How do I install the Cors Auditor skill?

Run npx skillmds@latest add starr-del/cors-auditor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cors Auditor safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cors Auditor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cors Auditor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cors Auditor?

Starr-del (@starr-del) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cors Auditor by starr-del — Agent Skill

Name: Cors Auditor
Author: Starr-del

Cors Auditor

Audit CORS configuration in Express, Next.js, FastAPI, or Flask code for security misconfigurations. Use whenever the user mentions CORS errors, 'blocked by CORS policy', cross-origin issues, configures an API for a frontend, or asks why credentials/cookies aren't being sent cross-origin. Also run it before deploying any API. Runs fully offline — no API keys, no network, no credentials.

Starr-del 928b57a 2 files · 8.9 KB Updated Sep 17, 2026

File contents

cors-auditor

Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.

python3 scripts/audit_cors.py <project_root> [--json]

Checks, in severity order:

WILDCARD_WITH_CREDENTIALS (critical) — browsers reject * + credentials outright, and the tempting 'fix' of reflecting the Origin header turns the API into an account-takeover vector. The correct fix is always an explicit allowlist.
REFLECTED_ORIGIN (critical) — req.headers.origin echoed back unvalidated = every website can make authenticated calls as your users.
NULL_ORIGIN_ALLOWED (high) — sandboxed iframes can claim Origin: null.
WILDCARD_PROD (medium) — legitimate only for truly public read-only APIs; confirm intent with the user.
LOCALHOST_IN_LIST (low) — dev config shipped to prod.

Important nuance when interpreting: the user's actual complaint is usually 'CORS is blocking me' and the most common bad advice on the internet is to widen the policy. Diagnose what origin they actually need, and produce the narrowest config that unblocks them — never suggest origin: '*' plus credentials, and never suggest reflecting the request origin without an allowlist check.

Exit codes: 0 clean, 1 findings.

All paths below are relative to this skill's directory (cors-auditor/).

Frequently asked questions