Back to Details

cookie-and-storage-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

cookie-and-storage-audit

cookie-and-storage-audit

"Cookie banner exists" and "cookie behavior is correct" are different claims. This skill produces the inventory and the timeline that every consent, analytics, and disclosure judgment depends on.
“Cookie 横幅存在”和“Cookie 行为正确”是两种不同的说法。本 skill 会生成每项同意机制、分析和披露判断都所依赖的清单和时间线。

Activate when

何时启用

  • Any cookie, storage key, tracker, embed, or third-party script is present in source, or the user asks what the site stores/loads.
  • Before adding, changing, or removing a consent control (
    consent-management
    ), or writing a cookie/privacy disclosure (
    privacy-policy
    , 
    policy-consistency
    ).
  • Not to decide whether consent is required (that needs a rule looked up at an official source; see 
    jurisdiction-applicability
    ).
  • 只要源码中出现任何 cookie、storage key、tracker、embed 或 third-party script，或用户询问网站存储或加载了什么，就应使用。
  • 在添加、更改或移除 consent control（
    consent-management
    ），或编写 cookie/privacy disclosure（
    privacy-policy
    、
    policy-consistency
    ）之前。
  • 不用于判定是否需要 consent（这需要从官方来源查询适用规则；参见 
    jurisdiction-applicability
    ）。

Inspect

检查

1. Source inventory (SOURCE-INDICATED). Search for tag managers, analytics/ads/replay snippets, vendor SDK imports, 
document.cookie
, 
localStorage
/
sessionStorage
/
indexedDB
writes, 
Set-Cookie
in server code and middleware, auth libraries (session cookies), i18n/theme persistence, consent libraries. Also look for fingerprinting-like behavior: canvas/WebGL/AudioContext readouts, font or plugin enumeration, 
navigator.getBattery
, screen/hardware probes bundled into an ID, FingerprintJS/ClientJS-style libraries, and device IDs persisted across sessions. Storage-free identification is still identification; disclose and review it as such (
analytics-privacy
). List each item with file and apparent purpose.
2. Runtime timeline (OBSERVED). Run the runtime helper in a fresh browser context (no prior storage). Paths relative to this skill's folder:
bash
node scripts/observe-runtime.mjs --url <site> --settle 2000
The first snapshot, 
initial
, is the state before any interaction. It lists cookies (name, domain, first/third-party, lifetime, flags), web-storage keys, and every request group by vendor class (analytics, advertising, session replay, tag manager, fonts, maps, video embeds, captcha, payments...), plus any consent-like UI it detected and the button labels to use next.
Build a timeline with a steps file. Use the labels the helper printed:
json
[
  {"do":"click","text":"Reject"},
  {"do":"snapshot","label":"after-reject","expect":"no-new-nonessential"},
  {"do":"reload"},
  {"do":"snapshot","label":"after-reject-reload","expect":"no-new-nonessential"}
]
Repeat in a fresh run for accept (
"expect":"some-tracking"
), and for withdraw (accept, then use the site's preferences/withdraw control, snapshot, reload, snapshot). Each run starts from a clean context, so one choice does not contaminate another.
Add 
--block-third-party
to observe what the page attempts without sending real traffic to vendors. Omit it (on a staging origin) when follow-on behavior matters, such as a tag manager that loads more tags.
3. Classify each item into: strictly necessary for a service the visitor asked for (e.g. auth session, cart, CSRF, the consent record itself); functional preference; measurement/analytics; advertising/tracking; third-party embed; unknown. Unknown is not essential. Do not classify from the name alone; use source, vendor docs, and behavior. Do not treat "essential" as legal classification; it is your working label.
4. Compare with disclosure. Read the cookie notice/privacy page. List what it names against what you observed; flag both directions (undisclosed item; disclosed item that never appears).
1. 源码清单（SOURCE-INDICATED）。搜索 tag manager、analytics/ads/replay 代码片段、供应商 SDK 导入、
document.cookie
、
localStorage
/
sessionStorage
/
indexedDB
写入、服务端代码和 middleware 中的 
Set-Cookie
、auth library（session cookie）、i18n/theme 持久化、consent library。还要查找类似 fingerprinting 的行为：canvas/WebGL/AudioContext 读取、font 或 plugin 枚举、
navigator.getBattery
、捆绑进 ID 的 screen/hardware 探测、FingerprintJS/ClientJS 类 library，以及跨 session 持久化的 device ID。即使不使用 storage 的识别也仍然属于识别；应按此方式披露并审查（
analytics-privacy
）。列出每一项、所在文件及初步用途。
2. 运行时时间线（OBSERVED）。在全新的 browser context（无先前 storage）中运行 runtime helper。路径相对于此 skill 的目录：
bash
node scripts/observe-runtime.mjs --url <site> --settle 2000
第一个快照 
initial
是任何交互之前的状态。它会列出 cookies（名称、域名、第一方/第三方、生命周期、flags）、Web Storage keys，并按 vendor class 对每个 request 分组（analytics、advertising、session replay、tag manager、fonts、maps、video embeds、captcha、payments……），还会列出检测到的任何类似 consent 的 UI，以及接下来应使用的按钮标签。
使用 steps 文件构建时间线。请使用 helper 打印的 labels：
json
[
  {"do":"click","text":"Reject"},
  {"do":"snapshot","label":"after-reject","expect":"no-new-nonessential"},
  {"do":"reload"},
  {"do":"snapshot","label":"after-reject-reload","expect":"no-new-nonessential"}
]
在全新运行中分别重复 accept（
"expect":"some-tracking"
）和 withdraw（先 accept，然后使用网站的 preferences/withdraw control，依次 snapshot、reload、snapshot）。每次运行都从干净 context 开始，因此一种选择不会污染另一种。
添加 
--block-third-party
，可观察页面在未向供应商发送真实流量时尝试执行什么。当后续行为很重要时（例如会加载更多 tags 的 tag manager），请在 staging origin 上省略此参数。
3. 分类。将每一项分类为：访客所请求服务严格必要的内容（例如 auth session、cart、CSRF、consent 记录本身）；功能偏好；衡量/分析；广告/追踪；第三方嵌入；未知。**未知不等于必要。**不要仅凭名称分类；应结合源码、供应商文档和行为进行判断。“必要”不是法律分类；它只是你的工作标签。
4. 与披露内容对比。读取 cookie notice/privacy page。将其列出的内容与观察结果进行对比；标记两个方向的问题（未披露的项目；已披露但从未出现的项目）。

Evidence that counts

有效证据

Label each claim OBSERVED, SOURCE-INDICATED, DECLARED, INFERRED, UNKNOWN, or REVIEW REQUIRED. UNKNOWN is never a pass and never a failure.
  • Vendor in source but no request observed: SOURCE-INDICATED. Say "integration present; runtime loading not observed on the pages exercised."
  • Request observed at load: OBSERVED, and it is a fact about timing. Whether consent was required is a separate question needing a rule looked up at an official source: REVIEW REQUIRED.
  • Absence is only proven for what you exercised: which pages, which viewport, which states, how long you waited. State the coverage.
  • Tag managers hide downstream tags. If GTM/Segment is present, the inventory is incomplete until runtime shows what it fires, and that may depend on the container's configuration you cannot see.
  • Legal specifics: never from memory. When a rule, deadline, threshold, or required wording matters, read the current text or guidance at an official source while you run (start from references/official-sources.md), cite the source and access date, and treat applicability to this business as REVIEW REQUIRED. If you cannot look it up, the answer is UNKNOWN.
为每项 claim 标注 OBSERVED、SOURCE-INDICATED、DECLARED、INFERRED、UNKNOWN 或 REVIEW REQUIRED。UNKNOWN 既不算通过，也不算失败。
  • 源码中存在供应商，但未观察到 request：SOURCE-INDICATED。应说明：“集成已存在；在本次测试页面的运行时加载中未观察到。”
  • 在页面加载时观察到 request：OBSERVED，并且这是关于时序的事实。是否需要 consent 是另一个问题，需要从官方来源查询适用规则：REVIEW REQUIRED。
  • 只能证明已测试范围内的不存在情况：应说明测试了哪些页面、viewport、状态以及等待了多长时间，并明确说明覆盖范围。
  • Tag manager 会隐藏下游 tags。如果存在 GTM/Segment，在运行时显示其实际触发内容之前，清单都不完整；这还可能取决于无法查看的 container 配置。
  • **法律细节：绝不能凭记忆作答。**当规则、截止日期、阈值或必需措辞很重要时，应在执行过程中查阅官方来源上的现行文本或指南（从 references/official-sources.md 开始），引用来源及访问日期，并将该规则对当前业务的适用性视为 REVIEW REQUIRED。如果无法查阅，答案应为 UNKNOWN。

May change

可更改内容

Nothing by default. This is an audit. Findings feed 
consent-management
(implementation) and 
privacy-policy
/
policy-consistency
(disclosure). If asked to fix a disclosure, correct it only to state observed facts.
默认不做任何更改。这是一项审计。检查结果将提供给 
consent-management
（实施）以及 
privacy-policy
/
policy-consistency
（披露）。如果要求修正披露内容，仅按观察到的事实进行更正。

Must not claim

不得声称

"No cookies", "cookie-free", "GDPR/ePrivacy compliant", "consent not required", or "all cookies are essential" from a single pass. Do not assert purposes you have not verified. Do not call a cookie banner unnecessary unless the timeline shows no non-essential storage or trackers on the exercised paths and you state the limits.
不要根据单次检查声称“没有 cookies”、“无 Cookie”、“符合 GDPR/ePrivacy”、“无需 consent”或“所有 cookies 都是必要的”。不要断言尚未核实的用途。除非时间线显示在所测试路径上没有非必要 storage 或 trackers 并且明确说明限制，否则不要称 Cookie 横幅没有必要。

Verify

验证

The audit is verified when the timeline is reproducible: same steps, same result, on a second run. If results differ between runs (A/B tests, geo-based banners, lazy vendors), say so. Record the inventory in the reply (or 
.readyvibe/storage-inventory.md
): item, type, first/third party, when it appears, purpose (with evidence), disclosed? (yes/no/unknown).
当时间线可复现时，即相同步骤在第二次运行中得到相同结果，审计即视为已验证。如果不同运行的结果存在差异（A/B tests、基于地理位置显示的横幅、延迟加载的供应商），应明确说明。将清单记录在回复中或 
.readyvibe/storage-inventory.md
中：项目、类型、第一方/第三方、何时出现、用途（附证据）、是否已披露？（是/否/未知）。

Escalate

升级处理

  • Non-essential tracking observed before interaction: OBSERVED fact, applicability REVIEW REQUIRED; hand to 
    consent-management
    and 
    jurisdiction-applicability
    .
  • Personal data in cookies/URLs/storage (email, IDs): flag to 
    analytics-privacy
    / 
    privacy-readiness
    .
  • Cookies you cannot identify: UNKNOWN, ask the owner or find vendor documentation; do not guess.
  • 在交互前观察到非必要 tracking：这是 OBSERVED 事实，适用性为 REVIEW REQUIRED；转交 
    consent-management
    和 
    jurisdiction-applicability
    。
  • cookies/URLs/storage 中包含 personal data（email、ID）：标记给 
    analytics-privacy
    / 
    privacy-readiness
    。
  • 无法识别的 cookies：标记为 UNKNOWN，询问所有者或查找供应商文档；不要猜测。

No change is valid when

何时无需更改即有效

The timeline shows no cookies, storage, or third-party requests beyond first-party essentials on the exercised paths, and the disclosure does not claim otherwise. Report "no non-essential storage or trackers observed on X, Y, Z; recheck if analytics, ads, embeds, or accounts are added", and do not add a banner.
当时间线显示在所测试路径中，除第一方必要项外没有 cookies、storage 或第三方 request，且披露内容没有相反声明时，应报告：“在 X、Y、Z 上未观察到非必要 storage 或 trackers；如果添加了 analytics、ads、embeds 或 accounts，请重新检查”，并且不要添加横幅。