A security audit tool that scans web endpoints for dangerous CORS misconfigurations and assigns a security grade from A to F.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install cors-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install cors-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CORS Misconfiguration Scanner?
The CORS Misconfiguration Scanner is a lightweight, Python-based security tool designed to identify vulnerabilities in how web servers handle Cross-Origin Resource Sharing. By utilizing Openclaw Skills, developers and security researchers can quickly detect common pitfalls like origin reflection, wildcard policies, and null origin acceptance that could lead to unauthorized cross-origin data access. This skill provides a comprehensive security assessment by performing 13 distinct checks on any given URL.
It helps maintain a robust security posture by identifying misconfigured headers that might expose sensitive authentication tokens or session data to malicious third-party domains. The tool is particularly valuable for teams practicing DevSecOps, as it allows for the rapid identification of misconfigurations that could allow attackers to steal sensitive user data across origin boundaries.
CORS Misconfiguration Scanner Use Cases
- Automated security auditing of REST APIs and web endpoints to ensure compliance.
- Identifying origin reflection vulnerabilities that bypass standard browser protections.
- Evaluating the security of internal private network access policies to prevent SSRF-like attacks.
- Performing bulk scans across multiple microservices within a cloud environment.
- Integrating CORS security gates into CI/CD pipelines to prevent shipping insecure configurations.
How CORS Misconfiguration Scanner Works
- The user provides one or more target URLs to the scanner via the command line interface.
- The skill initiates a series of HTTP requests simulating various cross-origin scenarios such as origin reflection, null origin, and HTTP vs HTTPS trust.
- The tool analyzes the response headers—specifically Access-Control-Allow-Origin (ACAO) and Access-Control-Allow-Credentials (ACAC)—against 13 security rules.
- Findings are weighted by severity, ranging from Critical to Info.
- A final security grade from A to F is calculated based on the aggregate risk level of the detected issues.
- A detailed report is generated in the requested format, providing actionable insights for remediation.
CORS Misconfiguration Scanner Setup
To use this Openclaw Skills tool, ensure you have Python 3.6 or higher installed on your system. This scanner relies exclusively on the Python standard library, requiring no external dependencies.
# Run a scan on a single target URL
python3 scripts/cors_scan.py https://api.example.com
# Run a batch scan on multiple endpoints
python3 scripts/cors_scan.py https://api1.com https://api2.com
CORS Misconfiguration Scanner Data Schema & Taxonomy
The scanner organizes its output into structured findings and security grades to facilitate clear reporting. Data can be exported in the following formats:
| Feature | Details |
|---|---|
| Output Formats | Text (default), JSON, and Markdown report support. |
| Grading Scale | A (Clean) to F (Critical misconfigurations detected). |
| Severity Levels | Critical, High, Medium, Low, and Info categories. |
| Taxonomy | Identifies specific issues like Origin Reflection, Wildcard Methods, and Private Network Access. |
| Exit Codes | Returns 0 for pass and 1 for failure in CI/CD environments. |
CORS Misconfiguration Scanner Advanced Features
- Batch scanning capabilities for processing multiple URLs in a single execution for large-scale audits.
- CI/CD integration support with configurable exit codes based on a minimum acceptable security grade (e.g., --min-grade C).
- Multiple output formats including machine-readable JSON for automated reporting and database ingestion.
- Specialized detection for Private Network Access (PNA) vulnerabilities, protecting internal resources.
- Support for preflight request analysis including Access-Control-Max-Age and custom header validation.
SKILL.md
Loading
Related Openclaw Skills
Prettier Config Validator
A robust diagnostic utility for validating and linting Prettier configuration files across multiple formats to ensure project consistency.
KAMIS CLI: Korean Agricultural Price Data
A specialized CLI tool for fetching daily wholesale and retail price data for Korean agricultural, livestock, and aquatic products via the official KAMIS OpenAPI.
Task Retrospective
A structured framework for AI agents to evaluate their performance, extract reusable patterns, and improve future task execution.
Vulnerability Prioritizer
A high-performance risk prioritization engine that filters scanner noise using real-world exploit intelligence and asset context.
Helm Chart Linter
A pure Python linter and validator designed to ensure Helm charts follow security, structure, and dependency best practices.
Dependency Health Check
A multi-ecosystem audit tool to identify outdated, vulnerable, and unused packages while ensuring license compliance.
Featured*
