By psylch
Comprehensive CORS audit skill — diagnose misconfigurations, duplicate headers, and cross-origin issues across gateway, backend, and frontend layers. Covers standard setups, micro-app architectures (Qiankun, single-spa), and multi-origin scenarios.
A Claude Code skill that performs architecture-level CORS audits. Unlike configuration-only tools, this skill audits the entire request path — gateway, backend, and frontend — to catch issues that single-layer tools miss.
Born from real production debugging: duplicate Access-Control-Allow-Origin headers from Caddy + FastAPI, broken micro-app embedding, and environment-specific misconfigurations.
| What it covers | How |
|---|---|
| Duplicate CORS headers | Detects when gateway + backend both set headers (the #1 CORS bug) |
| Gateway configs | Validates Caddyfile, nginx.conf for CORS issues |
| Micro-app embedding | Qiankun / single-spa origin and URL path pitfalls |
| Environment separation | Dev vs production CORS strategy audit |
| Multi-origin APIs | Dynamic origin reflection patterns |
| Automated validation | Bundled Python script tests live endpoints and static configs |
npx skills (recommended)npx skills add psylch/cors-audit-skill -g -y
In Claude Code:
/plugin marketplace add psylch/cors-audit-skill
/plugin install cors-audit@psylch-cors-audit-skill
git clone https://github.com/psylch/cors-audit-skill.git ~/.claude/skills/cors-audit-skill
Restart Claude Code after installation.
In Claude Code, use any of these trigger phrases:
audit CORS configuration
check CORS headers
diagnose cross-origin issue
CORS 走查
跨域问题排查
The skill guides Claude through a 6-phase audit process:
The bundled scripts/validate_cors.py automates key checks:
# Test a live endpoint (detects duplicate headers, preflight issues, origin policy)
python scripts/validate_cors.py --url https://api.example.com/health --origin https://app.example.com
# Validate a static config file (Caddyfile, nginx.conf, or JSON policy)
python scripts/validate_cors.py --config path/to/Caddyfile
# Batch test multiple endpoints
python scripts/validate_cors.py --url-file endpoints.txt --origin https://app.example.com
# JSON output for CI integration
python scripts/validate_cors.py --url https://api.example.com/health --origin https://app.example.com --format json --output report.json
Exit codes: 0 = pass, 2 = critical issues found. Zero external dependencies.
| Pattern | Example | CORS Strategy |
|---|---|---|
| Same-origin | Monolith serving HTML + API | No CORS needed |
| Simple cross-origin | app.com → api.com | Backend handles CORS |
| Gateway-proxied | Caddy/Nginx in front of both | Gateway handles CORS, backend disabled |
| Micro-app embedded | Qiankun app in host site | Gateway with host domain as allowed origin |
| Multi-consumer API | Multiple frontends → one API | Dynamic origin reflection |
cors-audit-skill/
├── .claude-plugin/
│ ├── marketplace.json
│ └── plugin.json
├── skills/
│ └── cors-audit/
│ ├── SKILL.md # 6-phase audit process
│ ├── scripts/
│ │ └── validate_cors.py # Automated validator (stdlib only)
│ └── references/
│ ├── architecture_patterns.md # 5 patterns with config examples
│ └── cors_checklist.md # 30+ audit items with pass/fail criteria
├── README.md
├── README.zh.md
└── LICENSE
MIT
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
npx claudepluginhub psylch/cors-audit-skill --plugin cors-auditConfigures a complete Ghostty-based terminal AI coding environment with Fish, yazi, lazygit, Neovim (LazyVim), fzf, zoxide, atuin on macOS with Apple Silicon — with CJK font optimization for Chinese/Japanese/Korean users
Skill development toolkit for AI coding agents: create, review, and publish skills with runtime UX best practices
Search, validate, and save cloud drive resources via PanSou aggregation API and local Quark desktop APP integration
All-in-one media acquisition toolkit: Hi-Res music downloads, cloud drive resource search, and book downloads
Initialize a project-level context management system with docs/ directory structure, Claude Code hooks (session-start, quality-gate), and CLAUDE.md navigation. Use when starting a new project, bootstrapping context management, or when the user says '/ch-project-context init', 'init project context', 'setup context management', 'initialize docs structure'.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Harness-native ECC operator layer - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, and rules evolved over 10+ months of intensive daily use
Professional WordPress engineering skills for Claude Code — performance optimization, security auditing, Gutenberg block development, and theme/plugin best practices