feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/ml_model_inversion.md

@@ -8,16 +8,35 @@ You are testing **{target}** for Model inversion and attribute inference (OWASP
 
 **METHODOLOGY:**
 
-### 1. Profile outputs
-- Identify confidence scores/embeddings/structured outputs that leak training signal
+### 1. Profile the output surface
+- Identify what the endpoint returns that leaks training signal:
+  - raw confidence scores / class probabilities / `logits` / softmax vectors,
+  - embeddings or feature vectors (`/embed`, `/vectorize`),
+  - structured outputs (top-k, per-class scores), or verbatim memorised text from an LLM.
+- Note the input schema, whether queries are rate-limited, and whether the same input gives deterministic scores (needed for a stable oracle).
+- Tools: a small Python harness (`requests` + `numpy`/`scipy`) driving the API and logging (input, score) pairs; save it under `$NEUROSPLOIT_POCS`.
 
-### 2. Infer
-- Issue crafted queries to infer membership or sensitive attributes
+### 2. Choose the attack (decision points)
+- **Membership inference**: confidence is systematically higher on training members → threshold/shadow-model attack. Build a labelled set of known-in vs known-out samples if any ground truth exists.
+- **Attribute inference**: a hidden sensitive attribute correlates with the returned score → query variants that hold everything constant except the guessed attribute.
+- **Model inversion proper**: gradient-free reconstruction of a representative input for a class from confidence feedback (e.g. hill-climbing on the score).
+- **LLM memorisation**: prompt for likely-memorised PII/secret sequences and check for verbatim reproduction (this is the LLM06 case).
 
-### 3. Confirm
-- Demonstrate reliable inference beyond random chance with statistical evidence
+### 3. Establish a baseline and measure
+- Define the random-chance / prior baseline explicitly (e.g. base rate of the attribute, 50% for a binary membership guess).
+- Run enough queries to compute a metric with a confidence interval: attack accuracy, AUC, or precision@k vs baseline. A single lucky guess is NOT proof.
+- Keep queries benign and within rate limits; never attempt to extract real third-party PII in bulk — infer on synthetic/consenting probes and report the CAPABILITY.
 
-### 4. Report Format
+### 4. Confirm
+- Proof = a metric measurably and reproducibly above baseline (report N queries, the statistic, and the CI), or a verbatim memorised secret matched to a known value (masked).
+- Re-run to show stability, not a fluke.
+
+### 5. Chaining hooks
+- Recovered sensitive attributes / membership → privacy-impact and PII-exposure reporting.
+- Verbatim memorised secrets/keys → credential-reuse chain.
+- A leaky embedding/score endpoint → feeds prompt-injection / data-extraction agents.
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -33,4 +52,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are a model-inversion researcher. Report only with statistically supported evidence that sensitive attributes/membership are recoverable. Single anecdotes or chance-level results are not findings.
+You are a model-inversion researcher. Report only with statistically supported evidence that sensitive attributes/membership are recoverable — state the baseline, the number of queries, and a metric with its confidence interval, and show it is reproducible. Single anecdotes or chance-level results are not findings. Keep all probing benign and rate-limited; demonstrate the capability without bulk-extracting real third-party PII.