Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ShulkwiSEC/bb-huge --skill cookie-attacksgit clone --depth 1 https://github.com/ShulkwiSEC/bb-hugeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shulkwisec/bb-huge/cookie-attacks)<a href="https://agentmods.dev/skills/shulkwisec/bb-huge/cookie-attacks"><img src="https://agentmods.dev/badge/skills/shulkwisec/bb-huge/cookie-attacks/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shulkwisec/bb-huge/cookie-attacks"><img src="https://agentmods.dev/badge/skills/shulkwisec/bb-huge/cookie-attacks.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00109 | $0.02342 |
| Opus 5 | $0.00055 | $0.01171 |
| Sonnet 5 | $0.00022 | $0.00468 |
| Haiku 4.5 | $0.00011 | $0.00234 |
Grade A, and why
cookie-attacks scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
r = requests.post("https://TARGET/login", Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sI -X POST "https://TARGET/login" \ How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cookie Security and Logout Testing
What Is Broken and Why
Session cookies are the primary authentication artifact in web applications. Missing security
attributes expose them to theft via network interception (Secure absent), JavaScript injection
attacks (HttpOnly absent), cross-site request forgery (SameSite absent), and cross-subdomain
theft (Domain too broad). Cookies that persist beyond the session or survive logout allow
session restoration attacks. In SSO environments, application-level logout without central-portal
logout leaves the authenticated state intact across all federated applications. Predictable tokens
reduce the brute-force cost of session forgery to practical levels.
Key Signals
Set-Cookieresponse missingSecureflag on any session cookieSet-Cookieresponse missingHttpOnlyflag on session cookiesSet-CookiewithSameSite=Nonebut application is not a cross-site embedded resourceSameSiteattribute absent (defaults toLaxin modern browsers, butNonein older ones)Domain=.TARGET(leading dot) set too broadly — accessible to all subdomainsPath=/for cookies that should scope to/bankor/admin- Session cookie has
Expiresfar in the future or is persistent (survives browser close) - Cookie names lack
__Host-or__Secure-prefixes - Authenticated page responses missing
Cache-Control: no-store - After logout, old session cookie still returns 200 on authenticated endpoints (no server-side invalidation)
- Back button after logout displays cached authenticated page content
- In SSO: application logout does not invalidate central SSO session token
Methodology
- Attribute audit: Intercept all
Set-Cookieheaders across the application; check every session and auth cookie forSecure,HttpOnly,SameSite,Domain,Path,Expires. - Cookie prefix check: Verify whether session cookies use
__Host-(strongest binding) or__Secure-prefixes. - Scope verification: Test if cookies with broad
Domainattributes are accessible from sibling subdomains (security boundary check). - Persistence test: Close browser entirely; reopen and navigate to authenticated pages; check if session persists (persistent cookie vulnerability).
- Logout server-side invalidation: After logout, copy the session cookie; replay it against authenticated endpoints in Burp Repeater; observe if 200 or redirect to login.
- Back-button cache: Log out; press browser Back button; observe if authenticated page content is visible from cache.
- Session timeout: Make an authenticated request; wait incrementally; determine inactivity timeout threshold.
- SSO logout: Log out of application; attempt access via SSO portal without re-entering credentials; then log out of SSO portal; attempt application access.
- Token entropy: Feed session tokens to Burp Sequencer; collect 200+ samples; analyze for effective entropy bits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 188 lines · 109 tokens per session scan A bb9d64b68ca7
cookie-attacks is a skill published in the GitHub repository ShulkwiSEC/bb-huge (22 stars, last pushed 2mo ago), licensed MIT. It adds 109 tokens to every session and 2,342 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints…
skill-context-detection
Auto-detect work context (Dev vs Knowledge) — use to tailor workflows based on current task type.
skill-copilot-provider
GitHub Copilot CLI as optional zero-cost provider via copilot -p programmatic mode.
supabase
Supabase / PostgREST Row-Level-Security playbook — pull the anon (or leaked servicerole) key out of the frontend JS, map tables from the auto-generated OpenAPI spec, test anonymous RLS READ disclosures (PII/secret leaks), and anonymous RLS WRITE abuse (insert/update/delete — e.g. forging…
skill-security-framing
URL validation and content sanitization for untrusted sources — use when handling external input safely.
race
Race condition / TOCTOU playbook — limit overrun (one-time codes used twice, gift cards spent twice), single-packet attack (last-byte sync) to force parallel processing, and state-confusion races (file upload + read, order before payment). Use when timing-sensitive logic could be abused — one-time codes, coupons/gift…