CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

testland/graphql-complexity-limit-tester

Use when a GraphQL API must be hardened or audited against denial of service and schema disclosure. Sends over-limit depth and cost queries and asserts they are rejected, proving graphql-depth-limit, cost analysis or graphql-armor are enforced; covers introspection and persisted-query allowlists.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill with strong validation checkpoints and clean bundle structure. Its main cost is token efficiency: repeated graphql-armor defaults and duplicated citation URLs inflate the body without adding guidance value.

Suggestions

Consolidate the graphql-armor defaults (n=6, maxCost=5000, n=1000) into a single table in Step 2 and cite each plugin doc URL once, rather than repeating them in the Overview, Step 3, and test comments.

Remove or slim the References section entries that duplicate URLs already cited inline, keeping only links not previously given.

Note in the cost/token test snippets that generated field names (field0..N, f0..f59) must be replaced with real schema fields, so the errors assertion targets the cost/token rejection rather than an unknown-field validation error.

DimensionReasoningScore

Conciseness

The core instructions are tight, but the graphql-armor defaults (n=6, maxCost=5000, n=1000) and their citation URLs are repeated across the Overview, Step 2, Step 3, and test comments, and the References section duplicates every URL already cited inline — noticeable tightening opportunities keep this below anchor 4.

3 / 5

Actionability

Provides complete TypeScript test code for all three library families plus the Envelop variant, with install and run commands; minor gaps remain (some snippets use typeDefs/resolvers without imports, and cost/token tests generate field names like field0..N that won't exist in a real schema), so it is not literally copy-paste ready.

4 / 5

Workflow Clarity

Explicit validation checkpoints throughout: a hard-stop gate when no limit is configured, a required read of the actual configured limit before crafting queries, a resolver-call assertion proving validation short-circuits execution, an anti-patterns table with fixes, and a production-config drift check.

5 / 5

Progressive Disclosure

Well-sectioned body with both reference links (introspection.md, persisted-queries.md) verified real, clearly signaled with context, and exactly one level deep; background catalogs are appropriately split into reference files while executable test authoring stays in the body.

5 / 5

Total

17

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit trigger guidance, concrete third-person actions, and named target libraries. Its only weaknesses are a few missing natural synonyms (e.g., "query complexity") and slight overlap with sibling introspection/persisted-query skills.

DimensionReasoningScore

Specificity

Lists multiple concrete third-person actions — "Sends over-limit depth and cost queries and asserts they are rejected, proving graphql-depth-limit, cost analysis or graphql-armor are enforced" — with named libraries and covered areas (introspection, persisted-query allowlists); coverage is comprehensive rather than gapped.

5 / 5

Completeness

Explicitly answers both questions: "Use when a GraphQL API must be hardened or audited against denial of service and schema disclosure" (when) and the concrete what-clause describing the over-limit query/assertion behavior with named libraries.

5 / 5

Trigger Term Quality

Good natural-term coverage ("GraphQL", "hardened or audited", "denial of service", "depth", "cost", "introspection", "graphql-armor"), but common user phrasings like "query complexity" or "query depth limit" are absent, so it falls short of the comprehensive-synonyms anchor.

4 / 5

Distinctiveness Conflict Risk

The GraphQL DoS depth/cost testing niche with named libraries is distinct, but "covers introspection and persisted-query allowlists" overlaps the sibling introspection/APQ skills this bundle references, creating minor conflict risk with closely related skills.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

On this page