Agent skill · security · yaklang
cors-cross-origin-misconfiguration
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
Why this skill is useful
Provides detailed testing procedures and specific exploitation techniques for CORS misconfigurations that the AI wouldn't reliably generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: CORS Misconfiguration — Credentialed Origins, Reflection, and Trust Boundary Errors AI LOAD INSTRUCTION: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion SCENARIOS.md. Extended Scenarios Also load SCENARIOS.md when you need: JSONP hijacking complete attack scenario — watering hole + <script> cross-origin data theft Honeypot de-anonymization via JSONP — use social platform JSONP endpoints to identify anonymous visitors Same-origin policy deep dive — protocol/hostname/port definition, document.domain subdomain relaxation and its security risks CORS vs JSONP technical comparison — methods, error handling, credential behavior, migration path CORS exploitation payloads — reflected origin with credentials: include, null origin via sandboxed iframe Dual-site attack lab pattern — localhost:8981 (target) + localhost:8982 (attacker) testing setup 1. WHEN TO LOAD THIS SKILL Load when: Responses contain Access-Control-Allow-Origin, Access-Control-Allow-Credentials, or preflight headers A browser-based attack path might read authenticated API responses JSON endpoints appear protected from CSRF but are readable cross-origin 2. HIGH-VALUE MISCONFIGURATION CHECKS Theme What to Check --- --- wildcard with credentials Access-Control-Allow-Origin: plus credential support or equivalent broken behavior reflected origin server echoes arbitrary Origin weak allowlist suffix, prefix, substring, regex, or mixed-case matching errors null origin acceptance of sandboxed, file, or serialized origins preflight trust overbroad methods and headers internal API exposure admin or tenant data readable cross-origin 3. QUICK TRIAGE 1. Send crafted Origin headers and inspect reflection. 2. Test with and without credentials. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/cors-cross-origin-misconfiguration