prototype-pollution-exploit
Fail
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: CRITICAL
Full Analysis
- [SAFE]: The skill is primarily an educational resource documenting security research and vulnerability testing methodologies for JavaScript Prototype Pollution.
- [PROMPT_INJECTION]: No prompt injection patterns detected. The content consists of technical documentation and code examples rather than behavioral overrides for the AI agent.
- [REMOTE_CODE_EXECUTION]: While the skill contains code snippets that demonstrate Remote Code Execution (RCE) via Prototype Pollution (e.g., in
server-side-rce.md), these are presented as static, non-functional examples for educational analysis of vulnerabilities in third-party libraries like EJS and Pug. The skill does not attempt to execute these commands on the host system. - [EXTERNAL_DOWNLOADS]: The skill references several external resources and tools for security scanning (e.g.,
ppmap,PPScan). These are well-known security research tools and documentation (e.g., PortSwigger, HackTricks). Per the trust policy, documentation of well-known security resources for educational purposes is considered safe. - [OBFUSCATION]: No obfuscation or hidden content was detected. All code examples and URLs are in plain text and consistent with the educational intent.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata