CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/graphql-complexity-limit-tester

The GraphQL attack-surface / hardening skill: crafts over-limit depth and complexity queries then asserts rejection before execution, verifying that graphql-depth-limit, graphql-cost-analysis, and graphql-armor (max-depth / cost-limit / max-tokens plugins) are actually enforced and not just configured; carries the introspection attack-surface catalog (what __schema exposes, per-framework disable controls, hideSchemaDetailsFromClientErrors) in references/introspection.md and the persisted-query allowlisting strategies (Apollo APQ protocol, auto-register vs strict-allowlist vs hybrid modes) in references/persisted-queries.md. Use when auditing a GraphQL service for DoS or schema-disclosure exposure, hardening a production deployment, or adding tests that prove the limits in CI.

76

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and well-structured, with executable code for every supported library and explicit validation checkpoints guarding against vacuous passes. The only weakness is mild redundancy where graphql-armor defaults are restated across multiple sections.

Suggestions

State the graphql-armor defaults (n=6, maxCost=5000, n=1000) once in Step 2 and reference back from later sections instead of repeating them in the Overview, Step 3, and Step 4 comments.

Consider moving the per-plugin default-value tables into a short reference snippet or a single consolidated table to avoid restating the same figures in prose.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence with no basic-concept padding, but restates the graphql-armor default values (n=6, maxCost=5000, n=1000) across the Overview, Step 2, and Step 3/4 sections, which is minor over-explanation that could be trimmed.

4 / 5

Actionability

Provides copy-paste-ready TypeScript test code for all three library families plus install commands, query-construction templates, and a resolver-call assertion, covering the common cases fully executable.

5 / 5

Workflow Clarity

A clear five-step sequence (Install, Identify limit, Craft queries, Write tests, Assert pre-execution rejection) with explicit validation checkpoints: the 'Hard stop: no limit configured' guard and the Step 5 resolver-call counter that confirms validation short-circuits execution.

5 / 5

Progressive Disclosure

The body is a concise overview with well-signaled one-level-deep references to references/introspection.md and references/persisted-queries.md, both confirmed as real bundle files; catalog material is correctly split out rather than inlined.

5 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and well-differentiated: it states concrete actions across three named libraries, gives explicit 'Use when' triggers, and carves out a distinct niche from related GraphQL skills. Trigger terms are natural and comprehensive.

DimensionReasoningScore

Specificity

Names multiple concrete actions (crafts over-limit depth and complexity queries, asserts rejection before execution) and three specific libraries/plugins with comprehensive coverage, matching the anchor for listing several specific concrete actions.

5 / 5

Completeness

Explicitly answers both what (crafts over-limit queries and asserts rejection before execution, verifying enforcement) and when (a clear 'Use when...' clause with three concrete trigger scenarios).

5 / 5

Trigger Term Quality

Includes natural phrases users would say ('auditing a GraphQL service for DoS', 'schema-disclosure exposure', 'hardening a production deployment', 'adding tests that prove the limits in CI') with good synonym coverage.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (GraphQL depth/complexity DoS testing) and is scoped to avoid overlap with sibling skills, giving minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents