skills/mukul975/anthropic-cybersecurity-skills/exploiting-prototype-pollution-in-javascript/Gen Agent Trust Hub
exploiting-prototype-pollution-in-javascript
Warn
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides functional payloads to achieve Remote Code Execution (RCE) by targeting template engines (EJS, Pug, Handlebars) and Node.js internal modules like
child_process. - [DATA_EXFILTRATION]: The
scripts/agent.pytool performs active network requests (GET and POST) to user-supplied URLs. This capability allows the agent to interact with external systems and could be used to probe internal infrastructure or exfiltrate data if used maliciously. - [COMMAND_EXECUTION]: The documentation includes specific shell commands (curl) and Node.js code snippets designed to manipulate server-side environments and bypass authentication or authorization checks.
Audit Metadata