What problem does it solve? Security testers often struggle to confirm whether JavaScript prototype pollution signals (such as proto, constructor, or deep-merge inputs) represent real server-side vulnerabilities or harmless client-side quirks, leading to false positives and unverifiable findings. ## Core Features & Use Cases - Evidence-Gated Validation: Uses a baseline, single-variable probe, post-baseline, oracle, and evidence workflow to prove that newly created objects actually inherit an injected marker. - Client vs Server Distinction: Separates client-side state merge issues from server-side security impact, rejecting object reflection, devtools edits, and one-off anomalies as evidence. - Safe Boundaries: Prohibits RCE gadget hunting, shared configuration changes, and pollution of admin or other users' objects, routing confirmed impact to follow-up reviews. - Use Case: During an authorized Node.js API assessment, you suspect the qs query parser or a JSON deep-merge accepts proto keys; this Skill guides a minimal harmless-marker test that proves or disproves pollution without touching production state. ## Quick Start Ask the agent to run the prototype pollution specialist against an authorized Node.js endpoint to verify whether nested proto fields in JSON or query input pollute newly created objects.
