← Back to Skills Marketplace
cors-scanner
by
charlie-morrison
· GitHub ↗
· v1.0.0
· MIT-0
68
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install cors-scanner
Description
Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP o...
README (SKILL.md)
CORS Misconfiguration Scanner
Scan web endpoints for dangerous Cross-Origin Resource Sharing policies. Detect misconfigurations that could allow attackers to steal data cross-origin.
Quick Scan
python3 scripts/cors_scan.py https://api.example.com
Batch Scan
python3 scripts/cors_scan.py https://api1.com https://api2.com https://api3.com
Output Formats
# Text (default)
python3 scripts/cors_scan.py \x3Curl>
# JSON
python3 scripts/cors_scan.py \x3Curl> --format json
# Markdown report
python3 scripts/cors_scan.py \x3Curl> --format markdown
CI/CD Integration
# Fail if any URL grades below C
python3 scripts/cors_scan.py https://api.example.com --min-grade C
echo $? # 0 = pass, 1 = fail
What It Checks (13 checks)
| Check | Severity | Description |
|---|---|---|
| Origin reflection | Critical/High | Server reflects arbitrary Origin back as ACAO |
| Credentials + wildcard | Critical | ACAO: * with ACAC: true (browser-blocked but misconfigured) |
| Null origin accepted | High/Medium | Origin: null trusted (exploitable via sandboxed iframes) |
| HTTP origin on HTTPS | High | HTTPS endpoint trusts HTTP origins (MitM risk) |
| Subdomain wildcard | High | Trusts any subdomain (*.domain.com) |
| Third-party origin | High | Confirms reflection with different attacker domain |
| Private network access | High | Allows external sites to reach internal network |
| Wildcard origin (*) | Medium | ACAO: * on potentially sensitive endpoints |
| Sensitive headers exposed | Medium | Exposes auth/session headers cross-origin |
| Wildcard methods | Medium | ACAM: * allows any HTTP method |
| Wildcard headers | Medium | ACAH: * allows any custom header |
| Missing max-age | Low | No preflight caching, increased latency |
| Clean | Info | No misconfigurations detected |
Grading
| Grade | Meaning |
|---|---|
| A | No CORS issues detected |
| B | Minor issues (low severity) |
| C | Moderate issues (medium severity) |
| D | Serious issues (high severity or multiple medium) |
| F | Critical misconfigurations (origin reflection + credentials) |
Requirements
- Python 3.6+
- No external dependencies (stdlib only)
Examples
$ python3 scripts/cors_scan.py https://httpbin.org/get
CORS Scan: https://httpbin.org/get
Grade: A
Findings: 0
============================================================
⚪ [INFO] No CORS misconfigurations detected
The scanned endpoint does not appear to have dangerous CORS policies.
Usage Guidance
This skill is internally consistent with being a CORS misconfiguration scanner: it only needs to make HTTP(S) requests and inspect headers. Before running it, consider these practical points: (1) the included script disables TLS verification (ssl.CERT_NONE) and turns off hostname checks — this is common in scanning tools to avoid failing on self-signed certs but means the scanner will accept invalid certificates; (2) the scanner will send crafted Origin headers and may trigger server-side behavior—only scan endpoints you own or have permission to test to avoid legal issues; (3) I reviewed most of the script, but the provided source was truncated in the listing — inspect the full scripts/cors_scan.py locally to confirm there are no calls that log or transmit results to third-party services before executing; (4) run the tool in an isolated environment (or sandbox) if you want extra caution. If you can provide the complete scripts/cors_scan.py contents I can raise my confidence to high.
Capability Analysis
Type: OpenClaw Skill
Name: cors-scanner
Version: 1.0.0
The cors-scanner bundle provides a functional tool for auditing CORS misconfigurations, but the core script (scripts/cors_scan.py) contains a significant security vulnerability by explicitly disabling SSL certificate verification (ssl.CERT_NONE). While this is often done in security tools to facilitate testing of development environments, it exposes the agent to Man-in-the-Middle (MitM) attacks. Per the analysis criteria, this unintentional vulnerability warrants a suspicious classification despite the lack of clear malicious intent or data exfiltration.
Capability Assessment
Purpose & Capability
Name/description align with the included script: the code issues HTTP(S) requests with crafted Origin headers and inspects CORS response headers to detect reflection, wildcards, null origin, preflight issues, private-network access, etc. No unrelated credentials, binaries, or services are requested.
Instruction Scope
SKILL.md simply instructs running the included Python script against target URLs and describes expected outputs/formats. The instructions do not ask the agent to read local files, environment variables, or send results to external endpoints. Note: the script performs network requests to arbitrary targets (expected for a scanner).
Install Mechanism
No install spec is present and the tool uses only Python standard library (urllib, ssl, argparse). This is proportionate for a lightweight scanner. The package is delivered as source (scripts/cors_scan.py) so no external downloads during install.
Credentials
The skill declares no required environment variables, credentials, or config paths. The script does not appear to reference secrets. This is appropriate for a network-scanning utility.
Persistence & Privilege
always:false and no special privileges or modifications to other skills/systems are requested. The skill does not request permanent presence or elevated agent configuration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install cors-scanner - After installation, invoke the skill by name or use
/cors-scanner - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release
Metadata
Frequently Asked Questions
What is cors-scanner?
Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP o... It is an AI Agent Skill for Claude Code / OpenClaw, with 68 downloads so far.
How do I install cors-scanner?
Run "/install cors-scanner" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is cors-scanner free?
Yes, cors-scanner is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does cors-scanner support?
cors-scanner is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created cors-scanner?
It is built and maintained by charlie-morrison (@charlie-morrison); the current version is v1.0.0.
More Skills