testland/hasura-tests
Wraps Hasura GraphQL Engine testing patterns: docker-compose test instance, the metadata API for declarative schema/permission setup, x-hasura-role and x-hasura-user-id session headers for role-based permission tests, the v1/graphql endpoint via curl/HTTPie/native HTTP clients, and the role-by-table-by-operation permission-matrix pattern. Use for a metadata-driven Hasura engine where row-level permissions dominate; for a code-first server runtime harness use graphql-yoga-tests (Mercurius in its references) or apollo-server-tests instead, not this skill.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill embeds hardcoded secrets (e.g., admin and DB passwords) and shows curl/CLI/test examples that include those secrets verbatim, so an LLM following the skill would need to handle/output secret values directly.
Where we found it
[REDACTED]
secret · 15 sites
The hardcoded Hasura admin secret "[REDACTED]" is used verbatim in curl -H headers, hasura CLI --admin-secret arguments, and Python test code headers — all visible command-line / output sites an LLM would reproduce.
- Audited
- Security analysis