npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Protects against GraphQL-specific attack vectors: unbounded query depth that causes
Performs GraphQL introspection attacks to extract full API schemas, map attack surfaces, identify sensitive fields/mutations, test query depth/complexity limits, and exploit batching/alias/nested DoS vulnerabilities. For GraphQL security testing.
Performs GraphQL introspection to extract schemas, map attack surfaces, test depth limits, and exploit batching/alias/nested query vulnerabilities in GraphQL endpoints.
Assesses GraphQL API endpoints for introspection leaks, injection attacks, authorization defects, and DoS vulnerabilities during authorized pentests.
Share bugs, ideas, or general feedback.
Protects against GraphQL-specific attack vectors: unbounded query depth that causes exponential resolver execution, introspection left enabled in production (exposing the full schema to attackers), and batch/alias attacks that bypass rate limiting.
ApolloServer({ schema }) — no depth limit, no cost analysis, introspection on by default{ user { posts { comments { author { posts { ... } } } } } }{ a1: login(p:"x") a2: login(p:"y") ... a1000: login(p:"z") }introspection: true in production — full schema exposed to attackersFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
a1: … a1000: …) bypasses per-request rate limits
unless this is enforced.a1: login … a1000: login counts as 1000 attempts.Anchor — shape, not implementation:
server = new GraphQLServer(
schema,
introspection = env != "production",
validation = [depthLimit(5), costAnalysis(max=1000)],
rate_limit = per_operation("login", 5/min),
)