← 返回 Skills 市场
cors-scanner
作者
charlie-morrison
· GitHub ↗
· v1.0.0
· MIT-0
68
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install cors-scanner
功能描述
Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP o...
使用说明 (SKILL.md)
CORS Misconfiguration Scanner
Scan web endpoints for dangerous Cross-Origin Resource Sharing policies. Detect misconfigurations that could allow attackers to steal data cross-origin.
Quick Scan
python3 scripts/cors_scan.py https://api.example.com
Batch Scan
python3 scripts/cors_scan.py https://api1.com https://api2.com https://api3.com
Output Formats
# Text (default)
python3 scripts/cors_scan.py \x3Curl>
# JSON
python3 scripts/cors_scan.py \x3Curl> --format json
# Markdown report
python3 scripts/cors_scan.py \x3Curl> --format markdown
CI/CD Integration
# Fail if any URL grades below C
python3 scripts/cors_scan.py https://api.example.com --min-grade C
echo $? # 0 = pass, 1 = fail
What It Checks (13 checks)
| Check | Severity | Description |
|---|---|---|
| Origin reflection | Critical/High | Server reflects arbitrary Origin back as ACAO |
| Credentials + wildcard | Critical | ACAO: * with ACAC: true (browser-blocked but misconfigured) |
| Null origin accepted | High/Medium | Origin: null trusted (exploitable via sandboxed iframes) |
| HTTP origin on HTTPS | High | HTTPS endpoint trusts HTTP origins (MitM risk) |
| Subdomain wildcard | High | Trusts any subdomain (*.domain.com) |
| Third-party origin | High | Confirms reflection with different attacker domain |
| Private network access | High | Allows external sites to reach internal network |
| Wildcard origin (*) | Medium | ACAO: * on potentially sensitive endpoints |
| Sensitive headers exposed | Medium | Exposes auth/session headers cross-origin |
| Wildcard methods | Medium | ACAM: * allows any HTTP method |
| Wildcard headers | Medium | ACAH: * allows any custom header |
| Missing max-age | Low | No preflight caching, increased latency |
| Clean | Info | No misconfigurations detected |
Grading
| Grade | Meaning |
|---|---|
| A | No CORS issues detected |
| B | Minor issues (low severity) |
| C | Moderate issues (medium severity) |
| D | Serious issues (high severity or multiple medium) |
| F | Critical misconfigurations (origin reflection + credentials) |
Requirements
- Python 3.6+
- No external dependencies (stdlib only)
Examples
$ python3 scripts/cors_scan.py https://httpbin.org/get
CORS Scan: https://httpbin.org/get
Grade: A
Findings: 0
============================================================
⚪ [INFO] No CORS misconfigurations detected
The scanned endpoint does not appear to have dangerous CORS policies.
安全使用建议
This skill is internally consistent with being a CORS misconfiguration scanner: it only needs to make HTTP(S) requests and inspect headers. Before running it, consider these practical points: (1) the included script disables TLS verification (ssl.CERT_NONE) and turns off hostname checks — this is common in scanning tools to avoid failing on self-signed certs but means the scanner will accept invalid certificates; (2) the scanner will send crafted Origin headers and may trigger server-side behavior—only scan endpoints you own or have permission to test to avoid legal issues; (3) I reviewed most of the script, but the provided source was truncated in the listing — inspect the full scripts/cors_scan.py locally to confirm there are no calls that log or transmit results to third-party services before executing; (4) run the tool in an isolated environment (or sandbox) if you want extra caution. If you can provide the complete scripts/cors_scan.py contents I can raise my confidence to high.
功能分析
Type: OpenClaw Skill
Name: cors-scanner
Version: 1.0.0
The cors-scanner bundle provides a functional tool for auditing CORS misconfigurations, but the core script (scripts/cors_scan.py) contains a significant security vulnerability by explicitly disabling SSL certificate verification (ssl.CERT_NONE). While this is often done in security tools to facilitate testing of development environments, it exposes the agent to Man-in-the-Middle (MitM) attacks. Per the analysis criteria, this unintentional vulnerability warrants a suspicious classification despite the lack of clear malicious intent or data exfiltration.
能力评估
Purpose & Capability
Name/description align with the included script: the code issues HTTP(S) requests with crafted Origin headers and inspects CORS response headers to detect reflection, wildcards, null origin, preflight issues, private-network access, etc. No unrelated credentials, binaries, or services are requested.
Instruction Scope
SKILL.md simply instructs running the included Python script against target URLs and describes expected outputs/formats. The instructions do not ask the agent to read local files, environment variables, or send results to external endpoints. Note: the script performs network requests to arbitrary targets (expected for a scanner).
Install Mechanism
No install spec is present and the tool uses only Python standard library (urllib, ssl, argparse). This is proportionate for a lightweight scanner. The package is delivered as source (scripts/cors_scan.py) so no external downloads during install.
Credentials
The skill declares no required environment variables, credentials, or config paths. The script does not appear to reference secrets. This is appropriate for a network-scanning utility.
Persistence & Privilege
always:false and no special privileges or modifications to other skills/systems are requested. The skill does not request permanent presence or elevated agent configuration.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install cors-scanner - 安装完成后，直接呼叫该 Skill 的名称或使用
/cors-scanner触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release
元数据
常见问题
cors-scanner 是什么？
Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP o... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 68 次。
如何安装 cors-scanner？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install cors-scanner」即可一键安装，无需额外配置。
cors-scanner 是免费的吗？
是的，cors-scanner 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
cors-scanner 支持哪些平台？
cors-scanner 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 cors-scanner？
由 charlie-morrison（@charlie-morrison）开发并维护，当前版本 v1.0.0。
推荐 Skills