From prodsec-skills
Secures GraphQL APIs against introspection leaks, deep query abuse, and authorization bypass. Use when building, reviewing, or auditing GraphQL schemas, resolvers, or gateway configurations.
How this skill is triggered — by the user, by Claude, or both
Slash command
/prodsec-skills:graphql-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
GraphQL APIs introduce a threat surface distinct from REST. The flexible query language enables clients to request arbitrary data shapes, which can be abused for data exfiltration, denial of service, and authorization bypass if not constrained.
GraphQL APIs introduce a threat surface distinct from REST. The flexible query language enables clients to request arbitrary data shapes, which can be abused for data exfiltration, denial of service, and authorization bypass if not constrained.
Authorization logic MUST live in the business-logic layer, not in individual resolvers.
Scattering authorization checks across resolvers creates gaps as the schema grows. Any resolver that forgets a check becomes an exploitable authorization flaw.
GraphQL introspection exposes your full schema, including types, queries, mutations, and subscriptions. This is valuable for attackers mapping your attack surface.
Deeply nested queries can trigger expensive recursive resolution, leading to resource exhaustion.
Even within depth limits, queries can request expensive combinations of fields and connections.
GraphQL's single-endpoint design concentrates all operations on one URL, making rate limiting essential.
npx claudepluginhub redhatproductsecurity/prodsec-skills --plugin prodsec-skillsDetects GraphQL schemas missing depth limits, cost analysis, or production introspection controls. Audits Apollo, Yoga, Strawberry, gqlgen and other frameworks.
Secures GraphQL APIs by limiting query depth/complexity, disabling introspection in production, and enforcing field-level authorization. Based on OWASP guidelines.
Assesses GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and DoS vulnerabilities during authorized security tests.