offensive-graphql
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references multiple third-party security tools hosted on GitHub, such as InQL, graphql-cop, CrackQL, and clairvoyance. These are well-known utilities in the security research community.
- [COMMAND_EXECUTION]: Includes example command-line instructions using
curlandpython3for probing GraphQL endpoints. These commands are provided for educational purposes to demonstrate how to identify misconfigurations like enabled introspection or verbose errors. - [DATA_EXFILTRATION]: Discusses testing for Server-Side Request Forgery (SSRF) and provides examples using the cloud metadata service IP (169.254.169.254). This is described as a vulnerability to look for during an audit, not an attempt to exfiltrate data from the user's environment.
- [OBFUSCATION]: Uses Base64-encoded strings as examples for Relay node IDs (e.g., 'VXNlcjoxMjM=') and pagination cursors. These are standard representations in the GraphQL Relay specification and are used here for pedagogical purposes.
Audit Metadata