391 skills · sorted by relevance
Choose between REST, GraphQL, and tRPC based on who uses an API and how it is deployed. Define consistent responses, pagination, authentication, and versioning, supported by concrete request examples and failure cases.
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio query IDOR, decimal-precision and rounding abuse, idempotency-key bypass enabling double-spend, KYC/PII field-level authorization gaps, and admin-override mutations reachable via mass assignment. Distinct from hunt-graphql, which owns generic GraphQL discovery and IDOR/mutation methodology — this skill owns the delta introduced when a GraphQL layer sits in front of a ledger, wallet, payments, banking, brokerage, or lending backend, where a resolver bug moves real money instead of just leaking data. Use when hunting a fintech, banking, payments, wallet, neobank, brokerage, or lending target that exposes a GraphQL API, or when a schema/response includes balance, transfer, ledger, redeem, quote, KYC, or account-linking fields.
The English summary is being prepared. Showing the original description.
Implements GraphQL APIs in Golang using gqlgen or graphql-go. Apply when building GraphQL servers, designing schemas, writing resolvers, handling subscriptions, or integrating GraphQL with existing Go HTTP services. Also apply when the codebase imports `github.com/99designs/gqlgen` or `github.com/graph-gophers/graphql-go`.
The English summary is being prepared. Showing the original description.
Create integration tests for syncable metadata entities in Twenty itself. Cover invalid inputs, validation errors, and successful data operations, using reusable GraphQL request helpers, error snapshots, and cleanup routines to organize the test suite.
Design, build, debug, and optimize connections to external APIs. The skill covers REST, GraphQL, event notifications through webhooks, authentication, retries, request limits, and logging to help produce integrations whose failures can be traced.
Design APIs and interfaces between parts of an application with clear input and output types, consistent errors, and predictable names. The guidance helps you extend existing interfaces while preserving compatibility for the code that uses them.
Design REST or GraphQL APIs by defining data relationships, requests, responses, and authentication. Produce OpenAPI specifications, machine-readable API descriptions, with consistent errors, pagination, and versioning plans, then validate contracts using a mock server.
Query gnomAD for variant frequencies, gene constraint measures, and effects on gene transcripts. Get concise Markdown summaries from focused requests, with options to return machine-readable JSON or save the full response to a file.
Retrieve focused information from CIViC for cancer variant interpretation. It uses GraphQL, a way to request specific data fields, to inspect available data structures and turn targeted evidence results into concise summaries.
Build and troubleshoot Shopify themes, apps, and custom storefronts with task-specific references. It covers Liquid, Shopify’s template language, API data access, custom business rules, and performance improvements, using API version 2026-01.
GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.
The English summary is being prepared. Showing the original description.
GraphQL API specialist for schema design, resolvers, federation, and performance optimizationUse when "graphql, schema design, resolvers, federation, apollo, relay, dataloader, n+1 problem, graphql security, graphql, api, schema, resolvers, federation, subscriptions, apollo, relay, dataloader" mentioned.
The English summary is being prepared. Showing the original description.
DataLoader, subscriptions, federation, and schema stitching for GraphQL APIs. Activate on: GraphQL, DataLoader, subscription, federation, schema stitching, resolver, SDL, Apollo, Yoga. NOT for: REST API design (use api-architect), frontend GraphQL clients (use relevant frontend skill).
The English summary is being prepared. Showing the original description.
Diagnose and eliminate the GraphQL N+1 resolver explosion using Facebook DataLoader's per-request batching, plus the second-order defenses (persisted queries, depth limits, cost analysis). Use when a GraphQL query that returns N items in a list triggers N+1 database round trips, when designing nested resolvers that load associations, when a list query times out under load, or when you need to budget query cost before resolvers run. NOT for REST-style endpoint design (use api-versioning-strategy), generic database query optimization (use database-query-optimizer), or schema design (use graphql-server-architect).
The English summary is being prepared. Showing the original description.
Performs GraphQL introspection attacks to Şunu çıkar: full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testi...
The English summary is being prepared. Showing the original description.
Migrates REST APIs to GraphQL incrementally with schema stitching, REST datasources, and gradual endpoint migration. Use when users request "migrate to GraphQL", "REST to GraphQL", "GraphQL wrapper", or "API modernization".
The English summary is being prepared. Showing the original description.
Read and update Shopify store data through GraphQL, an API format for requesting specific fields, using curl. The skill covers products, orders, customers, inventory adjustments, custom fields, and bulk data exports, with checks for API errors.
Design and implement backend APIs, the interfaces applications use to exchange data. Cover authentication, input validation, error handling, tests, and documentation, while consulting stored implementation patterns and recording results for reuse in later development tasks.
Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.
You are an expert in Apollo Client, the comprehensive GraphQL client for React applications. You help developers fetch data with GraphQL queries and mutations, manage local and remote state with Apollo's normalized cache, implement optimistic UI updates, handle pagination, and configure authentication — providing a complete data management solution for GraphQL-powered apps.
The English summary is being prepared. Showing the original description.
Build and configure a GraphQL API backed by Neo4j using @neo4j/graphql v7 (current) or v5 (LTS). Covers Neo4jGraphQL constructor, getSchema(), assertIndexesAndConstraints(), type definitions with @node, @relationship (IN/OUT/UNDIRECTED), @cypher for custom resolvers, @authorization/@authentication for JWT/JWKS security, auto-generated queries/mutations, OGM programmatic access, subscriptions via CDC, and Apollo Federation. Use when writing typeDefs, securing fields, or wiring Neo4j to Apollo Server. Does NOT handle raw Cypher outside resolvers — use neo4j-cypher-skill. Does NOT cover Spring Data Neo4j entity mapping — use neo4j-spring-data-skill.
The English summary is being prepared. Showing the original description.
Expert guide for designing and consuming GraphQL APIs. Covers Apollo Server/Client, NestJS GraphQL (Code-First & Schema-First), TypeGraphQL, caching, and N+1 query optimization.
The English summary is being prepared. Showing the original description.
Covers object-level authorization bypass in GraphQL APIs where introspection reveals hidden fields or mutations that accept arbitrary user/resource IDs without ownership checks. Trigger on keywords like "GraphQL", "query", "mutation", "introspection", "resolver", "node ID", "relay", "object type", "schema", "batching", or "alias". Applies to dual-stack REST+GraphQL apps, Relay-style global IDs, and unauthenticated resolvers.
The English summary is being prepared. Showing the original description.