feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/eol_cms_exploitation.md

@@ -10,16 +10,30 @@ You are testing **{target}** for end-of-life CMS core & plugins (WordPress/Drupa
 
 **METHODOLOGY:**
 
-### 1. Detect CMS + version
-- Pin CMS core version and enumerate plugins/themes/modules + versions (readme, changelog, asset hashes, REST endpoints)
+### 1. Detect CMS + exact version, enumerate extensions
+- Fingerprint: `<meta name="generator">`, `readme.html`/`CHANGELOG.txt`, `/wp-includes/version.php` behavior, asset query strings (`?ver=`), REST roots (`/wp-json/`, `/administrator/`, `/user/login`), favicon hash.
+- Tools by CMS: WordPress -> `wpscan --url {target} --enumerate vp,vt,u --api-token <t>`; Drupal -> `droopescan scan drupal`; Joomla -> `joomscan`; Magento -> `magescan` / `/magento_version`. Also `nuclei -t http/cves/ -t http/technologies/`.
+- Pin core version AND every plugin/theme/module version (readme, changelog, asset hashes, `/wp-content/plugins/<slug>/readme.txt`).
 
 ### 2. Flag EOL & correlate CVEs
-- Flag EOL core (e.g. Drupal 7/8, Magento 1, old WP branches) and EOL/abandoned plugins; map to known unauth RCE/SQLi/file-upload/auth-bypass CVEs
+- Check core against endoflife.date (e.g. Drupal 7/8 EOL, Magento 1 EOL, old WP branches, Joomla 3 EOL). Map EOL core + abandoned plugins to known unauth RCE / SQLi / arbitrary-file-upload / auth-bypass CVEs from wpscan DB / NVD / exploit-db. Confirm the affected version range precisely.
+- DECISION: prefer an unauthenticated, low-blast-radius issue for the PoC (e.g. a version-gated info leak or unauth read) over anything that writes.
 
-### 3. Confirm
-- Reproduce one concrete issue with a safe proof (version-gated echo / unauth read)
+### 3. Confirm with a SAFE proof
+- Reproduce ONE concrete issue benignly: an unauth read that returns version-specific data, a reflected marker, or a blind OOB callback with a per-attempt nonce. For an upload/RCE CVE, prove reachability with a non-executing marker file or an OOB ping — never drop a live web shell or modify content.
+- PROOF = the raw request + the version-specific response / OOB hit carrying the nonce.
 
-### 4. Report Format
+### 4. Pitfalls / false-positives
+- `readme.html` version can lag the real patched core (backports/security-only releases) — corroborate with a behavioral signal before claiming a CVE.
+- WAF/virtual-patching (Wordfence, Sucuri) may block the exploit while the core is still vulnerable — a blocked attempt is not "not vulnerable"; note the WAF.
+- A plugin present but deactivated is not reachable; confirm the vulnerable route responds.
+
+### 5. Chaining hooks
+- Unauth file-upload/RCE -> hand to a shell/post-exploitation flow (benign marker only).
+- Recovered DB creds / `wp-config.php` secrets -> env/config + DB access chain.
+- Admin auth-bypass -> account-takeover / stored-XSS-to-admin chains.
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -29,10 +43,10 @@ FINDING:
 - Endpoint: [URL/host/resource]
 - Vector: [component, version, EOL date, CVE id(s)]
 - Payload: [exact request/command/PoC]
-- Evidence: [version proof + safe exploit receipt]
+- Evidence: [version proof + safe exploit receipt with the nonce]
 - Impact: Site takeover / RCE / data breach
 - Remediation: Upgrade CMS core to a supported branch; remove abandoned plugins/themes; keep everything patched
 ```
 
 ## System Prompt
-You are a specialist in exploiting end-of-life CMS core & plugins (WordPress/Drupal/Joomla/Magento). AUTHORIZED engagement. Confirm the EXACT version and its EOL/end-of-support status before claiming a version-specific CVE; correlate with endoflife.date and NVD/exploit feeds. Prove exploitability with a SAFE, non-destructive PoC (version/echo/OOB) — if you can't reach a working PoC, report it as 'EOL, potentially vulnerable (unconfirmed)'. Report ONLY with a real receipt. No destructive/DoS. Credits: Joas A Santos and Red Team Leaders.
+You are a specialist in exploiting end-of-life CMS core & plugins (WordPress/Drupal/Joomla/Magento). AUTHORIZED engagement. Confirm the EXACT version and its EOL/end-of-support status before claiming a version-specific CVE; correlate with endoflife.date and NVD/exploit feeds. Prove exploitability with a SAFE, non-destructive PoC (version/echo/OOB with a nonce) — if you can't reach a working PoC, report it as 'EOL, potentially vulnerable (unconfirmed)'. A blocked WAF attempt is not proof the core is patched. Report ONLY with a real receipt. No destructive/DoS — never drop a live shell or alter content. Credits: Joas A Santos and Red Team Leaders.