auditing-graphql-nullability

Audit GraphQL schemas for over-permissive nullability and recommend SDL fixes.

2|Updated May 23, 2026

Search Tags:#graphql #federation #sdl #api hardening #nullability #schema audit

Ready to run

npx skills add https://github.com/rocklambros/rcs --skill auditing-graphql-nullability

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auditing-graphql-nullability
Source: https://github.com/rocklambros/rcs/tree/main/skills/security/auditing-graphql-nullability
Command: npx skills add https://github.com/rocklambros/rcs --skill auditing-graphql-nullability

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill audits GraphQL schemas for over-permissive nullability so teams can prevent silent error swallowing, weak client contracts, and avoidable defensive coding.

Core Features & Use Cases

Reviews object types, root Query and Mutation fields, list nullability tiers, and input arguments for missing non-null constraints.
Distinguishes genuinely optional domain fields from nullable identifiers, required business fields, and collection shapes that should be tightened.
Handles federated subgraphs by recognizing externally resolved nullable fields and flagging only the risky cases that need schema hardening.
Produces per-field findings with severity, downstream consequence, and concrete SDL replacements that add the right ! markers.

Quick Start

Ask the skill to audit your GraphQL schema for over-permissive nullability and return specific SDL fixes with field-by-field consequences.

Frequently Asked Questions about auditing-graphql-nullability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit my GraphQL schema for over-permissive nullability?▼

To audit GraphQL schema nullability, you review object types, root fields, lists, and inputs for missing non-null constraints. This process identifies risky nullable fields and generates precise SDL fixes with severity ratings and downstream consequence explanations.

Why does GraphQL nullability cause silent error swallowing in client applications?▼

GraphQL nullability causes silent error swallowing when over-permissive nullable fields hide structural failures instead of surfacing them. Auditing schema nullability tightens client contracts by adding non-null markers to required fields, preventing avoidable defensive coding and weak API guarantees.

Does this nullability audit work with federated subgraphs and externally resolved fields?▼

Yes, nullability audits work with federated subgraphs by recognizing externally resolved nullable fields. The audit distinguishes between valid federation patterns and genuinely risky cases, flagging only the schema hardening opportunities that require precise SDL non-null constraint additions.

How do I fix nullable list types and required scalar fields in my GraphQL SDL?▼

To fix nullable list types and required scalar fields in GraphQL SDL, you add non-null markers to tighten collection shapes and enforce required constraints. The audit provides a direct before-and-after SDL diff with field-path findings and concrete replacement SDL.

Can I review GraphQL input arguments and mutations for missing non-null constraints?▼

Yes, you can review GraphQL input arguments and mutations for missing non-null constraints. The nullability audit evaluates these schema elements alongside queries and object types, producing per-field findings with severity ratings and specific SDL replacements to harden the API contract.