skills/mukul975/anthropic-cybersecurity-skills/exploiting-prototype-pollution-in-javascript/Gen Agent Trust Hub
exploiting-prototype-pollution-in-javascript
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
SKILL.mdfile provides numerouscurlcommand examples for performing HTTP POST and GET requests with prototype pollution payloads against remote endpoints. - [REMOTE_CODE_EXECUTION]: Documentation in
SKILL.mdandreferences/api-reference.mdincludes exploit payloads that leverage template engine gadgets (e.g., EJS, Pug) to execute system-level commands usingchild_process.execSync. - [EXTERNAL_DOWNLOADS]: The
scripts/agent.pyutility utilizes therequestslibrary to conduct network-based vulnerability scanning against user-defined target URLs. - [DATA_EXFILTRATION]: The automated scanner script is designed to accept an authentication token from the user and transmit it to the specified target URL as part of the exploit verification process.
Audit Metadata