prototype-pollution
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation includes theoretical payload examples for achieving Remote Code Execution (RCE) via prototype pollution gadgets. These examples target specific sinks like the EJS template engine's
escapeFunctionand Node.jschild_processoptions. These are provided for instructional purposes in the context of authorized security research. - [COMMAND_EXECUTION]: The skill details how to manipulate shared object prototypes to influence subsequent command execution calls in Node.js (e.g., polluting
shell,argv0, orNODE_OPTIONS). This is presented as a post-exploitation gadget for security testing. - [EXTERNAL_DOWNLOADS]: The playbook references multiple external security research tools and repositories hosted on GitHub, such as
yeswehack/pp-finder,yuske/silent-spring, andportswigger/server-side-prototype-pollution. These references are used to point the user toward established community resources for vulnerability detection.
Audit Metadata