Agent skill · security · yaklang
prototype-pollution
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.
Why this skill is useful
Adds detailed testing scripts and techniques for detecting prototype pollution vulnerabilities in JavaScript applications, which are not commonly found in standard resources.
What it needs
About 4k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Prototype Pollution — Expert Attack Playbook AI LOAD INSTRUCTION: Expert prototype pollution for client and server JS. Covers proto vs constructor.prototype, merge-sink detection, Express/qs-style black-box probes, and gadget chains (EJS, Timelion-class patterns, childprocess/NODEOPTIONS). Assumes you know object spread and prototype inheritance — focus is on parser behavior and post-pollution sinks. Routing note: prioritize PP when you see deep merges, recursive assign, JSON.parse followed by Object.assign, or URL queries converted to nested objects. 0. QUICK START Client-side first probes When input can reflect into DOM or framework routing, pair with alert(1) / console checks to observe whether global object properties were polluted. Server-side first probes（JSON / form） After sending, check whether unrelated follow-up responses show abnormal headers/status/JSON spacing, or whether app logic reads Object.prototype.polluted (see §3 detection table). Quick boolean If target code uses lodash.merge, deep-extend, hoek.applyToDefaults, or some qs/query-string configurations, raise priority. --- 1. MECHANISM Prototype chain: when accessing obj.key, if obj lacks own property key, lookup walks up [[Prototype]] until Object.prototype. proto: many parsers treat literal key proto as a magic path that attaches child properties to the prototype. Merging { "proto": { "x": 1 } } can be equivalent to Object.prototype.x = 1 depending on implementation and patch level. constructor.prototype: constructor typically points to the object's constructor function; constructor.prototype is that constructor's prototype object. For plain objects this usually links to Object.prototype. Example path: This is not always equivalent to proto (filtering, JSON parsing, Bun/Node differences), so test both paths. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/prototype-pollution