How does this skill help in securing APIs?

The skill provides automated tools to find the exact depth at which an API becomes unresponsive, allowing developers to set informed safety limits using libraries like graphql-depth-limit.

What is a GraphQL depth limit attack?

It is a type of Denial-of-Service attack where a client sends a deeply nested query that exploits circular relationships in a schema, forcing the server to exhaust CPU and memory resources.

Can I use this for automated CI/CD security testing?

The included Python script can be integrated into security pipelines to verify that GraphQL depth limits are properly enforced across different environments.

Does this support testing for alias amplification?

Yes, it includes techniques to test alias-based amplification, where a single query uses multiple aliases to bypass traditional per-query complexity checks.

GraphQL Depth Limit Security Testing

Name: GraphQL Depth Limit Security Testing
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Tests GraphQL APIs for resource exhaustion vulnerabilities by executing and analyzing deeply nested recursive queries.

This skill enables Claude to identify and simulate GraphQL depth limit attacks, a critical Denial-of-Service (DoS) vector targeting GraphQL endpoints. It provides comprehensive methodologies for testing how servers handle recursive relationships, alias-based amplification, and complex fragment spreads. Designed for security researchers and developers, the skill includes automated Python scripts for progressive testing and actionable mitigation strategies to secure APIs against resource exhaustion and performance degradation.

主要功能

01Simulates recursive query attacks to identify circular schema vulnerabilities

02Measures server response time and resource handling under load

034,121 GitHub stars

04Automated depth limit testing using customizable Python scripts

05Tests alias-based and fragment-spread query amplification

06Provides implementation patterns for depth limiting and complexity analysis

使用场景

01Debugging server-side performance issues caused by complex client queries

02Conducting security audits and penetration tests on GraphQL endpoints

03Validating the effectiveness of API rate limits and depth-control middleware

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills performing-graphql-depth-limit-attack

For use in Claude.ai and ChatGPT

主要功能

01Simulates recursive query attacks to identify circular schema vulnerabilities

02Measures server response time and resource handling under load

034,121 GitHub stars

04Automated depth limit testing using customizable Python scripts

05Tests alias-based and fragment-spread query amplification

06Provides implementation patterns for depth limiting and complexity analysis

使用场景

01Debugging server-side performance issues caused by complex client queries

02Conducting security audits and penetration tests on GraphQL endpoints

03Validating the effectiveness of API rate limits and depth-control middleware

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills performing-graphql-depth-limit-attack

For use in Claude.ai and ChatGPT