skills.rest
SnailSploit
SnailSploitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

graphql-security

Test GraphQL APIs for introspection abuse, injection, and authorization bypasses.

2.9k|469|Updated Mar 4, 2026
Search Tags:#authorization#security#vulnerability assessment#penetration testing#graphql#introspection#api security
One-click install
npx skills add https://github.com/SnailSploit/Claude-Red --skill graphql-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-security
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-graphql
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill graphql-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the security vulnerabilities inherent in GraphQL APIs, providing a comprehensive checklist to identify and mitigate risks like introspection abuse, injection flaws, and authorization bypasses.

Core Features & Use Cases

  • Vulnerability Identification: Detects common GraphQL weaknesses including IDOR, injection, and DoS vectors.
  • Schema Analysis: Guides users through analyzing GraphQL schemas for sensitive information and access control gaps.
  • Use Case: When testing a web application that exposes a GraphQL endpoint, use this Skill to systematically uncover potential security flaws before they can be exploited.

Quick Start

Use the graphql-security skill to test the GraphQL endpoint at http://example.com/graphql for vulnerabilities.

Frequently Asked Questions about graphql-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test GraphQL endpoints for security vulnerabilities during a penetration test?▼

To test GraphQL endpoints for security vulnerabilities, systematically perform schema analysis, query fuzzing, and authorization testing to identify introspection abuse, injection flaws, and authorization bypasses.

What is GraphQL introspection abuse and how does it expose API security risks?▼

GraphQL introspection abuse is the exploitation of schema query features to extract sensitive information and access control gaps. It exposes API security risks by revealing the entire data structure to unauthorized users.

How can I find authorization bypasses and IDOR vulnerabilities in a GraphQL API?▼

To find authorization bypasses and IDOR vulnerabilities in a GraphQL API, conduct systematic authorization testing against the schema to detect access control gaps and improper object-level permission validation.

What are the common denial-of-service attack vectors targeting GraphQL APIs?▼

Common denial-of-service attack vectors targeting GraphQL APIs include deeply nested queries and resource-intensive query fuzzing. These vectors exploit schema execution to overwhelm server resources and crash the endpoint.

Can I use this methodology for bug bounty engagements targeting web applications?▼

Yes, you can use this methodology for bug bounty engagements targeting web applications. It provides a comprehensive checklist to systematically uncover and exploit GraphQL security flaws during testing.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

graphql-and-hidden-parameters

Identify GraphQL API vulnerabilities including hidden parameters and authorization gaps.

Community
Advanced
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
MathiasPaulenkoMathiasPaulenko

WaveXis Network Testing

Capture and manipulate HTTP/HTTPS traffic for performance auditing and API testing.

Community
Advanced
YukiIto1999YukiIto1999

api-security

Automate API security assessment across GraphQL, REST, WebSocket, and Web-LLM interfaces.

Community
Intermediate