performing-graphql-introspection-attack

SUSPICIOUS/HIGH-RISK skill. The content is internally consistent with its stated purpose, but that purpose is to equip an AI agent with offensive GraphQL attack techniques, including schema extraction, brute-force-style batching, auth bypass testing, and DoS-style query abuse. No clear malware or credential-harvesting behavior is present, and data flows go directly to the target endpoint rather than an unrelated third party, but the autonomous offensive security capability makes the skill high risk.

The fragment is an incomplete GraphQL security-testing script and cannot run because INTROSPECTION_QUERY lacks a value. If corrected, it performs active schema reconnaissance and depth-limit probing against arbitrary user-supplied URLs, optionally using a supplied Authorization header. This presents moderate dual-use security risk and potential abuse/resource-exhaustion risk, but there is no clear evidence of malware, stealth, persistence, credential theft, or covert data exfiltration.