Prototype Pollution Advanced

Once you've confirmed prototype pollution exists, this is what you load to turn it into code execution. Covers the full escalation path: server-side RCE through template engine gadgets (EJS, Pug, Handlebars) and child_process pollution, client-side script gadgets in jQuery and Lodash, and practical bypass techniques when __proto__ is filtered. The gadget reference table alone is worth it. Includes black-box detection methods that work without source access and covers the constructor.prototype alternative when filters block the obvious path. This assumes you already understand merge sinks and basic pollution mechanics from the companion prototype-pollution skill.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill prototype-pollution-advanced --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Prototype Pollution Advanced — RCE & Gadget Exploitation

AI LOAD INSTRUCTION: Advanced prototype pollution escalation. Covers server-side RCE via template engines (EJS, Pug, Handlebars), Node.js child_process gadgets, client-side script gadgets, filter bypass patterns, and systematic detection. Load ../prototype-pollution/SKILL.md first for fundamentals (merge sinks, __proto__ vs constructor.prototype, basic probes).

0. RELATED ROUTING

prototype-pollution — LOAD FIRST for PP fundamentals, merge-sink detection, basic probes
ssti-server-side-template-injection — template engine RCE context (PP often triggers through template gadgets)
xss-cross-site-scripting — client-side PP gadgets ultimately achieve XSS

Advanced Reference

Load KNOWN_GADGETS.md for the comprehensive gadget table by framework/library with polluted properties, trigger conditions, impact, and affected versions.