graphql-audit

GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable GraphQL attack playbook with concrete, copy-paste commands across many techniques, but it is overlong for a single SKILL.md, relies on a missing bundled script, and lacks explicit validation checkpoints for its batch/destructive operations.

Suggestions

Add explicit validate/confirm-impact checkpoints to the batch and destructive workflows (e.g., after alias/OTP brute-force, verify a successful result before reporting, and confirm DoS impact via measured response-time delta with a defined threshold).

Provide the referenced tools/graphql_audit.sh (or remove the reference and inline only what exists); consider splitting the large per-technique sections into one-level reference files so SKILL.md stays a concise overview.

Tighten the body: drop the editorial epigraph and condense the repeated curl+python3 boilerplate into reusable snippets to reduce the ~500-line footprint.

Dimension	Reasoning	Score
Conciseness	The ~500-line body is dense and actionable but long; editorial framing ('GraphQL flips the threat model — clients drive queries. One endpoint, infinite attack surface.') and repetitive curl-wrapped python one-liners could be tightened. It is mostly efficient but carries length that does not all earn its place.	2 / 3
Actionability	Nearly every section supplies copy-paste-ready, executable commands — curl probes, pip installs, python3 one-liners, wscat subscription payloads — meeting the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	The 'QUICK KILL CHECKLIST' sequences phases with conditional branches ('If introspection off — run clairvoyance') and a 'KILL SIGNALS' stop condition, but the batch/destructive operations (alias bombing, OTP brute force) lack explicit validate-confirm-impact checkpoints in the workflow itself, capping clarity at 2.	2 / 3
Progressive Disclosure	Content is well-organized into numbered sections but is essentially monolithic — all detail lives inline in SKILL.md with no separate reference files, and the one referenced bundle (tools/graphql_audit.sh, 'this repo') does not exist on disk, leaving a broken one-level reference.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete capabilities and gives an explicit 'Use when' trigger tied to recognizable GraphQL endpoint paths. It is specific, complete, and unlikely to conflict with other skills.

Dimension	Reasoning	Score
Specificity	Lists many concrete specific actions — 'introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass' — matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers both what (the attack-surface list) and when via the clause 'Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.'	3 / 3
Trigger Term Quality	Covers natural terms a user would say ('GraphQL', '/graphql', '/api/graphql', 'GQL-over-HTTP') plus concrete tool names, giving good coverage rather than generic jargon.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (GraphQL security hunting) with distinct endpoint-based triggers, making it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (524 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: shuvonsec/claude-bug-bounty
Path: skills/graphql-audit/SKILL.md
Commit: 2009594

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.