graphql-and-hidden-parameters
starsforks
How to install graphql-and-hidden-parameters?
prohao42/aimy-skill/graphql-and-hidden-parameters
$npx -y skills add Prohao42/aimy-skill --skill graphql-and-hidden-parameters--- name: graphql-and-hidden-parameters description: >- GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps. ---
SKILL.md
| 1 | # SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier. |
| 4 | |
| 5 | ## 1. GRAPHQL FIRST PASS |
| 6 | |
| 7 | ```graphql |
| 8 | query { __typename } |
| 9 | query { |
| 10 | __schema { |
| 11 | types { name } |
| 12 | } |
| 13 | } |
| 14 | ``` |
| 15 | |
| 16 | If introspection is restricted, continue with: |
| 17 | |
| 18 | - field suggestions and error-based discovery |
| 19 | - known type probes like `__type(name: "User")` |
| 20 | - JS and mobile bundle route extraction |
| 21 | |
| 22 | ## 2. HIGH-VALUE GRAPHQL TESTS |
| 23 | |
| 24 | | Theme | Example | |
| 25 | |---|---| |
| 26 | | IDOR | `user(id: "victim")` | |
| 27 | | batching | array of login or object fetch operations | |
| 28 | | hidden fields | admin-only fields exposed in type definitions | |
| 29 | | nested authz gaps | related object fields with weaker checks | |
| 30 | |
| 31 | ## 3. HIDDEN PARAMETER DISCOVERY |
| 32 | |
| 33 | Look for: |
| 34 | |
| 35 | - fields present in admin docs but not public docs |
| 36 | - `additionalProperties` or permissive schemas |
| 37 | - frontend code using richer request bodies than visible UI controls |
| 38 | - mobile endpoints carrying role, org, feature-flag, or internal filter fields |
| 39 | |
| 40 | ## 4. NEXT ROUTING |
| 41 | |
| 42 | - If hidden fields affect privilege: [api authorization and bola](../api-authorization-and-bola/SKILL.md) |
| 43 | - If GraphQL batching changes auth or rate behavior: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md) |
| 44 | - If endpoint discovery is incomplete: [api recon and docs](../api-recon-and-docs/SKILL.md) |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
