graphql-audit From the maker
awarexone/Agentic-Bug-HunterSkill
GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.
Why this score
This repo hosts 10 skills, so its 5,379 stars are split between them (about 538 each) for scoring.
Popularity score: 77/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 20, 2026 at commit 40b03eeea639, with Cisco's open-source skill-scanner.
None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Other makers' add-ons that do the same job, next to this one.
| Name | Score | Stars | Context | Updated |
|---|---|---|---|---|
| This onegraphql-audit awarexone/Agentic-Bug-Hunter · Skill | 77 | ★ 5.4k | ≈95 always | 26d ago |
| attack-graphql CyberStrikeus/CyberStrike · Skill Same job: backend & apis | 71 | ★ 3.2k | ≈30 always | 21d ago |
| sast-graphql utkusen/sast-skills · Skill Same job: backend & apis | 53 | ★ 1.3k | ≈22 always | 7mo ago |
| apollo-graphql Mindrally/skills · Skill Same job: backend & apis | 63 | ★ 278 | ≈36 always | 27d ago |
| data-client-graphql-setup reactive/data-client · Skill Same job: backend & apis | 70 | ★ 2.0k | ≈45 always | 16d ago |
| graphql-security-specialist davila7/claude-code-templates · Subagent Same job: backend & apis | 80 | ★ 33k | ≈55 in chat | 16d ago |