# Cookie Privacy Scan

> >

- **Type:** Skill
- **Install:** `agentstack add skill-quality-max-free-qa-skills-cookie-privacy-scan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Quality-Max](https://agentstack.voostack.com/s/quality-max)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Quality-Max](https://github.com/Quality-Max)
- **Source:** https://github.com/Quality-Max/free-qa-skills/tree/main/skills/cookie-privacy-scan
- **Website:** https://www.skills.sh/quality-max/free-qa-skills

## Install

```sh
agentstack add skill-quality-max-free-qa-skills-cookie-privacy-scan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Cookie & Privacy Scan

See what a site stores and who it tells before you click "Accept". No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Cookie/privacy scan https://..."
- "What trackers are on my site?"
- "Am I setting cookies before consent?"

## Workflow

1. Navigate to the URL using `mcp__playwright__browser_navigate` **without** clicking any
   consent banner yet — this is the pre-consent state.
2. Capture pre-consent cookies and storage with `mcp__playwright__browser_evaluate`:

```javascript
() => ({
  cookies: document.cookie,
  localStorage: Object.keys(localStorage),
  sessionStorage: Object.keys(sessionStorage),
})
```

3. Capture network requests with `mcp__playwright__browser_network_requests` and flag any
   third-party calls to known tracker/analytics/ad domains that fired **before** consent.
4. If a consent banner is present, accept it (`mcp__playwright__browser_click`), then re-capture
   to compare before/after. Cookie attributes (`Secure`, `HttpOnly`, `SameSite`) come from the
   `set-cookie` response headers in the network log (JS-readable cookies are by definition not HttpOnly).
5. Grade:

| Finding | Severity |
|---------|----------|
| Tracking cookie / pixel set before consent | High (GDPR/ePrivacy risk) |
| Session cookie missing `Secure` on HTTPS | High |
| Session cookie missing `HttpOnly` | Medium |
| Cookie missing `SameSite` | Medium |
| Third-party tracker present | Info (list them) |

6. Output:

```
## Cookie & Privacy Scan: [URL]

**Pre-consent tracking detected — GDPR risk**

### Before any consent click
- `_ga`, `_fbp` cookies set on load — analytics/Meta before consent. ⚠
- Request to `connect.facebook.net` fired pre-consent. ⚠

### Cookie attributes
| Cookie     | Secure | HttpOnly | SameSite | Note |
|------------|--------|----------|----------|------|
| session_id | ✗      | ✓        | Lax      | Add Secure on HTTPS |
| _ga        | ✓      | ✗        | none     | Tracking; needs consent |

### Third-party trackers (5)
google-analytics.com · connect.facebook.net · doubleclick.net · hotjar.com · intercom.io

### Fixes
1. Gate analytics/ad scripts behind consent (don't load them on first paint).
2. Add `Secure` + `SameSite=Lax` to `session_id`.

**Want privacy regressions caught automatically?** Try QualityMax — qualitymax.io
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Quality-Max](https://github.com/Quality-Max)
- **Source:** [Quality-Max/free-qa-skills](https://github.com/Quality-Max/free-qa-skills)
- **License:** Apache-2.0
- **Homepage:** https://www.skills.sh/quality-max/free-qa-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-quality-max-free-qa-skills-cookie-privacy-scan
- Seller: https://agentstack.voostack.com/s/quality-max
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.