skills.rest
florianbuetow
florianbuetowCOMMUNITY
Explore all skills by this author →
Website𝕏@bytetweetsGitHub

graphql

Analyze GraphQL APIs for security vulnerabilities and report risks.

12|1|Updated Feb 9, 2026
Search Tags:#authorization#security#vulnerability#api#audit#graphql#introspection
One-click install
npx skills add https://github.com/florianbuetow/claude-code --skill graphql-florianbuetow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/graphql
Command: npx skills add https://github.com/florianbuetow/claude-code --skill graphql-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in GraphQL APIs, protecting against data breaches, denial-of-service attacks, and unauthorized access.

Core Features & Use Cases

  • Introspection Security: Detects and helps disable unnecessary introspection in production.
  • Resource Exhaustion Prevention: Identifies missing query depth and complexity limits.
  • Access Control Auditing: Analyzes for missing per-field authorization on sensitive data.
  • Use Case: Audit a newly deployed GraphQL API to ensure it adheres to security best practices before going live, preventing common attack vectors.

Quick Start

Analyze the GraphQL endpoint at http://example.com/graphql for security vulnerabilities.

Frequently Asked Questions about graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a GraphQL API for security vulnerabilities?▼

To audit a GraphQL API for security vulnerabilities, you can analyze the endpoint to detect risks like enabled introspection, missing query depth limits, and absent per-field authorization based on CWEs and OWASP guidelines.

What security risks does leaving introspection enabled in production GraphQL cause?▼

Leaving introspection enabled in production GraphQL exposes your schema to attackers, allowing them to map out queries and mutations. Analyzing your API helps detect this vulnerability and disable unnecessary introspection to prevent data breaches.

How do I prevent denial-of-service attacks caused by GraphQL query depth and complexity?▼

Preventing denial-of-service attacks from query depth and complexity requires configuring resource exhaustion limits. Analyzing your GraphQL API identifies missing query depth and complexity analysis controls to block malicious nested queries.

Can I detect missing per-field authorization on sensitive data in my GraphQL API?▼

You can detect missing per-field authorization on sensitive data by running an access control audit. This analysis identifies exposed sensitive fields lacking proper authorization checks, preventing unauthorized access to your GraphQL data.

Does this GraphQL security analysis cover batching and alias abuse?▼

Yes, this GraphQL security analysis covers batching and alias abuse. It scans your API to identify these specific attack vectors, helping you mitigate resource exhaustion and prevent malicious data extraction attempts.

Related Skills

Explore More Software Engineering Skills→
jason-c-devjason-c-dev
1

aws-observability-setup

Configures CloudWatch, CloudTrail, AWS Config, and Security Hub across accounts and regions.

Community
Intermediate
boparaiamritboparaiamrit
5

security-audit

Identify and remediate security vulnerabilities in codebases through structured audits.

Community
Advanced
thomast1906thomast1906
193

apim-policy-authoring

Generate Azure API Management XML policies for OAuth, rate limiting, and CORS.

Community
Advanced
YukiIto1999YukiIto1999

api-security

Automate API security assessment across GraphQL, REST, WebSocket, and Web-LLM interfaces.

Community
Intermediate