What problem does it solve? GraphQL endpoints frequently disable standard introspection (__schema, __type), returning uniform generic errors that block schema enumeration during security assessments. This Skill recovers fields, mutations, and types anyway by exploiting the differential between validation-stage and execution-stage errors. ## Core Features & Use Cases - Error-Oracle Enumeration: Use wrong-typed variables, the @skip(if: true) directive, and empty input objects to confirm field names, argument types, and input object shapes one response at a time. - Safe Mutation Probing: Validate that mutations exist without invoking their resolvers, so no state-changing side effects occur during reconnaissance. - Design-Intent Triage: Cross-reference recovered operations against client bundle call sites to separate deliberate pre-auth checks, correctly gated operations, and dead legacy surface worth reporting. - Use Case: During an authorized assessment, introspection on a production GraphQL endpoint returns a generic error for every query. Use these oracle techniques with a wordlist seeded from the recovered client bundle to map the real attack surface before testing authorization on individual fields. ## Quick Start Ask the agent to enumerate the GraphQL endpoint's schema using error-oracle techniques since standard introspection is blocked.
