graphql-and-hidden-parameters

Analyze GraphQL schema introspection to identify hidden parameters and security vulnerabilities.

Updated Jun 11, 2026

Search Tags:#graphql #vulnerability detection #schema analysis #api security #security auditing

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill graphql-and-hidden-parameters-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: graphql-and-hidden-parameters
Source: https://github.com/utsavthakur/agenticskills/tree/main/graphql-and-hidden-parameters
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill graphql-and-hidden-parameters-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Identifies security gaps and hidden features in GraphQL APIs, ensuring secure and comprehensive schema inspection.

Core Features & Use Cases

Introspection and Schema Discovery: Leverages GraphQL introspection to uncover hidden fields and parameters.
Batching and Undocumented Fields: Tests for batching capabilities and identifies undocumented fields or parameters.
Authorization Gaps: Discovers authorization vulnerabilities in nested object fields.
Use Case: When developing or auditing a GraphQL API, use this skill to ensure that all potential security risks are identified and mitigated.

Quick Start

Utilize the 'graphql-and-hidden-parameters' skill to perform an initial GraphQL schema analysis on your API.

Frequently Asked Questions about graphql-and-hidden-parameters

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for hidden parameters in a GraphQL API?▼

Testing for hidden parameters involves leveraging GraphQL introspection to analyze the schema and uncover undocumented fields. This skill identifies hidden features and security gaps to ensure comprehensive schema inspection.

What are common GraphQL vulnerabilities related to schema introspection?▼

Common GraphQL vulnerabilities include exposed hidden fields, undocumented parameters, and authorization gaps within nested object fields. Schema introspection analysis uncovers these security risks during an API security assessment.

How do I find authorization gaps in nested GraphQL fields?▼

Finding authorization gaps in nested GraphQL fields requires schema analysis to trace object relationships and access controls. This skill discovers authorization vulnerabilities by exploring nested fields and hidden parameters during security auditing.

Can I test GraphQL batching capabilities for security vulnerabilities?▼

Yes, you can test GraphQL batching capabilities for security vulnerabilities. This skill specifically tests batching functionality to identify potential security risks and undocumented fields during API security assessments.

What do I need to know to perform a GraphQL schema security audit?▼

Performing a GraphQL schema security audit requires knowledge of GraphQL schema structure and common API vulnerabilities. This skill requires this prerequisite understanding to effectively identify security risks and hidden parameters.

Does this skill identify undocumented fields during GraphQL API security assessments?▼

Yes, this skill identifies undocumented fields during GraphQL API security assessments. It leverages schema introspection to uncover hidden fields and parameters, ensuring secure and comprehensive schema inspection.