Why this verdict
- suspicious: finding skill:skills/performing-graphql-security-assessment:skills/performing-graphql-security-assessment/SKILL.md:106:EXFIL
Security findings 1
Data exfiltration
highContextual risklow confidenceThe skill's Step 2 instructs uploading the harvested target API schema file (schema.json) to the external third-party service graphql-kit.com, an undeclared off-host transfer of client-confidential assessment data that the declared assessment purpose does not require.
Upload schema.json to https://graphql-kit.com/graphql-voyager/
vector:instruction
Counter-argument considered
Argued both directions: Voyager visualization is common tester practice, but the skill concretely instructs sending the harvested target schema (schema.json from the introspection curl) to an external third-party sink, graphql-kit.com, which no carve-out covers and which appears in none of the declared claims (D1-D10 name other tools but never this sink), so the undeclared off-host transfer stands as a contextual risk.
Open questions 2
What the analysis could not settle from the code alone.
Frontmatter tags map the skill to MITRE T1055 (Process Injection) and T1083 (File and Directory Discovery), techniques unrelated to the declared GraphQL assessment purpose; confirm whether this is keyword stuffing to broaden retrieval into unrelated contexts.
Supply chain
SKILL.md lines 265-302 between Step 6 and the Output Format section are not shown in this request; any additional executable instructions there cannot be judged from the presented evidence.
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Destructive action
criticalRefutedmedium confidenceThe skill instructs the agent to send deep-nesting, alias-width, batch, circular-fragment, and unbounded-pagination queries (users(first: 1000000)) to the target endpoint, which can exhaust the target's resources when executed.
{ users(first: 1000000) { id email } }Why it was refuted
The queries are documented test payloads for the skill's declared core capability: the target's declared description explicitly covers 'denial-of-service vulnerabilities during authorized security tests', and Step 5's own header frames them as testing the target's controls, so the harm carve-out (declared core capability / documented attack payloads in security-education material) neutralizes the finding.
Supply chain
highRefutedlow confidenceThe skill instructs installing and running unpinned third-party security tools (graphql-cop via pip install and clairvoyance via python3 -m), fetching their code from PyPI at run time without version pinning.
pip install graphql-cop
Why it was refuted
Both tools are openly declared assessment tooling and their use is the declared core capability: clairvoyance performs schema enumeration (the declared introspection-leak assessment in SKILL.md Step 2) and graphql-cop scans the assessment target, with both tools named as declared claims (D8/D9); nothing is concealed and the package names are exact, so the undeclared and harm gates fail despite the missing version pin.
Coverage gaps 3
Parts of the artifact the static analysis could not fully examine.
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:c495d71f7a542446
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:9bf117da94612cc6
invalid_judge_finding behavior-chains.0
