origin: * with Allow-Credentials: true (cors-wildcard-credentials).
Reflected origin — server echoes the request Origin back (cors-reflected-origin); critical when combined with credentials.
Null origin — Allow-Origin: null (cors-null-origin).
Wildcard origin — Allow-Origin: * without credentials (cors-wildcard).
Credentialed CORS — informational note when credentials are enabled (cors-credentials-enabled).
Wildcard methods — Allow-Methods: * (cors-methods-wildcard).

How to run it

# Live probe (sends a throwaway Origin to test reflection)
python skills/cors-auditor/auditor.py https://api.example.com

# Probe with a specific origin
python skills/cors-auditor/auditor.py https://api.example.com --origin https://evil.example

# Offline: audit a captured header block; pass --origin to test reflection
python skills/cors-auditor/auditor.py --headers-file resp.txt --origin https://evil.example

Exit codes: 0 no high issues · 1 critical/high findings · 2 fetch/usage error.

Recommended workflow for Claude

Probe the endpoint (live) or audit captured headers (offline).
Explain each finding and why it is exploitable (e.g. reflected origin + credentials = cross-origin data theft).
Recommend an explicit origin allowlist and dropping credentials where not needed.
Only test APIs the user owns or is authorized to test.

Más de este repositorio

mismo repositorio

dockerfile-scan

NovaCode37/claude-security-skills

Scan a Dockerfile for insecure build patterns — running as root, unpinned or :latest base images, ADD from remote URLs, piping curl/wget into a shell, hardcoded secrets in ENV/ARG, world-writable chmod 777, and sudo usage. Use when the user asks to "review my Dockerfile", "is this container image secure", "lint my Dockerfile for security", or "why does my image run as root".

2026-06-2312

dependency-check

NovaCode37/claude-security-skills

Audit project dependencies for known-vulnerable versions and risky pinning. Parses requirements.txt and package.json, matches a bundled offline advisory DB, optionally queries OSV.dev live, and warns about unpinned versions. Use when the user asks to "check dependencies for vulnerabilities", "audit my requirements.txt / package.json", "scan for vulnerable packages", or "is my dependency tree secure".

2026-06-0812

secret-scanner

NovaCode37/claude-security-skills

Scan a codebase for hardcoded secrets — API keys, tokens, private keys and passwords — using a custom regex + Shannon-entropy engine. Use when the user asks to "find secrets", "check for leaked credentials", "scan for API keys", do a pre-commit secret check, or audit a repo before making it public.

2026-06-0712

prompt-injection-tester

NovaCode37/claude-security-skills

Red-team an LLM application against prompt injection and jailbreaks using a curated, categorized payload library and canary-based detection, then produce a resilience score. Use when the user asks to "test my chatbot for prompt injection", "check if my AI app is jailbreakable", "red-team my LLM", "evaluate prompt-injection defenses", or audit a system prompt's guardrails.

2026-06-0712

jwt-inspector

NovaCode37/claude-security-skills

Decode and security-audit a JSON Web Token — flag alg=none, missing/excessive expiry, symmetric-alg confusion risk, missing claims — and attempt an offline HMAC secret crack against a wordlist to detect weak signing keys. Use when the user asks to "decode this JWT", "is this token secure?", "audit a JWT", or "check if this token uses a weak secret".

2026-06-0712

http-sec-audit

NovaCode37/claude-security-skills

Audit a website's HTTP security headers and cookie flags — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP, version-leaking banners, and Secure/HttpOnly/SameSite cookies. Use when the user asks to "check my site's security headers", "audit HTTP headers", "is my CSP/HSTS configured right", or "scan a URL for header misconfigs".

2026-06-0712

name	cors-auditor
description	Audit a site's Cross-Origin Resource Sharing (CORS) configuration for misconfigurations — wildcard origin with credentials, reflected arbitrary Origin, the 'null' origin, overly broad allowed methods, and risky credentialed CORS. Use when the user asks to "check my CORS config", "is my API's CORS safe", "test for CORS misconfiguration", or "why can any site call my API".
license	MIT

CORS Misconfiguration Auditor

When to use this skill

"Audit the CORS configuration of https://api.example.com."
"Is it safe that my API returns Access-Control-Allow-Origin: *?"
"Does my server reflect any Origin back?"

What it checks

Wildcard + credentials — Allow-Origin: * with Allow-Credentials: true (cors-wildcard-credentials).
Reflected origin — server echoes the request Origin back (cors-reflected-origin); critical when combined with credentials.
Null origin — Allow-Origin: null (cors-null-origin).
Wildcard origin — Allow-Origin: * without credentials (cors-wildcard).
Credentialed CORS — informational note when credentials are enabled (cors-credentials-enabled).
Wildcard methods — Allow-Methods: * (cors-methods-wildcard).

How to run it

# Live probe (sends a throwaway Origin to test reflection)
python skills/cors-auditor/auditor.py https://api.example.com

# Probe with a specific origin
python skills/cors-auditor/auditor.py https://api.example.com --origin https://evil.example

# Offline: audit a captured header block; pass --origin to test reflection
python skills/cors-auditor/auditor.py --headers-file resp.txt --origin https://evil.example

Exit codes: 0 no high issues · 1 critical/high findings · 2 fetch/usage error.

Recommended workflow for Claude

Probe the endpoint (live) or audit captured headers (offline).
Explain each finding and why it is exploitable (e.g. reflected origin + credentials = cross-origin data theft).
Recommend an explicit origin allowlist and dropping credentials where not needed.
Only test APIs the user owns or is authorized to test.