Skill

performing-graphql-introspection-attack

skill:mukul975/anthropic-cybersecurity-skills#performing-graphql-introspection-attack

Performs GraphQL introspection attacks that extract the full API schema (types, queries, mutations, subscriptions, field definitions), map the attack surface, test query depth/complexity limits, and exploit GraphQL-specific weaknesses such as batching attacks, alias-based brute force, and nested query DoS. Use for GraphQL security testing, schema enumeration, or GraphQL API penetration testing.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:36 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

82/82

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-graphql-introspection-attack:skills/performing-graphql-introspection-attack/SKILL.md:411:DESTRUCT

Security findings 1

Destructive action

highContextual risklow confidence

SKILL.md instructs the agent to send a destructive deleteUser mutation to the target GraphQL endpoint during field-level authorization testing, which deletes data on the target if the endpoint accepts the mutation.

skills/performing-graphql-introspection-attack/SKILL.md:411

mutation { deleteUser(id:

vector:instruction

Counter-argument considered

Executing a destructive deleteUser mutation deletes real data on the target when authorization is broken; the declared capability set covers schema extraction, depth/complexity, and batching/DoS probing only, and field-level authorization is declared solely as an access-control concept, so no carve-out neutralizes this and the source-to-sink chain posts the mutation live to GRAPHQL_URL.

Open questions 1

What the analysis could not settle from the code alone.

Residue items R3/R4 (file_write '[--auth-header' and '[--max-depth' at references/api-reference.md lines 20-21) could not be adjudicated as necessary/unexplained/concealed because the cited lines contain only bash CLI usage documentation where square brackets denote optional arguments (python agent.py introspect --url <graphql_endpoint> [--auth-header ...]); no file-write capability exists in the unit, so the detector leads are unconfirmed.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Destructive action

criticalRefutedlow confidence

SKILL.md instructs the agent to send denial-of-service and resource-exhaustion probes to the target GraphQL endpoint, including a depth-20 nested query, a 500-alias wide query, a 300-query batch, and a circular fragment, which can exhaust target resources.

skills/performing-graphql-introspection-attack/SKILL.md:344

# Attack 2: Query depth attack (DoS)

Why it was refuted

The depth-20 query, wide query, 300-query batch, and circular fragment are exactly the skill's declared core capability ('nested query DoS', 'batching attacks', 'test query depth/complexity limits') and are declared as capability claim D2, so the harm gate fails on the declared-core-capability carve-out and the behavior is declared, not undeclared.