Skills
Navigate
skills/oyi77/1ai-skills/exploiting-prototype-pollution-in-javascript/Gen Agent Trust Hub

exploiting-prototype-pollution-in-javascript

Warn

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous curl commands designed to interact with web APIs and attempt property injection via the __proto__ and constructor.prototype vectors.
  • [REMOTE_CODE_EXECUTION]: The skill includes specific payloads targeting Node.js template engines such as EJS, Handlebars, and Pug, as well as the child_process module, to achieve Remote Code Execution on a target server.
  • [REMOTE_CODE_EXECUTION]: Example payloads demonstrate the use of sensitive system paths including /proc/self/environ and /proc/self/cmdline via NODE_OPTIONS to trigger arbitrary code execution.
  • [COMMAND_EXECUTION]: The skill provides instructions for performing Cross-Site Scripting (XSS) attacks by injecting malicious HTML and JavaScript into prototype properties such as innerHTML, html, and transport_url which reach dangerous sinks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 19, 2026, 11:50 PM
Security Audit — agent-trust-hub — exploiting-prototype-pollution-in-javascript