Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-cors
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser.
Passed 5 of 23 test cases with the skill, and 18 of 23 without it.
1 fixed13 passed either way5 still failing4 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Triage the following two CORS findings: 1) /api/health reflects Origin: https://evil.com with ACAC: true, returning {"status": "ok"}. 2) /api/v1/user/tokens reflects Origin: https://evil.com with ACAC: true, returning user API keys. Assign severity ratings to both findings with rationale.
| Checked | Without skill | With skill |
|---|---|---|
| Classifies the /api/health reflection as Informational severity due to non-sensitive data. | Passed | Passed |
| Classifies the /api/v1/user/tokens reflection as High severity due to credentialed access to sensitive API keys. | Missed | Passed |
The instructions your model reads when the skill loads.
CORS pays High only when an attacker-controlled origin can perform a
credentialed cross-origin read of sensitive authenticated data, and you
have a browser PoC proving the response body is readable from evil.com.
Two hard browser rules that kill most "findings" — check these FIRST:
Access-Control-Allow-Origin: * CANNOT be combined with credentials.
If the server returns ACAO: *, the browser refuses to send/expose the
response for a credentials: include request. A wildcard-only endpoint is
not credential-exploitable. It is only interesting if the data it serves
is sensitive without a session (rare) — usually this is Informational/Low.Access-Control-Allow-Credentials: true is meaningless on its own. It
matters only if ACAO reflects/allows your specific attacker origin AND a
cross-origin credentialed fetch actually returns a readable body. ACAC on a
response that does not reflect your origin proves nothing.If you cannot demonstrate a readable cross-origin authed body in a real browser, you do not have a High. Do not submit header-diffing alone.
Origin header AND
sets ACAC: true → any site reads authed API responses. The classic High.ACAO: null + ACAC: true. A sandbox iframe (or a
data:/redirect chain) emits Origin: null, so any page can read authed data.event.data without strictly validating event.origin.test cases passed, vs 18 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.