graphql

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly tells the tester to "capture the GraphQL endpoint's Authorization header" and demonstrates embedding an Authorization bearer token (A_TOKEN) and other sensitive fields (apiKeys, stripeSecretKey, jwtSecret) verbatim in PoC requests, which requires the LLM/agent to handle and output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a high-risk offensive guide describing explicit techniques for data exfiltration, credential theft, privilege escalation, rate-limit bypassing, CSRF/DoS, and schema brute-forcing that enable deliberate abuse of GraphQL endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow in SKILL.md relies on runtime HTTP interactions (e.g., curl/graphw00f/InQL) with a target GraphQL endpoint, where the LLM would ingest the returned schema/response text (outsider-authored free text from the remote server) into its context for analysis.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the operator to git-clone and run remote tools (executing fetched code) such as https://github.com/nikitastupin/clairvoyance and https://github.com/dolevf/graphql-cop, so those URLs are runtime external dependencies that lead to executing remote code.