skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

graphql-and-hidden-parameters

Probe GraphQL schemas and enumerate hidden request parameters for security assessments.

11|4|Updated Jun 7, 2026
Search Tags:#graphql#introspection#batching#schema discovery#authorization testing#hidden parameters
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill graphql-and-hidden-parameters-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-and-hidden-parameters
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/graphql-and-hidden-parameters
Command: npx skills add https://github.com/sayseven7/frameseven --skill graphql-and-hidden-parameters-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps uncover undocumented GraphQL fields, hidden request parameters, and schema behaviors that can expand an application's attack surface or expose authorization gaps.

Core Features & Use Cases

  • GraphQL discovery: Probe introspection, type definitions, field suggestions, and error messages to map schemas quickly.
  • Hidden parameter testing: Compare public UI requests with richer API payloads, admin docs, mobile traffic, and bundled client code to find undocumented inputs.
  • Abuse path analysis: Test batching, nested object access, and weak authorization boundaries for IDOR-style and privilege-related weaknesses.
  • Use Case: A tester finds GraphQL introspection is restricted, then uses error-based discovery, bundle review, and type probes to identify sensitive fields and follow-up authorization issues.

Quick Start

Use this skill to review a GraphQL or API target for introspection, hidden fields, batching behavior, and authorization gaps.

Frequently Asked Questions about graphql-and-hidden-parameters

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden GraphQL fields and undocumented parameters during API testing?▼

Hidden parameters are found by comparing public UI requests with richer API payloads, analyzing bundled client code, and probing schema error messages to reveal undocumented inputs and sensitive fields.

What is GraphQL introspection and how does it expose attack surface?▼

GraphQL introspection reveals schema type definitions and fields, allowing testers to map attack surface quickly by probing type definitions, field suggestions, and error messages to uncover undocumented capabilities.

Can I test GraphQL batching and nested object access for authorization gaps?▼

Yes, you can test GraphQL batching and nested object access to identify weak authorization boundaries, uncovering IDOR-style and privilege-related weaknesses by analyzing how batched queries bypass authorization checks.

How do I discover GraphQL schemas when introspection is disabled?▼

When GraphQL introspection is disabled, discover schemas using error-based discovery, client bundle review, and type probes to identify sensitive fields and undocumented schema behaviors from error messages and client code.

Does this approach work for REST endpoints with optional or deprecated fields?▼

Yes, hidden parameter testing applies to REST endpoints with optional or deprecated fields by comparing public UI requests with admin docs and mobile traffic to find undocumented inputs across GraphQL and REST APIs.

What are the limitations of error-based GraphQL schema discovery?▼

Error-based GraphQL schema discovery is limited when servers suppress verbose error messages and field suggestions, making it significantly harder to uncover hidden fields and type definitions without client bundle source code.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl
2

graphql-and-hidden-parameters

Probes GraphQL schemas to identify hidden parameters and authorization gaps.

Community
Intermediate
ArianHobson333ArianHobson333
7

chain-idor-to-priv-esc

Identify IDOR vulnerabilities that enable privilege escalation in web applications.

Community
Advanced
langbyyilangbyyi
96

graphql-and-hidden-parameters

Identify GraphQL API vulnerabilities including hidden parameters and authorization gaps.

Community
Advanced
DorianGalloDorianGallo
5

graphql-and-hidden-parameters

Probe GraphQL schemas for undocumented fields and authorization gaps.

Community
Intermediate