How do I install the Testing GRAPHQL Security skill?

Run npx skillmds@latest add majiayu000/testing-graphql-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Testing GRAPHQL Security skill do?

It is listed under Security on SkillMD.

Is Testing GRAPHQL Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Testing GRAPHQL Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Testing GRAPHQL Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Testing GRAPHQL Security?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Testing GRAPHQL Security by majiayu000

Name: Testing GRAPHQL Security
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

name: testing-graphql-security description: >- Test GraphQL API security including introspection disclosure, query depth attacks, batching abuse, IDOR via node interface, and injection through resolver arguments. domain: cybersecurity subdomain: bug-bounty tags: - graphql - introspection - query-depth - api-security version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1190"] frameworks: ["MITRE ATT&CK", "OWASP"] tools: ["burpsuite", "graphql-voyager", "inql"]

Testing Graphql Security

Overview

Test GraphQL API security including introspection disclosure, query depth attacks, batching abuse, IDOR via node interface, and injection through resolver arguments.

Prerequisites

Tool / Requirement	Details
`burpsuite`	Security tooling
`graphql-voyager`	Security tooling
`inql`	Security tooling
Burp Suite with InQL, GraphQL Voyager, target GraphQL endpoint	Environment requirement

Quick Reference

# Quick start commands
node scripts/agent.js --help
node scripts/agent.js enumerate --url https://target.com/graphql

Workflow

Step 1: Enumerate Schema

node scripts/agent.js enumerate --url https://target.com/graphql

Step 2: Test Query Depth

node scripts/agent.js test --url https://target.com/graphql --vector depth

Step 3: Fuzz Resolvers

node scripts/agent.js fuzz --url https://target.com/graphql --wordlist resolvers.txt

Verification

Verify schema enumeration: node scripts/agent.js enumerate --url https://target.com/graphql
Confirm findings: node scripts/agent.js report --url https://target.com/graphql

References

MITRE ATT&CK: T1190
Frameworks: MITRE ATT&CK, OWASP
Tools: burpsuite, graphql-voyager, inql

---name: testing-graphql-securitydescription: ---    --- name: testing-graphql-security description: >- Test GraphQL API security including introspection disclosure, query depth attacks, batching abuse, IDOR via node interface, and injection through resolver arguments. domain: cybersecurity subdomain: bug-bounty tags: - graphql - introspection - query-depth - api-security version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1190"] frameworks: ["MITRE ATT&CK", "OWASP"] tools: ["burpsuite", "graphql-voyager", "inql"] --- # Testing Graphql Security ## Overview Test GraphQL API security including introspection disclosure, query depth attacks, batching abuse, IDOR via node interface, and injection through resolver arguments. ## Prerequisites | Tool / Requirement | Details | |---|---| | `burpsuite` | Security tooling | | `graphql-voyager` | Security tooling | | `inql` | Security tooling | | Burp Suite with InQL, GraphQL Voyager, target GraphQL endpoint | Environment requirement | ## Quick Reference ```bash # Quick start commands node scripts/agent.js --help node scripts/agent.js enumerate --url https://target.com/graphql ``` ## Workflow ### Step 1: Enumerate Schema ```bash node scripts/agent.js enumerate --url https://target.com/graphql ``` ### Step 2: Test Query Depth ```bash node scripts/agent.js test --url https://target.com/graphql --vector depth ``` ### Step 3: Fuzz Resolvers ```bash node scripts/agent.js fuzz --url https://target.com/graphql --wordlist resolvers.txt ``` ## Verification - **Verify schema enumeration**: `node scripts/agent.js enumerate --url https://target.com/graphql` - **Confirm findings**: `node scripts/agent.js report --url https://target.com/graphql` ## References - MITRE ATT&CK: T1190 - Frameworks: MITRE ATT&CK, OWASP - Tools: burpsuite, graphql-voyager, inql

Frequently asked questions

Testing GRAPHQL Security