From find-cve-agent
Detects prototype pollution in JavaScript/TypeScript code by auditing object merge, clone, assign operations and untrusted input handling. Guides impact assessment for CVSS scoring.
npx claudepluginhub byamb4/find-cve-agentThis skill uses the workspace's default tool permissions.
Audit merge/clone/deep-assign utilities, query string parsers, JSON parsers, config mergers, and any package that recursively sets object properties from untrusted input.
Detects and fixes prototype pollution (CWE-1321) in JavaScript/TypeScript code using deep merges, lodash merge/set, Object.assign with dynamic keys, or recursive copies on user input.
Detects and exploits prototype pollution in JavaScript/Node.js apps via URL/JSON payloads for XSS, RCE, and auth bypass. For security testing web APIs and client-side code.
Detects and exploits JavaScript prototype pollution in client-side and server-side apps for XSS, RCE, and auth bypass via property injection. Useful for pentesting Node.js APIs, JSON merges, and JS frameworks.
Share bugs, ideas, or general feedback.
Audit merge/clone/deep-assign utilities, query string parsers, JSON parsers, config mergers, and any package that recursively sets object properties from untrusted input.
Key insight: Only ~50% acceptance rate. Must demonstrate REAL impact beyond just polluting prototype.
grep -rn "Object\.assign\|Object\.defineProperty\|Object\.create" .
grep -rn "merge\|extend\|deepMerge\|deepExtend\|deepAssign\|mixin" .
grep -rn "clone\|deepClone\|cloneDeep\|deepCopy" .
grep -rn "set\|setPath\|setValue\|lodash\.set\|_.set" .
grep -rn "\[.*\]\s*=" . --include="*.js" # Bracket notation assignment
Look for patterns where object keys from user input are used as property paths:
// VULNERABLE: recursive merge without key filtering
function merge(target, source) {
for (const key in source) {
if (typeof source[key] === 'object') {
target[key] = merge(target[key] || {}, source[key]);
} else {
target[key] = source[key];
}
}
}
grep -rn "__proto__\|constructor\|prototype" . | grep -i "filter\|block\|skip\|ignore\|reject"
grep -rn "Object\.create(null)" . # Null prototype objects are safe
grep -rn "hasOwnProperty\|Object\.keys\|Object\.entries" .
Prototype pollution alone is often not enough. Look for impact:
| Key | Effect | Impact |
|---|---|---|
__proto__ | Sets properties on Object.prototype | All objects affected |
constructor.prototype | Same effect via constructor chain | All objects affected |
constructor | Overwrites constructor reference | Type confusion |
toString | Overwrites string conversion | TypeError on string operations |
valueOf | Overwrites value conversion | TypeError on comparisons |
hasOwnProperty | Overwrites property check | Logic bypass |