Identify GraphQL security gaps like IDOR and authorization bypass.
npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-graphql-grivera82
Please help me install this Agent Skill. Skill: hunt-graphql Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/hunt-graphql Command: npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-graphql-grivera82
GraphQL endpoints often expose authorization-sensitive data and complex state transitions via single endpoints, making misconfigurations easy to exploit. This Skill helps identify, map, and validate GraphQL security gaps such as IDOR, cross-tenant access, SSRF, and DoS, enabling safer and reproducible bug-hunting workflows.
Analyze a target GraphQL endpoint with introspection enabled and report high-risk findings.
High-intent search queries and answers about installing and using this skill.
Testing GraphQL endpoints for IDOR and authorization bypass requires mapping schema introspection and mutation paths to expose access control misconfigurations. You can apply targeted testing workflows on platform endpoints to reproduce privilege-escalation scenarios safely.
Finding cross-tenant access vulnerabilities in multi-tenant SaaS involves enumerating the GraphQL schema, testing authorization boundaries, and verifying access controls across tenants. This process maps exposure and validates complex state transitions via single endpoints.
GraphQL introspection exposes security gaps by revealing endpoint surfaces and mutation paths that can bypass access controls. Analyzing these introspection surfaces allows you to map exposure and identify authorization-sensitive data vulnerabilities.
You can test REST and GraphQL API parity by coordinating cross-API testing workflows to reveal parity gaps and orphaned permissions. This approach helps identify authorization bypass and cross-tenant access vulnerabilities across both interfaces.
Safely reproducing GraphQL privilege escalation scenarios requires an exploitation-resistant evidence collection methodology. This validation process maps vulnerabilities from discovery through testing to generate report-ready security workflows.
This GraphQL security testing workflow requires no external dependencies and provides tooling guidance for safe, reproducible research. It relies on robust GraphQL pattern recognition to test endpoints, mutations, and introspection surfaces effectively.
cameronapakEnforce authentication and authorization checks on BKND API endpoints.
rajyeole6Conduct authorized penetration testing across network, web, and cloud infrastructure.
ricardoo022Test Supabase Row Level Security across REST and GraphQL channels.
cybersecwomanDiscover GraphQL vulnerabilities via schema introspection and response header validation.
