graphql-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes command templates that embed secrets verbatim (e.g., Authorization: Bearer $USER_TOKEN, x-hasura-admin-secret, and plaintext passwords in mutations), which requires the LLM to insert actual secret values into generated curl/requests.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document explicitly instructs offensive techniques — full schema introspection, querying with bearer tokens to retrieve other users' emails/secret fields, probing for admin secrets, SSRF/file-upload abuse, batching/alias methods, and fragment/circular queries for DoS — all of which enable deliberate data exfiltration, credential harvesting, authorization bypass, and resource exhaustion when used against targets.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s required runtime workflow performs GraphQL endpoint discovery and schema/introspection via tools like ffuf/curl against a target-provided /graphql URL, and the LLM context can include the returned response text (e.g., error messages, schema JSON) which is outsider-authored content from the target system.