graphql-and-hidden-parameters

Probe GraphQL schemas and enumerate hidden request parameters for security assessments.

11|4|Updated Jun 7, 2026

Search Tags:#graphql #introspection #batching #schema discovery #authorization testing #hidden parameters

Ready to run

npx skills add https://github.com/sayseven7/frameseven --skill graphql-and-hidden-parameters-sayseven7

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: graphql-and-hidden-parameters
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/graphql-and-hidden-parameters
Command: npx skills add https://github.com/sayseven7/frameseven --skill graphql-and-hidden-parameters-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps uncover undocumented GraphQL fields, hidden request parameters, and schema behaviors that can expand an application's attack surface or expose authorization gaps.

Core Features & Use Cases

GraphQL discovery: Probe introspection, type definitions, field suggestions, and error messages to map schemas quickly.
Hidden parameter testing: Compare public UI requests with richer API payloads, admin docs, mobile traffic, and bundled client code to find undocumented inputs.
Abuse path analysis: Test batching, nested object access, and weak authorization boundaries for IDOR-style and privilege-related weaknesses.
Use Case: A tester finds GraphQL introspection is restricted, then uses error-based discovery, bundle review, and type probes to identify sensitive fields and follow-up authorization issues.

Quick Start

Use this skill to review a GraphQL or API target for introspection, hidden fields, batching behavior, and authorization gaps.

Frequently Asked Questions about graphql-and-hidden-parameters

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find hidden GraphQL fields and undocumented parameters during API testing?▼

Hidden parameters are found by comparing public UI requests with richer API payloads, analyzing bundled client code, and probing schema error messages to reveal undocumented inputs and sensitive fields.

What is GraphQL introspection and how does it expose attack surface?▼

GraphQL introspection reveals schema type definitions and fields, allowing testers to map attack surface quickly by probing type definitions, field suggestions, and error messages to uncover undocumented capabilities.

Can I test GraphQL batching and nested object access for authorization gaps?▼

Yes, you can test GraphQL batching and nested object access to identify weak authorization boundaries, uncovering IDOR-style and privilege-related weaknesses by analyzing how batched queries bypass authorization checks.

How do I discover GraphQL schemas when introspection is disabled?▼

When GraphQL introspection is disabled, discover schemas using error-based discovery, client bundle review, and type probes to identify sensitive fields and undocumented schema behaviors from error messages and client code.

Does this approach work for REST endpoints with optional or deprecated fields?▼

Yes, hidden parameter testing applies to REST endpoints with optional or deprecated fields by comparing public UI requests with admin docs and mobile traffic to find undocumented inputs across GraphQL and REST APIs.

What are the limitations of error-based GraphQL schema discovery?▼

Error-based GraphQL schema discovery is limited when servers suppress verbose error messages and field suggestions, making it significantly harder to uncover hidden fields and type definitions without client bundle source code.