cors

Test CORS configurations for origin reflection and credential-bearing requests.

Updated Jul 30, 2026

Search Tags:#security #vulnerability #api #web-security #cors #pentest

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill cors-salmanabdurrahman

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cors
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/cors
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill cors-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the risk of Cross-Origin Resource Sharing (CORS) misconfigurations, which can lead to unauthorized credentialed data access and sensitive information leakage.

Core Features & Use Cases

Policy Discovery: Automatically identifies origin reflection, wildcard usage, and credential-bearing CORS configurations.
Bypass Testing: Probes for common security gaps including null-origin, subdomain trust-chain abuse, and protocol downgrade vulnerabilities.
Use Case: Security engineers can use this to audit authenticated API endpoints to ensure that sensitive user data is protected from cross-origin exploitation by unauthorized third-party domains.

Quick Start

Use the cors skill to audit the authentication endpoints defined in the current scope for origin reflection and credential leakage.

Frequently Asked Questions about cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test my API for CORS origin reflection vulnerabilities?▼

Test CORS origin reflection by probing authorized web APIs to check if the server echoes arbitrary origin values in the Access-Control-Allow-Origin header while allowing credentialed requests to expose sensitive data.

What is a CORS misconfiguration that leads to sensitive data leakage?▼

A CORS misconfiguration causing sensitive data leakage occurs when wildcard origins or subdomain trust-chains allow unauthorized third-party domains to extract authenticated user data via cross-origin requests.

How do I audit authenticated web API endpoints for cross-origin security?▼

Audit authenticated web API endpoints by validating preflight handling, probing for null-origin bypasses, and testing credential-bearing requests to ensure sensitive user data is protected from unauthorized cross-origin exploitation.

Can I test for null-origin and subdomain trust-chain bypasses in CORS policies?▼

Yes, you can test for null-origin and subdomain trust-chain bypasses by probing target web APIs for common security gaps, including protocol downgrade vulnerabilities and subdomain trust-chain abuse.

What authorization is required to safely perform CORS security assessments?▼

Safe CORS security assessments require adherence to strict authorization gates, scope validation, and evidence-based reporting protocols to ensure testing only targets authorized web APIs within the defined scope.