From 4c77045c473d3e8d28702a1d52e8bb3c63b8787b Mon Sep 17 00:00:00 2001
From: Brandon Webb <brandon.webb@vista.com>
Date: Tue, 14 Apr 2026 20:55:28 -0400
Subject: [PATCH] fix(agents): use null-prototype accumulator to prevent
 __proto__ pollution

Addresses cubic-dev-ai P1 review: Object.hasOwn() alone doesn't prevent
a crafted '__proto__' agent name from mutating the result object's
prototype chain. Using Object.create(null) eliminates inherited properties
entirely, making both the hasOwn checks and property assignments safe.
---
 .../claude-code-agent-loader/opencode-config-agents-reader.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts b/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts
index 7a73d6b26..5b3f41a75 100644
--- a/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts
+++ b/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts
@@ -79,7 +79,7 @@ function convertInlineAgent(agentData: unknown): ClaudeCodeAgentConfig | null {
 }
 
 export function readOpencodeConfigAgents(directory: string): Record<string, ClaudeCodeAgentConfig> {
-  const result: Record<string, ClaudeCodeAgentConfig> = {}
+  const result: Record<string, ClaudeCodeAgentConfig> = Object.create(null)
 
   for (const configPath of getConfigPaths(directory)) {
     try {