CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/graphql-complexity-limit-tester

Crafts over-limit depth and complexity queries then asserts rejection before execution, verifying that graphql-depth-limit, graphql-cost-analysis, and graphql-armor (max-depth / cost-limit / max-tokens plugins) are actually enforced and not just configured. Use when auditing a GraphQL service for DoS exposure after depth or cost limits have been added as mitigations, or when adding tests that prove the limits in CI before a production deployment.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill with strong validation checkpoints and clear organization. Its main weakness is verbosity from repeating the same documentation URLs and default values multiple times instead of stating them once.

Suggestions

State each library's default values and documentation URL once (e.g. in a single reference table in Step 2) and drop the inline restatements in the Overview, Step 3 comments, and References section to cut repeated tokens.

The Overview's positioning relative to 'apollo-server-tests' and 'introspection-attack-surface-reference' could be condensed to one or two sentences - the differentiation is valuable but currently spread across several paragraphs.

Consider moving the full Envelop/Yoga snippet or the per-library defaults into a reference file if the body is meant to stay a lean overview, though at present the single-file structure is acceptable.

DimensionReasoningScore

Conciseness

Mostly efficient and code-heavy without explaining basic concepts, but the same documentation URLs (max-depth, cost-limit, max-tokens) and default values are restated 3-4 times across Overview, Step 2, Step 3, code comments, and the References section, adding padding that could be tightened.

2 / 3

Actionability

Provides copy-paste-ready executable TypeScript for all three libraries plus Envelop/Yoga, concrete npm install commands, and worked over-limit query templates - nothing is left as pseudocode.

3 / 3

Workflow Clarity

Five clearly sequenced steps with a hard-stop guard when no limit is configured, and Step 5 supplies an explicit validation checkpoint (asserting the resolver is never called) to confirm enforcement happens before execution.

3 / 3

Progressive Disclosure

No bundle files are needed for this single-file skill; the body is well-organized into Overview, Hard stop, Steps 1-5, Running, Anti-patterns, Limitations, and References with one-level-deep pointers to sibling skills rather than nested references.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete actions, the target libraries and plugins, and gives two explicit 'Use when' triggers. It is specific, complete, and well-differentiated from sibling skills.

DimensionReasoningScore

Specificity

Lists multiple concrete actions - 'Crafts over-limit depth and complexity queries', 'asserts rejection before execution', and enumerates the three library families with their specific plugins (max-depth / cost-limit / max-tokens).

3 / 3

Completeness

Clearly answers both what (craft over-limit queries and assert rejection before execution across three libraries) and when via an explicit 'Use when...' clause covering two distinct trigger scenarios.

3 / 3

Trigger Term Quality

Includes natural terms a user would say - 'auditing a GraphQL service for DoS exposure', 'depth or cost limits', 'tests that prove the limits in CI before a production deployment' - covering the security-audit and CI-test phrasings.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche - GraphQL depth/complexity DoS-limit enforcement testing - and the body explicitly differentiates it from 'apollo-server-tests', so it is unlikely to trigger for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents