The Agent Skills Directory

[SAFE]: The skill uses curl to perform network operations directly related to its stated purpose of CORS security auditing. It does not attempt to exfiltrate sensitive data or access unauthorized endpoints.
[SAFE]: No hardcoded credentials, sensitive file access (such as SSH keys or environment files), or persistence mechanisms were detected in the skill files.
[SAFE]: The documentation references an external open-source tool on GitHub (Corsy) for optional automation but does not implement any automated downloads or execution of untrusted remote code.
[SAFE]: The skill processes untrusted data from HTTP headers, which represents a surface for indirect prompt injection. However, it specifically uses grep to filter for CORS-related headers, significantly reducing the risk of malicious instructions entering the agent's context. 1. Ingestion point: SKILL.md (Workflow Steps) reads headers via curl. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution (curl, grep, tr). 4. Sanitization: Filtering headers via grep isolates configuration data from potentially malicious content.

cors-check