typescript-eslint-object-injection-fix

Rewrite TypeScript dynamic key assignments to prevent ESLint detect-object-injection warnings.

Updated Nov 18, 2025
One-click install
npx skills add https://github.com/cajias/claude-skills --skill typescript-eslint-object-injection-fix
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: typescript-eslint-object-injection-fix
Source: https://github.com/cajias/claude-skills/tree/main/skills/typescript-eslint-object-injection-fix
Command: npx skills add https://github.com/cajias/claude-skills --skill typescript-eslint-object-injection-fix

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you fix ESLint security/detect-object-injection warnings when building objects from user input or other external data in TypeScript. It addresses the common tension between safe coding practices and lint rules that flag dynamic key assignment as a potential prototype pollution risk.

Core Features & Use Cases

  • Safe Dynamic Object Construction: Replace bracket-notation assignments with null-prototype objects and explicit property definition.
  • Prototype Pollution Prevention: Avoid exposing __proto__, constructor, and other inherited-object attack paths.
  • Common Use Cases: Aggregating HTTP headers, processing query parameters, transforming form data, and building lookup tables from untrusted keys.

Quick Start

Use this skill to rewrite my TypeScript code so it safely builds a dynamic object from external keys without triggering security/detect-object-injection warnings.

Frequently Asked Questions about typescript-eslint-object-injection-fix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix ESLint detect-object-injection warnings in TypeScript?

To fix ESLint detect-object-injection warnings in TypeScript, replace bracket-notation dynamic key assignments with null-prototype objects and explicit property definition to prevent prototype pollution while preserving object functionality.

What is prototype pollution in TypeScript dynamic object construction?

Prototype pollution in TypeScript dynamic object construction occurs when untrusted external keys like `__proto__` or `constructor` exploit inherited object paths, which requires null-prototype objects to safely prevent while aggregating HTTP headers or query parameters.

How do I safely build TypeScript objects from HTTP headers and query parameters?

Safely build TypeScript objects from HTTP headers and query parameters by using null-prototype objects and Object.defineProperty-style creation, preventing inherited attack paths while mapping untrusted external input into structured data.

Does ESLint security detect-object-injection flag all dynamic key assignments in TypeScript?

ESLint security detect-object-injection flags dynamic key assignments from untrusted input as a prototype pollution risk, requiring null-prototype objects and explicit property definition to resolve the warning without losing dynamic object building capabilities.

When should I use null-prototype objects for TypeScript form data processing?

Use null-prototype objects for TypeScript form data processing when aggregating untrusted external keys into dynamic objects, ensuring explicit property creation prevents inherited prototype pollution vulnerabilities flagged by ESLint security rules.

Why does TypeScript bracket notation trigger ESLint security warnings?

TypeScript bracket notation triggers ESLint security warnings because dynamic key assignment from external values risks prototype pollution, requiring Object.defineProperty-style creation on null-prototype objects to safely preserve dynamic lookup functionality.