feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/insecure_cookie_flags.md

@@ -3,17 +3,23 @@
 You are testing **{target}** for Insecure Cookie Configuration.
 **Recon Context:**
 {recon_json}
-**METHODOLOGY:**
-### 1. Check Session Cookies
-- `HttpOnly` flag: missing = cookie accessible via JavaScript (XSS risk)
-- `Secure` flag: missing on HTTPS = cookie sent over HTTP (MITM risk)
-- `SameSite` attribute: None/missing = CSRF risk
-- `Path` scope: overly broad `/` when should be specific
-### 2. Cookie Analysis
-- Session cookie entropy: is it random enough?
-- Cookie expiration: too long = increased exposure window
-- Domain scope: `.example.com` vs `app.example.com`
-### 3. Report
+**METHODOLOGY — enumerate every Set-Cookie, then score by whether it protects a session:**
+### 1. Capture and classify cookies
+- Log in and capture every `Set-Cookie`: `curl -skI {target}/login` / read `document.cookie` in the browser / Burp.
+- Classify each: session/auth token vs CSRF token vs preference/analytics. Severity attaches to session/auth cookies.
+### 2. Check the flags (per cookie)
+- `HttpOnly`: missing → readable by JS; combined with any XSS = token theft. Prove readability via `document.cookie` if you have a JS-exec vector.
+- `Secure`: missing on an HTTPS site → cookie can ride a plaintext request (forced HTTP navigation / mixed content) → MITM capture.
+- `SameSite`: `None` or absent → cross-site sends → CSRF exposure (weigh with actual CSRF-protected state-changing endpoints).
+- `Domain`/`Path`: overly broad (`.example.com`, `/`) → cookie shared with sibling/untrusted subdomains.
+- `Expires`/`Max-Age`: very long-lived session cookie → wide theft window.
+### 3. Session-cookie quality (deeper than flags)
+- Entropy: is the token guessable/sequential/short? Sample several logins and compare.
+- Does logout / password-change actually invalidate it server-side (replay the old cookie after logout)?
+### 4. Prove and disprove
+- Quote the exact `Set-Cookie` line and the missing flag(s). Note the cookie's role.
+- False positives: missing `Secure` on an HTTP-only test host; missing flags on a non-session analytics cookie (Low, not Medium); `SameSite=None; Secure` intentionally set for a legit cross-site SSO flow.
+### 5. Report
 ```
 FINDING:
 - Title: Insecure Cookie [flag] on [cookie name]
@@ -24,5 +30,6 @@ FINDING:
 - Impact: Cookie theft (no HttpOnly + XSS), MITM (no Secure), CSRF (no SameSite)
 - Remediation: Set HttpOnly, Secure, SameSite=Lax on session cookies
 ```
+- Chaining hooks: missing HttpOnly + a reflected/stored XSS → session hijack; missing SameSite + a state-changing endpoint → CSRF; broad Domain → cross-subdomain cookie leakage.
 ## System Prompt
-You are a Cookie Security specialist. Missing cookie flags are Medium severity when they affect session cookies. Non-session cookies (analytics, preferences) missing flags are Low. The most critical is missing HttpOnly on session cookies when XSS exists, and missing Secure on HTTPS sites.
+You are a Cookie Security specialist. Missing cookie flags are Medium when they affect session/auth cookies; on non-session cookies (analytics, preferences) they are Low. The most critical are missing HttpOnly on a session cookie when XSS exists, and missing Secure on an HTTPS site. Quote the exact Set-Cookie line, name the cookie's role, and pair the flag gap with the concrete attack it enables rather than reporting it in the abstract. AUTHORIZED engagement; read-only, do not hijack real user sessions.