Prototype Pollution

This gives Claude the full offensive playbook for finding and exploiting prototype pollution in JavaScript applications. It covers both `__proto__` and `constructor.prototype` injection paths, quick probes for client and server contexts, and concrete black-box detection signals like polluting Express `parameterLimit` or `json spaces` settings. The gadget table walks through real RCE chains in EJS and child_process scenarios. Load this when you're merging untrusted input into objects, auditing query parsers or deep assign logic, or hunting for post-pollution sinks that turn property injection into command execution. The decision tree and tool list make it practical for both initial recon and chaining to full exploits.

Install to Claude Code

npx -y skills add yaklang/hack-skills --skill prototype-pollution --agent claude-code