GraphQL Security Assessment (offensive-graphql)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

GraphQL API security assessment covering schema introspection exposure, query depth and complexity DoS, alias/batching rate-limit bypass, field-level authorization enforcement, and resolver injection checks. Use when auditing Apollo, Hasura, Yoga, or custom GraphQL servers.

Operational Workflow