hunt-cors

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An operationally dense, executable CORS hunting playbook with strong validation discipline and clear sequencing. The only gap is that a fair amount of detail (regex-bypass table, full PoC variants) lives inline in one file with no progressive offloading to reference files.

Suggestions

Consider moving the Phase 3 regex-bypass table and the full set of browser PoC variants into a reference file, leaving SKILL.md as a tighter overview that links out to it.

Dimension	Reasoning	Score
Conciseness	Lean and assumes Claude's competence — it never explains what CORS, origins, or pre-flight are; every section (browser rules, regex-bypass table, PoCs) is directly action-bearing and earns its tokens.	5 / 5
Actionability	Copy-paste-ready curl probes, a class-to-payload regex table, and complete browser PoC HTML for reflect/null-origin reads cover the common cases with executable, specific commands.	5 / 5
Workflow Clarity	A clear Phase 1–6 sequence with explicit validation checkpoints and feedback loops ('curl reflecting a header is NOT exploitation', 'if you see BLOCKED you have nothing', 'Browser proof mandatory') — strong error-recovery guidance for this batch/recon skill.	5 / 5
Progressive Disclosure	Well-organized into clear sections with cross-links to sibling skills (hunt-subdomain, hunt-dom, hunt-csrf) that are one-level-deep, but the ~285-line body keeps all the detailed regex table and multiple PoC variants inline rather than offloading any to reference files.	4 / 5
	Total	19 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, trigger-rich description that names the specific CORS flaw classes and gives explicit 'when' guidance. It is technical rather than layperson-facing, which slightly caps trigger-term quality.

Suggestions

Add a few broader user-facing synonyms (e.g. 'cross-origin sharing', 'CORS policy') to broaden trigger-term coverage for less-expert phrasings.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete flaw classes — 'origin-reflection with credentials', 'null-origin trust', 'subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only)', 'pre-flight (OPTIONS) gating bypass', 'postMessage origin checks' — with comprehensive coverage of the CORS attack surface.	5 / 5
Completeness	Clearly states what it does ('Hunt CORS Misconfiguration' with enumerated flaw classes and the credentialed-read impact bar) and gives an explicit 'Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers' trigger clause.	5 / 5
Trigger Term Quality	Strong natural keywords a tester would say ('CORS', 'API endpoints', 'SPAs', 'Access-Control-* headers', 'credentials', 'cross-origin'), but the phrasing leans technical and is missing a few common synonyms/variations a less-expert user might say.	4 / 5
Distinctiveness Conflict Risk	A distinct niche (CORS misconfiguration hunting) with specific trigger signals ('Access-Control-* headers', credentialed cross-origin read) that minimize overlap with sibling skills like hunt-csrf or hunt-dom.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-cors/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.