What problem does it solve? Manually auditing every Set-Cookie header for missing HttpOnly, Secure, or SameSite flags is tedious and error-prone, especially when session cookies are only issued after login. This Skill automates the inventory and classification of cookies so missing flags surface as triaged security leads instead of being overlooked. ## Core Features & Use Cases - Cookie Classification: Distinguishes session vs persistent cookies, detects sensitive names (session, auth, token, JWT patterns), and validates __Host-/__Secure- prefix rules. - Flag Issue Detection: Flags missing HttpOnly/Secure on sensitive cookies, SameSite=None without Secure, and broad Domain attributes, each with severity ratings. - Structured Outputs: Writes REPORT.md and cookies.json under notes/{target}/recon-data/cookie-flags/ for handoff to cartographer and CSRF/XSS hypothesis workflows. - Use Case: During the recon security-controls phase of a bug-bounty engagement, run the script against the target's login response to inventory session cookies and identify which missing flags warrant XSS or CSRF impact hypotheses. ## Quick Start Run the cookie_flags.py script against an in-scope URL with an output directory, for example: python3 web-skills/cookie-flags-analysis/scripts/cookie_flags.py https://app.example.com --output-dir notes/app/recon-data/cookie-flags.
