ClawHub
Back to skill

Security audit

Phy Cors Audit

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real CORS auditing skill, but it needs review because it can probe arbitrary URLs from the agent environment and includes an unsafe generated Express preflight example.

Review before installing. Use it only for endpoints you own or are authorized to test, and avoid running it against localhost, private network addresses, metadata services, or untrusted user-supplied URLs. Treat generated Express snippets cautiously and ensure preflight handling reuses the same restricted CORS policy.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:96
Finding

Unrestricted Target URL Enables Server-Side Request Forgery

Content
View full analysis
dict: """Send a single CORS probe and return response headers.""" result = subprocess.run( ['curl', '-sI', '-X', method, url, '-H', f'Origin: {origin}', '-H', 'Content-Type: application/json', '--max-time', '10', '--user-agent', 'CorsAuditor/1.0'], capture_output=True, text=True ) ``` ### Technical Analysis The user-controlled `url` is passed directly to `curl` without validating its scheme, hostname, port, resolved IP address, or network destination. The skill explicitly advertises support for probing any supplied URL. Using an argument array prevents conventional shell metacharacter injection, but it does not prevent server-side request forgery. An attacker can supply URLs targeting loopback interfaces, private address ranges, link-local services, cloud metadata endpoints, or internal hostnames accessible from the agent's execution environment. The code also does not explicitly restrict curl to HTTP and HTTPS protocols. Although the `-I` option limits normal HTTP probes to response headers, those headers can still disclose internal software, service availability, authentication behavior, routing information, and CORS configuration. ### Attack Path 1. An attacker persuades a user or automated agent to audit an attacker-selected target. 2. The attacker supplies an internal URL, such as a loopback address, private service hostname, or link-local metadata endpoint. 3. `probe_cors()` passes the URL directly to `curl`. 4. The request originates from the environment running the skill rather than from the attacker. 5. The internal service's status code and response headers are parsed and included in the audit result. 6. The attacker uses the results for in ...[truncated 655 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:493
Finding

Generated Express Preflight Handler Does Not Reuse the Restricted CORS Policy

Content
View full analysis
{{ // Allow requests with no origin (server-to-server, curl) if (!origin || ALLOWED_ORIGINS.has(origin)) {{ callback(null, true); }} else {{ callback(new Error(`Origin ${{origin}} not allowed by CORS`)); }} }}, credentials: {str(allow_credentials).lower()}, methods: {methods}, allowedHeaders: {headers}, }})); // Always respond to preflight app.options('*', cors()); ``` The same insecure pattern is repeated in the example at `SKILL.md:694`: ```javascript app.options('*', cors()); // handle preflight ``` ### Technical Analysis The main Express middleware uses an explicit origin allowlist, but the preflight route creates a new `cors()` middleware instance without passing the restricted options. The default Express `cors` configuration is permissive and can return wildcard CORS approval for OPTIONS requests. Consequently, the generated configuration applies one policy to normal requests and a different policy to preflight requests. This does not automatically expose credentialed data in a correctly behaving browser because the default preflight handler does not enable credentials and the restricted main middleware may still reject the subsequent request. However, it creates an incorrect and unexpectedly permissive security boundary. It may widen unauthenticated cross-origin access and can become exploitable when combined with permissive route handlers, middleware ordering mistakes, custom clients, or later configuration changes. ### Attack Path 1. A developer copies the generated Express configuration and expects the allowlist to apply to all CORS processing. 2. An attacker-controlled origin submits an OPTIONS preflight request. 3. The req ...[truncated 854 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:436
Finding

Substring-Based Directory Exclusions Can Hide Files from Security Scanning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.

md
allowedHeaders: {headers},
}}));

// Always respond to preflight
app.options('*', cors());''',

        'fastapi': f'''# FastAPI (pip install fastapi)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad terms such as "preflight" and "cors policy," which are common in ordinary debugging or educational discussions and may cause the skill to activate when the user did not intend to run a live security audit. In this skill, unintended invocation matters because the tool is designed to probe live URLs and scan code, increasing the chance of unnecessary network activity or disruptive workflow behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash
# Option 1: Probe a live API endpoint
/cors-audit https://api.myapp.com/users

# Option 2: Probe with specific origin
/cors-audit https://api.myapp.com --origin https://evil.com

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 625)May include surrounding context.

bash
# Option 1: Probe a live API endpoint
/cors-audit https://api.myapp.com/users

# Option 2: Probe with specific origin
/cors-audit https://api.myapp.com --origin https://evil.com

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md
CODE_PATTERNS = [

    # Express cors() with no options = allow all origins
    {
        'name': 'EXPRESS_CORS_NO_OPTIONS',
        'pattern': re.compile(r'app\.use\s*\(\s*cors\s*\(\s*\)\s*\)', re.I),

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.

md
),
    },

    # Python: CORS_ORIGINS = "*" or origins="*"
    {
        'name': 'PYTHON_CORS_WILDCARD',
        'pattern': re.compile(