# GraphQL Field-Level Injection

> Detects GraphQL resolvers vulnerable to injection through unsanitized field arguments and dynamic query construction.

- Skill: `zakirkun/graphql-field-level-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/graphql-field-level-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/graphql-field-level-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/graphql-field-level-injection

---


# GraphQL Field-Level Injection

## Overview
GraphQL resolvers that pass field arguments directly to database queries, OS commands, or other dangerous functions are vulnerable to injection. Unlike REST, GraphQL injection can be harder to detect because:
- Arguments arrive as parsed JavaScript objects (not raw strings)
- Multiple injection points per query
- Batch operations multiply impact

## Remediation
- Use parameterized queries in all database operations within resolvers
- Validate and sanitize all resolver arguments
- Use schema-level validation with type coercion