Skip to content
Get packs

Offensive GraphQL Testing

Guides an agent through attacking GraphQL APIs during authorised pentests and bug bounties.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a structured playbook for security testing GraphQL APIs, covering discovery, schema reconstruction, authorization bypass, injection, batching abuse, denial-of-service checks, subscriptions and file uploads. With it installed, the agent can walk through each phase with concrete queries and suggest tools such as graphql-cop, InQL, clairvoyance and BatchQL. It is a methodology for attackers and defenders, not a tool that runs attacks by itself.

Great for

  • Penetration testers assessing a GraphQL API under a signed scope
  • Bug bounty hunters working on programs that allow GraphQL testing
  • Security students learning how GraphQL misconfigurations are found and exploited

Skip it if

  • Testing systems you do not own or have written permission to assess, since the content describes active exploitation and could cause harm or illegal access
  • Developers looking for a hardening checklist only, because the skill is written from an attacker's perspective

Try asking

  • “Enumerate the GraphQL schema of my staging API with introspection and clairvoyance and list sensitive types”
  • “Test this GraphQL endpoint for IDOR through Relay node IDs using my two test accounts”
  • “Check whether batching lets me brute force the OTP field on our authorised test server”
  • “Run a graphql-cop audit on the target and summarise the findings by severity”
Step-by-step guide: how to use Offensive GraphQL TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-graphql.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-graphql.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-graphql.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the skill at systems covered by written authorisation, and state the scope to the agent up front
  • Give the agent low-privilege and cross-user test tokens so it can check authorization properly
  • Ask the agent to report findings with reproduction steps and to avoid destructive DoS payloads on live targets

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.