Agent skill · security · jeremylongshore
auditing-cors-policy
Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected combo but server config wrong), missing Vary:Origin on per-origin responses, preflight cached over 86400s, OR Allow-Origin trust of attacker- controlled subdomain pattern. Trigger with: "audit cors", "check cors policy", "cors bypass", "preflight check".
Why this skill is useful
Adds an executable Python script for auditing CORS policies that identifies critical security misconfigurations not covered by generic knowledge.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Auditing CORS Policy Overview CORS misconfiguration is one of the most common middle-severity findings in web bug bounties. The browser-enforced rules are subtle, the failure modes are silent (the wrong cors response just works until an attacker weaponizes it), and the "fix" engineers reach for — Access-Control-Allow-Origin: — opens the very class of attacks CORS was meant to prevent when paired with credentials. This skill probes each common CORS misconfiguration with synthetic Origin headers and grades the response. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Origin reflected without validation HIGH Synthetic Origin https://attacker.example echoed in Allow-Origin OWASP A05:2021 Allow-Credentials:true with wildcard Allow-Origin CRITICAL Browser rejects but server is asserting the worst combo OWASP A05:2021 Allow-Credentials:true with reflected Origin CRITICAL Attacker site can read authenticated responses cross-origin OWASP A05:2021, CWE-942 Subdomain wildcard pattern bypass HIGH Allow-Origin: .example.com matches attacker.example.com.evil.com CWE-942 Missing Vary:Origin on per-origin response MEDIUM CDN caches one origin's response for all origins RFC 7234 Preflight cache > 86400s LOW Access-Control-Max-Age over 24h limits revocation agility MDN best practice Null Origin trusted HIGH Allow-Origin: null accepted (sandboxed iframes, data: URLs) CWE-942 All HTTP methods permitted MEDIUM Allow-Methods: enables CSRF-via-CORS for state-change OWASP A05:2021 Prerequisites Python 3.9+ (requests library) Authorization for non-local targets (../analyzing-tls-config/references/AUTHORIZATION.md) Instructions Step 1 — Confirm Authorization Step 2 — Run the scanner Options: The scanner sends multiple probes per target: 1. Baseline request with no Origin header 2. Probe with safe Origin (https://allowed-origin.example.com) 3. Probe with attacker Origin (https://attacker.example) 4. Probe with subdomain-bypass Origin 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/auditing-cors-policy