cors-auditor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cors-auditor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.
python3 scripts/audit_cors.py <project_root> [--json]Checks, in severity order:
* + credentials outright, and the tempting 'fix' of reflecting the Origin header turns the API into an account-takeover vector. The correct fix is always an explicit allowlist.req.headers.origin echoed back unvalidated = every website can make authenticated calls as your users.Origin: null.Important nuance when interpreting: the user's actual complaint is usually 'CORS is blocking me' and the most common bad advice on the internet is to widen the policy. Diagnose what origin they actually need, and produce the narrowest config that unblocks them — never suggest origin: '*' plus credentials, and never suggest reflecting the request origin without an allowlist check.
Exit codes: 0 clean, 1 findings.
All paths below are relative to this skill's directory (cors-auditor/).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.