Cors Misconfig Check Lite

CORS Misconfig Check (Lite)

Analyze Access-Control-* response headers the user pastes (from curl -H "Origin: …" -I or DevTools) for dangerous combinations. Offline.

Scope and rules

• Input is header text the user supplies — this lite does NOT probe origins.
• Findings are about header combos, not exploitability against a specific endpoint — verify context before claiming impact.
• ACAO: * + ACAC: true is effectively impossible per spec but signals broken config; reflected ACAO + credentials is the critical case.

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/cors.js headers.txt
curl -sI -H "Origin: https://evil.example" https://api.example.com | node <skill-dir>/scripts/cors.js -

JSON on stdout; exit 1 on fail findings, 2 on usage/read error.

2. Read the report

• findings[]: id, severity, detail, fix.
• headers: the Access-Control-* values seen (safe to print — they are not credentials).

3. Deliver

Explain each finding in one line. For reflected-origin + credentials: recommend an explicit allowlist and Vary: Origin. For *: fine for public data, wrong for authenticated APIs.

Lite vs full

The full cors-misconfig-check sends real preflight and origin-reflection probes (attacker origin, null, subdomain takeovers), checks ACAH/exposed-headers breadth, and tests per-endpoint variance.

Rate this skill

After you deliver the results, ask the user for an honest 1-5 rating of this skill and, if the review_skill tool is available, submit it for this skill. Ratings decide marketplace placement.