34 个 · 按相关度排序
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
中文简介正在准备中。当前显示英语简介。
Identify and exploit GraphQL API vulnerabilities by leveraging Introspection queries to dump the entire database schema, performing query batching to bypass rate limits (brute forcing), and extracting deeply nested unauthorized data via graph relationship abuse.
中文简介正在准备中。当前显示原文说明。
Covers object-level authorization bypass in GraphQL APIs where introspection reveals hidden fields or mutations that accept arbitrary user/resource IDs without ownership checks. Trigger on keywords like "GraphQL", "query", "mutation", "introspection", "resolver", "node ID", "relay", "object type", "schema", "batching", or "alias". Applies to dual-stack REST+GraphQL apps, Relay-style global IDs, and unauthenticated resolvers.
中文简介正在准备中。当前显示原文说明。
Exploit exposed GraphQL introspection endpoints to map the entire API schema. This skill details how to extract available queries, mutations, types, and fields, which significantly aids in identifying hidden endpoints, Broken Object Level Authorization (BOLA/IDOR), and mass assignment vulnerabilities.
中文简介正在准备中。当前显示原文说明。
Performs GraphQL introspection attacks to Şunu çıkar: full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testi...
中文简介正在准备中。当前显示原文说明。
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplificat...
中文简介正在准备中。当前显示原文说明。
根据错误信息和执行环境，分析AI代理反复失败或重复操作的原因。通过小范围、可撤销的恢复操作检验假设，并将结果与依据整理成可供交接的报告。
在AI代理反复失败或重复操作时，记录错误与环境前提、排查原因，采取影响有限的恢复操作，并汇总结果和证据，为有依据的重试与交接提供支持。
Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports.
中文简介正在准备中。当前显示原文说明。
Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports.
中文简介正在准备中。当前显示原文说明。
GraphQL saldırıları — introspection, aliased query batching, rate limit bypass
中文简介正在准备中。当前显示原文说明。
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
中文简介正在准备中。当前显示英语简介。
Audit GraphQL APIs for exposed schemas, missing access checks, injection risks, and weak query limits. Combine automated tools with targeted checks to investigate data exposure, unauthorized operations, and resource exhaustion, then document findings with reproducible evidence.
中文简介正在准备中。当前显示英语简介。
[omh] Agent is stuck, looping, or drifting: capture a stuck, looping, drifting, or repeatedly failing agent run, diagnose the likely failure pattern, and prepare the smallest safe recovery action. Use when the user says: agent-debug, agent debug, agent debugging, agent introspection, agent self-debug, self-debug, self debugging, looping agent.
中文简介正在准备中。当前显示原文说明。
GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.
中文简介正在准备中。当前显示原文说明。
Use BEFORE reading any data file that could be large (CSV/TSV, Parquet, HDF5, FITS, NetCDF, NDJSON, genomics FASTQ/FASTA/VCF/BAM, GRIB, ROOT, or big text/simulation logs like VASP OUTCAR). Returns a compact memory pointer — header/schema/shape/sample/key numbers — by introspection and sampling in bounded memory, so you never load a file bigger than the context window into the model. Reference data via the pointer; read specific ranges deterministically.
中文简介正在准备中。当前显示原文说明。
Configure Simulink models for Embedded Coder (ERT), Simulink Coder (GRT rapid-prototyping), or AUTOSAR code generation. Use when the user asks to generate embedded C or C++ code, run a full build of a model, produce a code generation report, configure a model for production/ECU deployment or rapid-prototyping code, target ARM or x86 hardware, apply MISRA C/C++ compliance (ERT/AUTOSAR only — Simulink Coder does not ship MISRA profiles), or set up GRT, ERT, AUTOSAR, or shared-library targets. Handles target selection, hardware mapping, model hierarchy propagation, and constraint introspection via the configure_for_codegen function. Do NOT use for GRT shared-library variants (grt_malloc.tlc), DDS, or ROS, or for iterative optimization workflows that measure baseline metrics, apply targeted changes, and re-measure to confirm improvement.
中文简介正在准备中。当前显示原文说明。
API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse. OWASP API Top 10. Wiki-first, FIND schema output.
中文简介正在准备中。当前显示原文说明。
GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully. 2025 lesson: GraphQL isn't always the answer. For simple CRUD, REST is simpler. For high-performance public APIs, REST with caching wins. Use GraphQL when you have complex data relationships and diverse client needs. Use when "graphql, graphql schema, graphql resolver, apollo server, apollo client, graphql federation, dataloader, graphql codegen, graphql query, graphql mutation, graphql, api, apollo, schema, resolvers, dataloader, federation, typescript" mentioned.
中文简介正在准备中。当前显示原文说明。
Hunt GraphQL-specific vulns — introspection abuse, field-level authorization (IDOR), batched queries for brute force, alias-based rate limit bypass, deep query DoS, mutation injection, schema disclosure, suggestion leakage, CSRF via GET, and CSRF via POST without preflight. Use when a GraphQL endpoint is present.
中文简介正在准备中。当前显示原文说明。
Use this skill when the user needs Obsidian runtime debugging or developer introspection through official desktop Obsidian CLI developer commands, including devtools, console/errors capture, DOM/CSS inspection, screenshots, CDP calls, and controlled eval. Do not use for regular note CRUD, task/property editing, Sync/Publish administration, or community tooling outside the official CLI.
中文简介正在准备中。当前显示原文说明。
API security automation skill for REST, GraphQL, gRPC, and WebSocket APIs. Covers OpenAPI/AsyncAPI ingestion, authenticated fuzzing, OWASP API Top 10 (BOLA, BFLA, mass assignment, SSRF), schema diffing, GraphQL introspection abuse, JWT and OAuth misuse, rate-limit and replay testing. Use to automate API assessments with safe, scoped, evidence-backed findings.
中文简介正在准备中。当前显示原文说明。
Route a vague Prisma Next prompt to the right specific skill. Use for "help me with Prisma Next", "what is Prisma Next", "explain Prisma Next", "I'm new to PN", "where do I start", "what can I do with Prisma Next", "what can I do next with Prisma", "just ran createprisma", "tour of Prisma Next", "Prisma Next overview", and comparison questions like "Prisma Next vs Prisma 7", "PN vs Drizzle", "PN vs Kysely", "PN vs TypeORM". Do NOT use when the prompt clearly matches a workflow skill — adoption / quickstart / first-touch orientation / brownfield introspection, schema / contract editing, migration authoring (db update / migration plan / migrate), migration review on deploy / concurrent migrations, queries / db.orm / db.sql / TypedSQL, runtime / db.ts / middleware wiring, build / Vite plugin / Next.js plugin, debug / structured error envelopes / PN-* error codes, or feedback / bug report / feature request — load that sibling skill directly.
中文简介正在准备中。当前显示原文说明。
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
中文简介正在准备中。当前显示原文说明。