skills.rest
Yliken
YlikenCOMMUNITY
Explore all skills by this author →
GitHub

graphql-and-hidden-parameters

Discover GraphQL schema gaps via introspection, hidden fields, and batching.

5|1|Updated Apr 20, 2026
Search Tags:#authorization#graphql#introspection#batching#api-testing#security-testing#hidden-parameters
One-click install
npx skills add https://github.com/Yliken/ai4 --skill graphql-and-hidden-parameters-yliken
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-and-hidden-parameters
Source: https://github.com/Yliken/ai4/tree/main/skills/graphql-and-hidden-parameters
Command: npx skills add https://github.com/Yliken/ai4 --skill graphql-and-hidden-parameters-yliken

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables proactive discovery and testing of GraphQL schemas to uncover introspection limitations, hidden fields, and authorization gaps that expose sensitive data or misconfigurations.

Core Features & Use Cases

  • Schema discovery through introspection and type probing to map available fields and types.
  • Hidden parameter testing to identify undocumented or admin-only fields exposed in API surfaces.
  • Authentication and authorization gap analysis, including batching and nested field risks, to guide secure integration.
  • Use Case: Validate that an API does not leak privileged fields when requested in bulk or with additional parameters.

Quick Start

Trigger the GraphQL surface discovery against your target API and surface hidden parameters for testing.

Frequently Asked Questions about graphql-and-hidden-parameters

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden parameters in a GraphQL API schema?▼

Finding hidden GraphQL parameters involves using introspection queries and type probing to map available fields, identifying undocumented or admin-only fields exposed in the API surface for testing.

What is GraphQL introspection and how does it expose schema gaps?▼

GraphQL introspection queries the __schema and __type endpoints to map available fields and types, exposing schema gaps like weak authorization or misconfigurations that leak sensitive data.

How do I test for authorization gaps and nested field risks in GraphQL?▼

Testing GraphQL authorization gaps requires analyzing authentication weaknesses and applying batching with nested field requests to validate the API does not leak privileged fields when queried in bulk.

Can I use GraphQL batching to detect sensitive data exposure?▼

Yes, you can use GraphQL batching to detect sensitive data exposure by requesting fields in bulk to validate the API does not leak privileged fields when handling additional undocumented parameters.

What are the limitations of GraphQL introspection for security testing?▼

GraphQL introspection limitations arise when endpoints restrict __schema access, requiring alternative type probing methods to discover undocumented parameters and execute deeper API security testing.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

graphql-and-hidden-parameters

Probe GraphQL schemas and detect hidden fields affecting access control.

Community
Intermediate
sayseven7sayseven7
11

api-sec

Route API security testing into documentation, authorization, token, and parameter workflows.

Community
Intermediate
naporin0624naporin0624
3

form-security-analyzer

Analyzes HTML forms for CSRF tokens, insecure actions, missing validation, hidden field exposure and misconfigurations, generating text or JSON reports.

Community
Intermediate
sayseven7sayseven7
11

graphql-and-hidden-parameters

Probe GraphQL schemas and enumerate hidden request parameters for security assessments.

Community
Intermediate