# Prototype Pollution

> Detects JavaScript prototype pollution vulnerabilities where attacker-controlled keys can modify Object.prototype.

- Skill: `zakirkun/prototype-pollution` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/prototype-pollution`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/prototype-pollution/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/prototype-pollution

---


# Prototype Pollution

## Overview
Prototype pollution occurs when JavaScript code recursively merges or assigns properties from user-controlled objects without filtering dangerous keys like `__proto__`, `constructor`, or `prototype`. Modifying `Object.prototype` affects all JavaScript objects in the application, enabling:
- Authentication bypass (`isAdmin` injected into base object)
- Denial of Service
- Remote Code Execution (in some Node.js contexts)

## Detection Strategy
- Recursive merge/assign functions without `__proto__` key filtering
- Direct `obj[key] = value` where `key` comes from user input
- Libraries known to be vulnerable (lodash < 4.17.13, merge < 2.1.1)

## Remediation
- Validate and reject `__proto__`, `constructor`, `prototype` as keys
- Use `Object.create(null)` for pure hash maps
- Use `JSON.parse()` with schema validation before merging
- Update vulnerable dependencies

**Vulnerable:**
```js
function merge(target, src) {
    for (const key of Object.keys(src)) {
        target[key] = src[key]; // key could be __proto__
    }
}
```

**Safe:**
```js
const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
function merge(target, src) {
    for (const key of Object.keys(src)) {
        if (!FORBIDDEN_KEYS.has(key)) target[key] = src[key];
    }
}
```