cors
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's instructions and code snippets follow industry-standard security best practices for CORS configuration. It explicitly warns against insecure configurations like using a wildcard origin with credentials enabled.
- [SAFE]: No evidence of prompt injection, data exfiltration, obfuscation, or malicious persistence mechanisms was found in the provided files.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for handling external data (the Origin header) in the provided code templates. Ingestion points: Incoming HTTP request headers (req.headers.origin) in SKILL.md. Boundary markers: The code uses explicit whitelist checks. Capability inventory: No dangerous system or network capabilities are invoked by the skill itself. Sanitization: Examples include validation logic to ensure only trusted origins are permitted.
Audit Metadata