hellodqy/mastermind-bug-bounty/prototype-pollution
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Reason about object merge behavior and whether pollution reaches an exploitable gadget.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/prototype-pollutionSKILL.md
Prototype Pollution
Goal
判断用户可控对象是否能污染原型，并进一步到达鉴权绕过、配置篡改、XSS 或 RCE gadget。
Tools / Inputs
- JSON body、query parser、merge/clone/update functions、client state
- 资源索引：
references/INDEX.md；确认 pollution source 后读prototype-pollution-gadgets.md；通用背景再读bug_classes.md
Constraints
- 污染存在不等于漏洞，必须找到 gadget 或安全影响。
- 用无害属性验证，不破坏运行状态。
- 区分服务端、客户端、构建时污染。
- 成功后追问能控制哪些配置、模板、权限或路径。
- 不能证明 gadget 时标记 PENDING。
Chain Questions
- 污染能否持久化到后续请求或其他用户？
- 哪些代码读取了被污染属性？
- 是否能影响 sanitizer、模板、权限、命令或路径？
- 是否能和 XSS/SSRF/RCE 串联？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/prototype_pollution/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/prototype-pollution)