skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

offensive-graphql

Automate GraphQL security testing for introspection, authorization, and injection vulnerabilities.

1|Updated Apr 27, 2026
Search Tags:#authorization#injection#graphql#introspection#api-security#security-testing#dos
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-graphql
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-graphql
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Red/Skills/offensive-graphql
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-graphql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

GraphQL security testing complexities and misconfigurations, including introspection exposure, authorization gaps, and vulnerability opportunities in GraphQL APIs.

Core Features & Use Cases

  • Introspection risk assessment and schema review to identify sensitive types and fields.
  • Authorization testing and IDOR, mutation access checks across roles and permissions.
  • Injection and DoS testing for queries, mutations, and subscriptions, with guidance on remediation.

Quick Start

Identify the GraphQL endpoint and apply the full vulnerability checklist to assess security posture.

Frequently Asked Questions about offensive-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my GraphQL API for authorization bypass and IDOR vulnerabilities?▼

GraphQL security testing enumerates your schema to identify sensitive types and fields exposed via introspection. It assesses these misconfiguration risks to prevent attackers from mapping your entire API structure.

What is the best way to assess introspection risks in a GraphQL service?▼

GraphQL security testing enumerates your schema to identify sensitive types and fields exposed via introspection. It assesses these misconfiguration risks to prevent attackers from mapping your entire API structure.

Can I run GraphQL injection and DoS testing against staging environments?▼

GraphQL security testing applies to both staging and production web apps and APIs. It evaluates introspection exposure, authentication configurations, and complex query risks across your environments.

How do I start a comprehensive security checklist for my GraphQL endpoint?▼

Identify your GraphQL endpoint and apply a full vulnerability checklist to assess its security posture. This automates schema enumeration, misconfiguration detection, and vulnerability testing across the service.

Does GraphQL security testing provide guidance on vulnerability remediation?▼

GraphQL security testing provides remediation guidance alongside injection and DoS vulnerability detection. It translates identified misconfigurations and authorization gaps into actionable steps to secure your API.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs for vulnerabilities.

Community
Intermediate
jpoleyjpoley
50

security-fixer

Generate secure patches for code vulnerabilities and output unified diffs.

Community
Intermediate
LingrongyeLingrongye
1

training-check

Monitor WandB metrics during model training to detect anomalies.

Community
Advanced
Prohao42Prohao42
120

waf-bypass-techniques

Identify WAF products and apply bypass techniques for penetration testing.

Community
Advanced