Name: graphql-and-hidden-parameters
Author: yaklang

Imported from yaklang/hack-skills (skills/graphql-and-hidden-parameters/SKILL.md) via skills.sh. Install upstream with npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters. Copyright stays with the author.

SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields

AI LOAD INSTRUCTION: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.

1. GRAPHQL FIRST PASS

query { __typename }
query {
  __schema {
    types { name }
  }
}

If introspection is restricted, continue with:

field suggestions and error-based discovery
known type probes like __type(name: "User")
JS and mobile bundle route extraction

2. HIGH-VALUE GRAPHQL TESTS

Theme	Example
IDOR	`user(id: "victim")`
batching	array of login or object fetch operations
hidden fields	admin-only fields exposed in type definitions
nested authz gaps	related object fields with weaker checks

3. HIDDEN PARAMETER DISCOVERY

Look for:

fields present in admin docs but not public docs
additionalProperties or permissive schemas
frontend code using richer request bodies than visible UI controls
mobile endpoints carrying role, org, feature-flag, or internal filter fields

4. NEXT ROUTING

If hidden fields affect privilege: api authorization and bola
If GraphQL batching changes auth or rate behavior: api auth and jwt abuse
If endpoint discovery is incomplete: api recon and docs

Install graphql-and-hidden-parameters and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "yaklang-hack-skills-graphql-and-hidden-parameters", "kind": "skill", "name": "graphql-and-hidden-parameters", "description": "GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.", "publisher": "yaklang", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/yaklang/hack-skills", "path": "skills/graphql-and-hidden-parameters/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/yaklang/hack-skills/graphql-and-hidden-parameters", "key": "yaklang/hack-skills/skills/graphql-and-hidden-parameters/SKILL.md" } }, "instructions": "# SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields\n\n> **AI LOAD INSTRUCTION**: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.\n\n## 1. GRAPHQL FIRST PASS\n\n```graphql\nquery { __typename }\nquery {\n __schema {\n types { name }\n }\n}\n```\n\nIf introspection is restricted, continue with:\n\n- field suggestions and error-based discovery\n- known type probes like `__type(name: \"User\")`\n- JS and mobile bundle rou", "cost": { "context_tokens": 380 } }

graphql-and-hidden-parameters

About

SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields

1. GRAPHQL FIRST PASS

2. HIGH-VALUE GRAPHQL TESTS

3. HIDDEN PARAMETER DISCOVERY

4. NEXT ROUTING

Install graphql-and-hidden-parameters and it becomes one more candidate the router can pick - when it fits.

Use it

Manifest

Reviews