{"slug":"elementalsouls-hunt-cors","source_name":"elementalsouls/hunt-cors","name":"Elementalsouls/Hunt CORS","description":"Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.","version":1,"lift":{"pass_rate_delta_pts":8,"pass_rate_pct":92,"total_cases":25,"passed_cases":23,"tokens_delta_pct":158.6,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-09T13:32:38.009491+00:00"},"skill_score":0.92,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":8,"with_pass_pct":92,"without_pass_pct":84,"tokens_delta_pct":158.6,"turns_delta_pct":0,"total_cases":25,"cases_aggregated":25,"verdict":"mixed","never_hurt":true,"completed_at":"2026-08-09T13:32:38.009491+00:00","run_id":"f6bf7112-7c69-4438-aafe-9be4c149542a","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"NOASSERTION","install_count":0,"manifest_hash":"37e8d80cdf985d71fdd955847e769c745178036ae3d61cda36f02af5eda456a0","raw_url":"https://app.decimal.ai/s/elementalsouls-hunt-cors/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/elementalsouls-hunt-cors"}