cors-check

Detect CORS policy misconfigurations by testing Origin headers against API responses.

21|1|Updated Apr 12, 2026

Search Tags:#web-security #cors #access-control #security-testing #cors-check #origin-header

Ready to run

npx skills add https://github.com/woohyun212/security-skill --skill cors-check

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cors-check
Source: https://github.com/woohyun212/security-skill/tree/main/cors-check
Command: npx skills add https://github.com/woohyun212/security-skill --skill cors-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CORS misconfigurations in APIs can enable unauthorized access or data leakage. This skill tests how an API responds to a variety of Origin headers to determine whether cross-origin access controls are correctly enforced.

Core Features & Use Cases

Detects origin reflection in ACAO responses and identifies credential leakage risks.
Assesses unsafe configurations such as wildcard origins with credentials and null origins across endpoints.
Provides remediation guidance and risk assessment to improve API security.

Quick Start

Provide a target URL and run the cors-check skill to assess its CORS policy.

Frequently Asked Questions about cors-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check my API for CORS misconfigurations?▼

This skill detects CORS policy misconfigurations by sending controlled requests with various Origin headers to your API and interpreting the Access-Control headers in the response to categorize risk levels.

What is origin reflection in CORS and why is it dangerous?▼

Origin reflection is a CORS misconfiguration where the API reflects the request's Origin header in the Access-Control-Allow-Origin response, enabling unauthorized cross-origin access and credential leakage risks.

How can I test if my web service allows wildcard origins with credentials?▼

You can test for wildcard origins with credentials by sending controlled requests to the target URL and interpreting the Access-Control headers in the response to identify this unsafe configuration and assess credential leakage risks.

Can I detect null origin vulnerabilities across my API endpoints?▼

Yes, this skill detects null origin vulnerabilities by testing various Origin headers, including null, against your API endpoints and interpreting the Access-Control response headers to assess the risk level.

What is the best way to assess Access-Control headers for security risks?▼

The best way to assess Access-Control headers is to send controlled requests with various Origin headers and interpret the responses to categorize risk levels and provide remediation guidance for detected CORS misconfigurations.

Does this CORS check provide remediation guidance for detected issues?▼

Yes, this skill provides remediation guidance and risk assessment by categorizing risk levels for detected CORS misconfigurations like origin reflection and wildcard origins with credentials, and offering actionable advice to improve API security.