Cross-Origin Security Review
Reviews code for unsafe CORS, postMessage origin checks, CSRF gaps and open redirects.
- Repository
- thedaviddias/Front-End-Checklist
- Stars
- 74,632
- Licence
- MIT
- Files
- 2 files
What it does
When installed, the agent reviews web code (scripts, client components, bundles) for cross-origin security mistakes. It looks for postMessage listeners that do not check event.origin, overly permissive CORS settings on logged-in routes, missing CSRF protection, and redirect parameters that accept arbitrary external URLs, then suggests fixes such as origin allow-lists. It also explains how the Same-Origin Policy, CORS and postMessage work.
Great for
- Front-end or full-stack developers reviewing a web app before release
- Teams checking login, logout, SSO and return-to flows for open redirects
- Developers learning why CORS and postMessage need careful origin checks
Skip it if
- Replacing a professional security audit: the skill is a checklist-style prompt and may miss issues or suggest incomplete fixes
- Non-technical users without a codebase to review, since the output is code-level advice
Try asking
- “Review this login component for postMessage listeners that don't validate event.origin.”
- “Check our Express CORS config for overly permissive settings on authenticated routes.”
- “Find open redirect risks in our login, logout and SSO return-to flows.”
- “Explain how CORS and the Same-Origin Policy apply to our API calls from the browser.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
cross-origin-security.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip cross-origin-security.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip cross-origin-security.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent at specific files or components rather than the whole repository for more precise findings.
- Ask it to state how to verify each fix in the browser, since the skill asks for browser-level verification.
- Treat its output as a review aid and confirm findings with a security expert for sensitive applications.
What's inside
- references/rule.md
- SKILL.md
Redistributed unmodified from thedaviddias/Front-End-Checklist under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.