cookie-and-storage-audit
cookie-and-storage-audit
"Cookie banner exists" and "cookie behavior is correct" are different claims. This skill produces the inventory and the timeline that every consent, analytics, and disclosure judgment depends on.
Activate when
- Any cookie, storage key, tracker, embed, or third-party script is present in source, or the user asks what the site stores/loads.
- Before adding, changing, or removing a consent control (
consent-management), or writing a cookie/privacy disclosure (privacy-policy,policy-consistency). - Not to decide whether consent is required (that needs a rule looked up at an official source; see
jurisdiction-applicability).
Inspect
1. Source inventory (SOURCE-INDICATED). Search for tag managers, analytics/ads/replay snippets, vendor SDK imports, document.cookie, localStorage/sessionStorage/indexedDB writes, Set-Cookie in server code and middleware, auth libraries (session cookies), i18n/theme persistence, consent libraries. Also look for fingerprinting-like behavior: canvas/WebGL/AudioContext readouts, font or plugin enumeration, navigator.getBattery, screen/hardware probes bundled into an ID, FingerprintJS/ClientJS-style libraries, and device IDs persisted across sessions. Storage-free identification is still identification; disclose and review it as such (analytics-privacy). List each item with file and apparent purpose.
2. Runtime timeline (OBSERVED). Run the runtime helper in a fresh browser context (no prior storage). Paths relative to this skill's folder:
node scripts/observe-runtime.mjs --url <site> --settle 2000