graphql-security
Detects GraphQL schemas without depth limits, cost analysis, or introspection controls. Use when writing GraphQL schemas, resolvers, or server configuration. Also invoke when setting up Apollo Server, graphql-yoga, Strawberry, gqlgen, or any GraphQL framework without explicit depth limiting, cost analysis, or introspection controls.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/graphql-security" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/graphql-security ~/.claude/skills/graphql-securityFrom README
GraphQL Security Check (CWE-400) What this checks Protects against GraphQL-specific attack vectors: unbounded query depth that causes exponential resolver execution, introspection left enabled in production (exposing the full schema to attackers), and batch/alias attacks that bypass rate limiting. Vulnerable patterns GraphQL server constructed with no depth-limit or cost-analysis validation rule Deeply nested query allowed because no maximum-depth rule rejects it before resolver execution Alias batching that repeats a credential-accepting field many times in one request, bypassing per-HTTP-request rate limits Introspection left enabled in production, exposing the full schema to unauthenticated callers Fix immediately Flag the vulnerable code and explain the risk. Translate the principles below to the language and framework of the audited file — use that stack's documented validation rule, plugin, or middleware API; do not roll your own.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...