Reject inherited capability input properties

Author: JoviDeCroock

.changeset/capability-review-fixes.md

@@ -9,5 +9,5 @@ Harden capability dispatch and agent trust edge cases: normalize custom HTTP
 paths, fail closed for custom endpoints when registry resolution fails, stream
 agent-directory responses within the documented size cap, expose confirmation
 fields in browser types, preserve explicit null capability inputs, reject malformed
-schemas, honor middleware replacement responses, and keep test-host agent context
-aligned with production.
+schemas and inherited-property validation bypasses, honor middleware replacement
+responses, and keep test-host agent context aligned with production.

packages/capabilities/src/schema.ts

@@ -264,8 +264,8 @@ export function validateAgainstSchema(schema: unknown, value: unknown, path = ""
     }
 
     for (const [name, propertyValue] of Object.entries(value)) {
-      const propertySchema = properties[name];
-      if (propertySchema !== undefined) {
+      if (Object.hasOwn(properties, name)) {
+        const propertySchema = properties[name];
         issues.push(...validateAgainstSchema(propertySchema, propertyValue, `${path}/${name}`));
         continue;
       }

packages/capabilities/test/schema.test.ts

@@ -79,6 +79,16 @@ describe("validateAgainstSchema", () => {
     ]);
   });
 
+  it("rejects prototype-named properties unless explicitly declared", () => {
+    const closedSchema = { type: "object", properties: {}, additionalProperties: false };
+    for (const name of ["constructor", "toString", "__proto__"]) {
+      const input = JSON.parse(`{${JSON.stringify(name)}:1}`);
+      expect(validateAgainstSchema(closedSchema, input)).toEqual([
+        { path: `/${name}`, message: "is not an allowed property" },
+      ]);
+    }
+  });
+
   it("validates array items with indexed paths", () => {
     expect(validateAgainstSchema(schema, { query: "x", tags: ["ok", 7] })).toEqual([
       { path: "/tags/1", message: "must be of type string, got number" },