Extract hooks

[infiton]

... a description that explains what, why, and how ...

PR Checklist

• Important or complicated code is tested
• Any user facing changes are documented in the Gadget-side changelog
• Any immediate changes are slated for release in Gadget via a generated package dependency bump
• Versions within this monorepo are matching and there's a valid upgrade path

To fix this prototype pollution risk, we need to prevent dangerous property names (e.g., __proto__, constructor, prototype) from being set as object keys on plain objects. The standard approaches are:

• Sanitizing input keys: Check keys before assigning them, and reject or skip dangerous ones.
• Using a prototype-less object: Replace {} with Object.create(null), which has no prototype, so polluting assignments are safe.
• Using a Map: However, if consumers expect variables to be a plain object, the safest is to use a prototype-less object.

In this code, the critical region is the construction of newVariables (lines 279–291), especially the assignment of subkeys at line 289. Rather than {}, we should use Object.create(null) for newVariables[action.modelApiIdentifier], and ideally also for newVariables itself (though its keys come from trusted sources except possibly key == 'id').

Implementation steps:

• On line 280, replace {} with Object.create(null).
• Where keys are written (line 289), optionally add a check skipping dangerous keys, but using prototype-less objects is already sufficient.
• This change is wholly within the shown code region.
• No external imports are needed.

---