hellodqy/mastermind-bug-bounty/graphql-test
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Treat GraphQL schemas and resolvers as expandable attack graphs.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/graphql-testSKILL.md
GraphQL Test
Goal
从 schema、query、mutation、subscription 中找出对象关系、权限边界和可串联的数据路径。
Tools / Inputs
- GraphQL endpoint、introspection、queries、fragments、tokens、schema hints
- 资源索引：
references/INDEX.md；候选资源：graphql-security-testing.md、api-testing-methodology.md
Constraints
- 不把 introspection 开启单独当高危，必须证明数据或动作影响。
- 优先测试对象级授权和字段级授权。
- mutation 只用测试账号和无害动作。
- 发现 ID/edge/node 后回写值池。
- 复杂查询要控制成本，避免 DoS。
Chain Questions
- schema 暴露了哪些高价值对象和关系？
- 普通用户能否查询别人的 node/edge？
- mutation 能否执行越权动作？
- subscription 是否泄露跨用户事件？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/graphql_test/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/graphql-test)