Authenticated Session Acquisition

On financial and multi-tenant targets the login is gated by SMS OTP / TOTP MFA that an autonomous run cannot satisfy, so the post-auth surface (BOLA/IDOR/mass-assignment/injection on the real data APIs, session handling, API pivots) silently collapses to pre-auth findings only. This skill's job is narrow and concrete: get one legitimate authenticated session and hand it to the executors as a reusable artifact. It does not attack the auth mechanism — see authentication for that.

The artifact contract (how the session reaches executors)

Emit both, into the engagement's OUTPUT_DIR, referenced BY NAME (never inline secrets — credential-loading.md):

• OUTPUT_DIR/<asset>/session/storageState.json — the Playwright storage state (cookies + localStorage) for browser-driven post-auth testing.
• OUTPUT_DIR/<asset>/session/bearer.txt — the raw access/ID token (+ its expires_at) for direct API replay.

Executors consume these exactly like any env-loaded secret: the scope file's creds_env names the realm, and the session path is passed as a file reference, so no token is ever written into a prompt, experiments.md, or attack-chain.md. Re-run this skill when the token expires (record expires_at; refresh rather than re-login where a refresh token exists).

Modes (pick by what the client can provide)