Detect CORS misconfigurations in web APIs during HTTP discovery.
npx skills add https://github.com/ersinkoc/security-check --skill sc-cors
Please help me install this Agent Skill. Skill: sc-cors Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-cors Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-cors
CORS misconfigurations can expose sensitive APIs to unintended origins, enabling data leakage and misuse. This skill identifies risky patterns that allow unauthorized cross-origin access, such as wildcard origins with credentials or unsafe origin reflection.
Use the CORS scan against your API to identify misconfigurations and insecure origins.
High-intent search queries and answers about installing and using this skill.
To detect CORS misconfigurations, scan your web API for wildcard origins used with credentials, unsafe origin reflection, null-origin allowances, and weak regex-based allowlists that enable bypasses.
A CORS configuration becomes vulnerable when it reflects request origins without validation, allows null origins, or uses wildcard origins alongside credentials, exposing sensitive APIs to data leakage and misuse.
Check your regex-based CORS allowlist by evaluating origin checks and header handling across deployments to identify weak patterns that fail to properly validate origins and enable bypasses.
Yes, you can apply CORS scanning during HTTP API discovery to evaluate origin checks, header handling, and regex-based allowlists across all your deployments to ensure strict origin validation.
Fix wildcard origins with credentials by enforcing strict origin allowlists, ensuring proper credential handling, and configuring safe default responses to prevent unauthorized cross-origin access.
Q16GAnalyze CORS response headers to identify misconfigurations in web APIs.
yezannnnnAutomate security scans, risk scoring, and compliance reporting for software projects.
louisbrulenaudetReview web applications and API gateways for security vulnerabilities.
cybersecwomanDetect API security misconfigurations including mass assignment, JWT attacks, and CORS issues.
