Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app.
Cookie Attributes Review is a tested SKILL.md that reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402.
Not for
Consent banners, cookie law, token issuing and revocation, cookie size limits and browser-specific caps. It reads pasted headers or cookie code and judges only the attributes written there; it cannot see framework defaults or a proxy that rewrites headers.
Tested, honestly
Tested 2026-10-26 with a strong and a weak model.
- SonnetStrong model, claude-sonnet-5-5
- Right on all 3 cases, read by hand. On the shop headers it found the ninety-day login cookie and the __Host- cookie that carries a Domain, and left out the year-long theme cookie that has no flags at all. On the Flask handler it gave the readable token and the parent domain, and left out the SameSite=None that already comes with Secure and the language cookie. On the clean set of three cookies it answered exactly No findings.
- HaikuWeak model, claude-haiku-5-5
- Right on all 3 cases, read by hand. It matched the strong model on both planted inputs, with sound fixes, and kept the preference cookies and the Secure-protected SameSite=None out. On the clean set it answered exactly No findings. Its two answers on the planted inputs differ in layout only: one has a blank line between the findings and one is indented by four spaces, and the check accepts both.
Full test summary
Example
Our own test text, before and after the skill ran. Excerpts only.
English · claude-sonnet-5-5
Before
Response headers of https://shop.example.com/login:
Set-Cookie: sid=7f3a9c41; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=7776000
Set-Cookie: __Host-view=compact; Path=/; Domain=shop.example.com; Secure; SameSite=Lax
Set-Cookie: ui_theme=dark; Path=/; Max-Age=31536000
After
LONG-SESSION — sid, Max-Age=7776000 — ninety days is above the limit of 604800 — shorten it
PREFIX-BROKEN — __Host-view, Domain=shop.example.com — a __Host- cookie must not carry a Domain attribute, so browsers will reject it — remove the Domain attribute
What is in the file
- What the MDN Set-Cookie page says, as published on 26 October 2026
- What counts as a session cookie
- The answer
- The codes
- Rules
- Work in this order
- Short example
Languages
English. Tried in: English.
License
Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.
Versions
Current version 1.0.0, updated 2026-10-26. Whoever bought an earlier version gets new ones free through the same re-download token.
v1.0.0 · 2026-10-26
First release, written in the second light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from the public MDN page (see notes/ideas.md). Output: see the skill description.
Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.
FAQ
Theme or language cookie readable by script: reported?
No. Only a login cookie needs the HttpOnly flag. A preference cookie, even a year-long one without Secure, gets no line, and neither does a cookie that sets no SameSite attribute at all.
Where does the seven-day limit come from?
From the skill itself. The MDN page names no figure for a login lifetime, so the 604800 seconds is stated as our own limit, and an Expires date counts only when the paste gives today's date.
What went into the test?
Three inputs: a set of response headers with a ninety-day login cookie and a broken host prefix, a Flask login handler with a readable token and a parent domain, and a clean set of three cookies. Each input went to Claude Sonnet once and to Claude Haiku once.
What comes back for a clean set of cookies?
A single sentence, No findings., and nothing around it. A defect is one line holding the code, the cookie, the reason and the fix, so the answer can be read in seconds or checked by a script.