skills.rest
devtint
devtintCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

graphql-security

Test GraphQL API endpoints for introspection leaks and query complexity vulnerabilities.

Updated Feb 23, 2026
Search Tags:#vulnerability assessment#penetration testing#graphql#introspection#api security#denial of service
One-click install
npx skills add https://github.com/devtint/API_PENTEST --skill graphql-security-devtint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-security
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/graphql-security
Command: npx skills add https://github.com/devtint/API_PENTEST --skill graphql-security-devtint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the unique security challenges posed by GraphQL APIs, protecting against data leaks, denial-of-service attacks, and injection vulnerabilities.

Core Features & Use Cases

  • Introspection Testing: Detects and analyzes GraphQL schema exposure.
  • DoS Prevention: Tests for query complexity, nesting, and batching abuse.
  • Injection & Auth Bypass: Identifies SQL/NoSQL injection, authorization flaws, and information disclosure.
  • Use Case: An organization has exposed a GraphQL endpoint. This Skill can be used to proactively identify if the schema is overly permissive, if denial-of-service attacks are possible, or if sensitive data can be accessed through unauthorized queries.

Quick Start

Use the graphql-security skill to test the GraphQL endpoint at https://api.example.com/graphql for introspection leaks and query complexity vulnerabilities.

Frequently Asked Questions about graphql-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a GraphQL API for security vulnerabilities?▼

GraphQL introspection leaks occur when the schema is overly permissive, exposing the entire API structure. You can detect and analyze this schema exposure by sending specific introspection queries to the `/graphql` endpoint to map available data.

How does query complexity lead to denial of service in GraphQL?▼

Query complexity leads to denial of service in GraphQL when deeply nested or batched queries consume excessive server resources. You can test for this batching abuse and nesting depth to evaluate your API's resilience against resource exhaustion attacks.

Can GraphQL endpoints be tested for SQL and NoSQL injection?▼

GraphQL endpoints can be tested for SQL and NoSQL injection by sending malicious payloads through query inputs. This identifies authorization flaws, bypasses, and sensitive information disclosure within the API implementation.

Does this GraphQL security testing work without authentication credentials?▼

Yes, GraphQL security testing works without prior authentication by probing the `/graphql` endpoint for information disclosure and authorization flaws. It identifies if sensitive data can be accessed through unauthorized queries when explicitly tasked with testing.

Related Skills

Explore More Software Engineering Skills→
AstorYHAstorYH
15

graphql-introspection

Query a GraphQL endpoint to discover its schema and available operations.

Community
Basic
cosmixcosmix
53

security-audit

Identify vulnerabilities, misconfigurations, and security best-practice violations across code, configurations, and infrastructure.

Community
Advanced
MathiasPaulenkoMathiasPaulenko

WaveXis Network Testing

Capture and manipulate HTTP/HTTPS traffic for performance auditing and API testing.

Community
Advanced
cxnaivecxnaive

web-pentest

Perform authorized web application penetration testing with reconnaissance, vulnerability analysis, and proof-based exploitation.

Community
Advanced