graphql-complexity-limit-tester

Overview

The introspection attack-surface catalog (references/introspection.md) names query-depth limiting and query-cost limiting as key DoS mitigations, but nothing in that catalog executes a test. This skill closes that gap: it authors tests that send an over-limit query and assert a validation error is returned before any resolver runs. The strongest request-layer mitigation - persisted-query allowlisting - is cataloged in references/persisted-queries.md.

Three library families are covered: