Session cookie security

Skill JeremyMorgan/code-review-skills/skills/session-cookie-security

Analyzes session and cookie security, including flags, expiration, fixation, and storage. Use when auditing session management and cookie configuration.From its SKILL.md

Install

npx -y skills add JeremyMorgan/code-review-skills --skill session-cookie-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.0 KB, as published. Nobody here has run it

Target: $ARGUMENTS

If no target path is given above, review the entire codebase.

Session and Cookie Security

Analyze this project's source code. Focus on session management and cookie security.

Verify:

Session configuration
- Secure flag (HTTPS only)
- HttpOnly flag (no JS access)
- SameSite attribute
- Session timeout
- Session regeneration after login
Cookie security
- All cookies have appropriate flags
- No sensitive data in cookies
- Proper domain/path scoping
- Encryption for sensitive cookies
CSRF Protection
- Token implementation
- Double submit cookie pattern
- Origin header validation
Session storage
- Not using default in-memory storage in production
- Redis/database backed sessions
- Session cleanup/expiration

Provide:

A structured finding report with the following for each issue:

Title, Severity (Critical/High/Medium/Low), CWE (if applicable), Evidence (file, function, line ranges), and a short Why it matters.

Exploitability notes and, where safe, a minimal PoC or reproduction steps (no real secrets).

Remediation: precise code-level fix or config change (snippets welcome), plus defense-in-depth guidance.

A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.

A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.

Constraints & style:

Be concrete and cite exact code locations and identifiers.

Prefer minimal, drop-in fix snippets over prose.

Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.

Write this into a markdown file and place it in the audits/ folder.