hunt-graphql

Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument, broken-object-level-authz, auth-bypass via unscoped mutations, and PII exposure from missing field-level authz. Use when hunting graphql on any target.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-graphql/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable hunting skill with copy-paste payloads, a sequenced methodology, and real report citations. Its main weaknesses are prose that could be trimmed and heavy inlining of citation/payload material that would benefit from separate reference files.

Suggestions

Move the nine detailed 'Disclosed Report Citations' into a references/ file (e.g. reports.md) and keep a one-line index inline, improving progressive disclosure and conciseness.

Tighten the three 'Real Impact Examples' scenarios into compact repro chains rather than narrative paragraphs.

Resolve the dangling reference to docs/verification/phase2e-jwt-graphql-race.md by either shipping the file in references/ or removing the citation.

Dimension	Reasoning	Score
Conciseness	The bulk is concrete, token-earning material (payloads, curl sequences, tool commands, report citations), but prose sections such as the 'Crown Jewel Targets' editorializing and the three long narrative 'Real Impact Examples' scenarios could be tightened.	3 / 5
Actionability	Provides fully executable, copy-paste-ready payloads and commands across the common cases — full introspection query, curl introspection test, batch JSON, alias-batching OTP mutation, complete RC desync curl sequence, and InQL/clairvoyance/graphql-cop invocations.	5 / 5
Workflow Clarity	A clear 10-step sequenced hunting methodology is backed by the Gate 0 validation checkpoints (attacker DO / victim LOSE / 10-minute repro), so validation is present and the destructive/batch cap does not apply; it stops short of explicit validate->fix->retry feedback loops.	4 / 5
Progressive Disclosure	Section headers are clear and well-organized, but with no references/scripts/assets bundle present, 362 lines inline material (nine detailed report citations and a large payload collection) that could be split into separate files, and a dangling reference to docs/verification/phase2e-jwt-graphql-race.md that is not present as a bundle file.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, domain-specific description with an explicit 'Use when' trigger and a comprehensive subclass inventory. It is held below 5 by a single broad trigger phrase and minor overlap with sibling hunt-* skills.

Suggestions

Expand the 'Use when' clause with concrete trigger variants, e.g. 'Use when testing GraphQL endpoints, introspection, mutations, or cross-tenant IDOR on any target.'

Add common synonyms/extensions ('GraphQL API', 'gql') to broaden natural-keyword coverage.

Clarify the boundary against hunt-idor/hunt-ssrf by stating this skill applies specifically when the surface is a GraphQL endpoint.

Dimension	Reasoning	Score
Specificity	Names the graphql domain and lists many concrete vulnerability subclasses (IDOR via node()/GID, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument, PII exposure), giving comprehensive coverage, though the action is a single 'hunting' verb rather than multiple distinct operations.	4 / 5
Completeness	Explicitly answers both 'what' (detailed subclass inventory) and 'when' ('Use when hunting graphql on any target'), but the when-clause is a single broad trigger rather than the multiple concrete trigger phrases of a level-5 anchor.	4 / 5
Trigger Term Quality	Includes natural keywords a hunter would say ('graphql vulnerabilities', 'hunting graphql', 'bug bounty') with a clear 'Use when hunting graphql' trigger, but lacks synonyms like 'gql' or 'GraphQL API' for full coverage.	4 / 5
Distinctiveness Conflict Risk	The 'hunting graphql' trigger carves a clear niche with minimal conflict risk, but the covered subclasses (IDOR, SSRF, SQLi) overlap with sibling hunt-idor / hunt-ssrf skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-graphql/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.