graphql-audit
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of several well-known security tools (clairvoyance, graphw00f, graphql-cop, gqlmap) via pip, and wscat via npm. These tools are standard for GraphQL schema discovery, fingerprinting, and vulnerability scanning.
- [COMMAND_EXECUTION]: The instructions utilize system commands including curl, bash, and python3 to perform network requests and automate testing against GraphQL endpoints. These commands are configured to interact with a user-provided target URL.
- [DYNAMIC_EXECUTION]: The skill includes Python snippets that generate dynamic payloads for testing GraphQL-specific vulnerabilities like query batching and alias bombs. This involves programmatic construction of complex JSON structures at runtime.
- [SAFE]: No malicious patterns, prompt injections, or unauthorized data exfiltration attempts were detected. The skill's functionality is transparent and strictly aligned with its stated purpose as a security auditing tool.
Audit Metadata