skills.rest
narlyseorg
narlyseorgCOMMUNITY
Explore all skills by this author →
GitHub

graphql-security

Identify GraphQL endpoints and assess security through introspection and authorization checks.

6|1|Updated Mar 1, 2026
Search Tags:#authorization#vulnerability#graphql#introspection#pentest#security-testing#dos
One-click install
npx skills add https://github.com/narlyseorg/superhackers --skill graphql-security-narlyseorg
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-security
Source: https://github.com/narlyseorg/superhackers/tree/main/skills/graphql-security
Command: npx skills add https://github.com/narlyseorg/superhackers --skill graphql-security-narlyseorg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

GraphQL APIs expose rich schemas and nested resolvers, which can hide authorization gaps, misconfigurations, and DoS risks.

Core Features & Use Cases

  • Endpoint discovery and fingerprinting to identify exposed GraphQL interfaces.
  • Introspection-based schema analysis and field-level access tests to reveal over-permissive resolvers.
  • Authorization testing for nested resolvers and relay-style access controls, including data exposure checks.
  • DoS and resource exhaustion testing via complex queries, batching, and fragment strategies.
  • Federation and persisted-query evaluations to surface misconfigurations and schema exposure.

Quick Start

Identify a GraphQL endpoint and begin introspection and authorization checks following this methodology.

Frequently Asked Questions about graphql-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test GraphQL APIs for authorization flaws and IDOR vulnerabilities?▼

To test GraphQL APIs for authorization flaws, you perform field-level access tests and analyze nested resolvers to uncover over-permissive data exposure and IDOR vulnerabilities. This involves checking relay-style access controls to ensure users cannot access unauthorized data.

How does introspection help find security misconfigurations in GraphQL?▼

Introspection helps find security misconfigurations by querying the GraphQL schema to map all available queries, mutations, and subscriptions. This schema analysis reveals exposed interfaces and overly permissive resolvers that could leak sensitive data.

Can I run DoS and resource exhaustion tests against Apollo and Hasura backends?▼

Yes, you can run DoS and resource exhaustion tests against Apollo and Hasura backends by sending complex nested queries, batching multiple requests, and using fragment strategies to overload the resolvers and deplete server resources.

What is the best way to discover exposed GraphQL endpoints for pentesting?▼

The best way to discover exposed GraphQL endpoints for pentesting is through endpoint discovery and fingerprinting techniques. This identifies active GraphQL interfaces on web and mobile backends, allowing you to map the attack surface before testing.

Does this GraphQL security testing methodology enforce execution scope and timeouts?▼

Yes, this GraphQL security testing methodology enforces execution discipline with explicit scope, timeouts, and validated results. This ensures safe and repeatable testing when checking for federation misconfigurations and persisted-query exposures.

Related Skills

Explore More Software Engineering Skills→
valITinovalITino
7

api-security

Automate API security testing for REST, GraphQL, and custom endpoints.

Community
Advanced
RifteoRifteo
30

hexstrike-forge

Execute structured penetration tests with HexStrike AI across five phases.

Official
Advanced
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
aegnticaegntic
4

api-tester

Test and debug REST and GraphQL APIs with curl and httpie.

Community
Intermediate