graphql

Analyze GraphQL APIs for security vulnerabilities and report risks.

12|1|Updated Feb 9, 2026

Search Tags:#authorization #security #vulnerability #api #audit #graphql #introspection

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill graphql-florianbuetow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: graphql
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/graphql
Command: npx skills add https://github.com/florianbuetow/claude-code --skill graphql-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in GraphQL APIs, protecting against data breaches, denial-of-service attacks, and unauthorized access.

Core Features & Use Cases

Introspection Security: Detects and helps disable unnecessary introspection in production.
Resource Exhaustion Prevention: Identifies missing query depth and complexity limits.
Access Control Auditing: Analyzes for missing per-field authorization on sensitive data.
Use Case: Audit a newly deployed GraphQL API to ensure it adheres to security best practices before going live, preventing common attack vectors.

Quick Start

Analyze the GraphQL endpoint at http://example.com/graphql for security vulnerabilities.

Frequently Asked Questions about graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a GraphQL API for security vulnerabilities?▼

To audit a GraphQL API for security vulnerabilities, you can analyze the endpoint to detect risks like enabled introspection, missing query depth limits, and absent per-field authorization based on CWEs and OWASP guidelines.

What security risks does leaving introspection enabled in production GraphQL cause?▼

Leaving introspection enabled in production GraphQL exposes your schema to attackers, allowing them to map out queries and mutations. Analyzing your API helps detect this vulnerability and disable unnecessary introspection to prevent data breaches.

How do I prevent denial-of-service attacks caused by GraphQL query depth and complexity?▼

Preventing denial-of-service attacks from query depth and complexity requires configuring resource exhaustion limits. Analyzing your GraphQL API identifies missing query depth and complexity analysis controls to block malicious nested queries.

Can I detect missing per-field authorization on sensitive data in my GraphQL API?▼

You can detect missing per-field authorization on sensitive data by running an access control audit. This analysis identifies exposed sensitive fields lacking proper authorization checks, preventing unauthorized access to your GraphQL data.

Does this GraphQL security analysis cover batching and alias abuse?▼

Yes, this GraphQL security analysis covers batching and alias abuse. It scans your API to identify these specific attack vectors, helping you mitigate resource exhaustion and prevent malicious data extraction attempts.