391 skills · sorted by relevance
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully. 2025 lesson: GraphQL isn't always the answer. For simple CRUD, REST is simpler. For high-performance public APIs, REST with caching wins. Use GraphQL when you have complex data relationships and diverse client needs. Use when "graphql, graphql schema, graphql resolver, apollo server, apollo client, graphql federation, dataloader, graphql codegen, graphql query, graphql mutation, graphql, api, apollo, schema, resolvers, dataloader, federation, typescript" mentioned.
The English summary is being prepared. Showing the original description.
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplificat...
The English summary is being prepared. Showing the original description.
Design and review REST and GraphQL APIs with consistent naming, data structures, error responses, pagination for large result sets, and versioning strategies. Helps teams define shared standards and plan changes that existing clients can adopt gradually.
Automate Contentful Graphql operations through Rube MCP, a connection for agent tools. The skill discovers available actions, checks the service connection, and follows current input requirements to execute the requested workflow.
Design REST or GraphQL APIs by defining who will use them, what data they expose, and how requests behave. Establish error formats, versioning, pagination, and authentication, then review examples for consistency before implementation.
Assess REST, GraphQL, and gRPC APIs for authentication, access control, input validation, and business logic weaknesses. Use OWASP API Security Top 10, a framework of common API risks, to organize testing and document findings with reproduction steps and remediation.
Automate Contentful Graphql operations through Rube MCP, a connection for agent tools. The skill discovers available actions, checks the service connection, and follows current input requirements to execute the requested workflow.
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
Assess REST and GraphQL API security through checks of authentication, access permissions, input validation, and request limits. The workflow guides endpoint discovery, testing, and documentation of findings and remediation within an authorized scope.
Design REST and GraphQL APIs by clarifying who will use them and how. Define data structures, errors, authentication, pagination, and versioning, then review examples to make the interface consistent and easier to use.
Design GraphQL APIs with clear data types, efficient data retrieval, and example operations. Build combined APIs across services and real-time updates, while addressing repeated database requests, query cost limits, and access control for individual fields.
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
Diagnose REST and GraphQL API failures by checking connectivity, authentication, request formats, and returned data. Prepare reproducible commands, identify likely causes, and build regression tests that check whether a fix keeps working.
Connect syncable entity components within Twenty server internals and expose them through GraphQL, an API query interface. It guides NestJS module registration, business services, response data conversion, and consistent handling of validation and execution errors.
Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.
Guide authorized security assessments of REST, SOAP, and GraphQL APIs. Organize endpoint discovery, authentication checks, access control tests, and input testing, then document discovered weaknesses and evidence of unauthorized data access.
Compare GraphQL and RPC contracts, which describe expected API behavior, with generated clients and live handlers in a CTF sandbox. Identify hidden or outdated operations and preserve minimal request pairs that demonstrate the mismatch.
Choose how an API, the interface software uses to exchange data, should work. Covers REST, GraphQL, and tRPC selection, consistent responses, pagination, versioning, authentication, request limits, documentation, and security review considerations.
Design GraphQL APIs with clear data types, data-fetching functions called resolvers, and real-time updates. Address repeated database calls, pagination, structured errors, and expensive queries while planning schema changes that preserve compatibility.
Test and debug REST and GraphQL APIs using curl, httpie, Postman collections, or scripted tests. Check authentication, invalid inputs, pagination, and response details to identify failures that a successful status code alone may miss.
Work with Linear issues through Symphony’s authenticated client. Retrieve issue details, update workflow states, create or edit comments, link GitHub pull requests, and upload videos using GraphQL, an API language for requesting specific data.
Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to find GraphQL injection, unsafe GraphQL document construction, or operation string injection bugs.
The English summary is being prepared. Showing the original description.
The GraphQL pipeline for SKMTC generators — authoring generators whose input schema is GraphQL SDL rather than OpenAPI. Covers `toGqlOperationEntry`, `GqlOperation`, `synthesizeArgsObject` (mutation args -> object schema), the GQL enrichment routing (`[id][rootKind][fieldName][variant]` — two nested subject keys where OAS has path+method), the `to<Lang>GqlOperationProjectionBase` companion factories, and the `GeneratorKey` shape `id|rootKind|fieldName|variant`. Use this skill ALONGSIDE `skmtc-generator` whenever the schema source is GraphQL SDL or the task mentions "GraphQL", "SDL", "GqlOperation", "toGqlOperationEntry", or GraphQL query/mutation generators. Engine rules (producers, register/insert, the axioms) stay in `skmtc-generator`; this skill carries only what differs for GraphQL.
The English summary is being prepared. Showing the original description.