SKILL: Prototype Pollution — Expert Attack Playbook AI LOAD INSTRUCTION : Expert prototype pollution for client and server JS. Covers vs , merge-sink detection, Express/qs-style black-box probes, and gadget chains (EJS, Timelion-class patterns, child process/NODE OPTIONS). Assumes you know object spread and prototype inheritance — focus is on parser behavior and post-pollution sinks . Routing note: prioritize PP when you see deep merges, recursive assign, followed by , or URL queries converted to nested objects. 0. QUICK START Client-side first probes When input can reflect into DOM or framew…