Agent skill
testing-graphql-security
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/testing-graphql-security
SKILL.md
name: testing-graphql-security description: >- Test GraphQL API security including introspection disclosure, query depth attacks, batching abuse, IDOR via node interface, and injection through resolver arguments. domain: cybersecurity subdomain: bug-bounty tags:
- graphql
- introspection
- query-depth
- api-security version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1190"] frameworks: ["MITRE ATT&CK", "OWASP"] tools: ["burpsuite", "graphql-voyager", "inql"]
Testing Graphql Security
Overview
Test GraphQL API security including introspection disclosure, query depth attacks, batching abuse, IDOR via node interface, and injection through resolver arguments.
Prerequisites
| Tool / Requirement | Details |
|---|---|
burpsuite |
Security tooling |
graphql-voyager |
Security tooling |
inql |
Security tooling |
| Burp Suite with InQL, GraphQL Voyager, target GraphQL endpoint | Environment requirement |
Quick Reference
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js enumerate --url https://target.com/graphql
Workflow
Step 1: Enumerate Schema
node scripts/agent.js enumerate --url https://target.com/graphql
Step 2: Test Query Depth
node scripts/agent.js test --url https://target.com/graphql --vector depth
Step 3: Fuzz Resolvers
node scripts/agent.js fuzz --url https://target.com/graphql --wordlist resolvers.txt
Verification
- Verify schema enumeration:
node scripts/agent.js enumerate --url https://target.com/graphql - Confirm findings:
node scripts/agent.js report --url https://target.com/graphql
References
- MITRE ATT&CK: T1190
- Frameworks: MITRE ATT&CK, OWASP
- Tools: burpsuite, graphql-voyager, inql
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?