Graphql And Hidden Parameters
- 2.3k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
graphql-and-hidden-parameters is an agent skill that tests GraphQL introspection, batching, hidden fields, and schema authorization gaps.
About
The graphql-and-hidden-parameters skill focuses on schema discovery, hidden parameter abuse, and batching as a force multiplier when GraphQL exists or REST docs hint at optional deprecated fields. First pass runs __typename and __schema types queries, then error-based discovery, __type probes, and JS or mobile bundle route extraction when introspection is restricted. High-value tests cover IDOR user queries, login batching arrays, admin-only fields in type definitions, and nested authz gaps on related objects. Hidden parameter discovery hunts admin-only docs fields, additionalProperties schemas, richer frontend request bodies, and mobile role org or feature-flag filters. Next routing links api-authorization-and-bola for privilege fields, api-auth-and-jwt-abuse for batching auth changes, and api-recon-and-docs for incomplete endpoint discovery. Use when exploring GraphQL introspection, batching, undocumented fields, schema abuse, or GraphQL authorization gaps. The workflow follows the source SKILL.md contract with progressive reference loading, clear trigger phrases, and practical steps developers can apply directly in agent sessions.
- GraphQL first pass: __typename, __schema, and restricted introspection fallbacks.
- High-value tests: IDOR queries, batching, hidden admin fields, nested authz gaps.
- Hidden parameter discovery in admin docs, schemas, frontend, and mobile clients.
- Routes to api authorization, JWT abuse, and API recon skills.
- Batching treated as force multiplier for auth and rate behavior changes.
Graphql And Hidden Parameters by the numbers
- 2,294 all-time installs (skills.sh)
- +135 installs in the week ending Aug 4, 2026 (Skillselion tracking)
- Ranked #224 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: MEDIUM risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
graphql-and-hidden-parameters capabilities & compatibility
- Capabilities
- introspection and error based schema discovery · idor and batching test patterns · hidden parameter hunting in clients · nested authorization gap detection · cross skill routing to auth and recon
- Use cases
- security audit · api development · testing
What graphql-and-hidden-parameters says it does
GraphQL and hidden parameter testing playbook.
Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.
npx skills add https://github.com/yaklang/hack-skills --skill graphql-and-hidden-parametersAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.3k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 1 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
How do I discover undocumented GraphQL fields and test batching or IDOR on hidden parameters?
Test GraphQL introspection, batching, hidden fields, undocumented parameters, and authorization gaps in schemas and mobile or admin API surfaces.
Who is it for?
Security engineers and developers auditing GraphQL APIs and rich mobile or admin request bodies.
Skip if: Skip for pure REST APIs with no GraphQL or hidden schema fields evident.
When should I use this skill?
Use when exploring GraphQL introspection, batching, undocumented fields, or GraphQL authorization gaps.
What you get
GraphQL test themes with introspection paths, hidden field targets, and linked authorization routes.
- introspection recon results
- hidden parameter test cases
- authorization gap findings
Files
SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields
AI LOAD INSTRUCTION: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.
1. GRAPHQL FIRST PASS
query { __typename }
query {
__schema {
types { name }
}
}If introspection is restricted, continue with:
- field suggestions and error-based discovery
- known type probes like
__type(name: "User") - JS and mobile bundle route extraction
2. HIGH-VALUE GRAPHQL TESTS
| Theme | Example |
|---|---|
| IDOR | user(id: "victim") |
| batching | array of login or object fetch operations |
| hidden fields | admin-only fields exposed in type definitions |
| nested authz gaps | related object fields with weaker checks |
3. HIDDEN PARAMETER DISCOVERY
Look for:
- fields present in admin docs but not public docs
additionalPropertiesor permissive schemas- frontend code using richer request bodies than visible UI controls
- mobile endpoints carrying role, org, feature-flag, or internal filter fields
4. NEXT ROUTING
- If hidden fields affect privilege: api authorization and bola
- If GraphQL batching changes auth or rate behavior: api auth and jwt abuse
- If endpoint discovery is incomplete: api recon and docs
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Pick graphql-and-hidden-parameters for GraphQL-specific recon and auth testing rather than the file-access-vuln router for upload endpoints.
FAQ
Who is graphql-and-hidden-parameters for?
Security engineers and developers auditing GraphQL APIs and rich mobile or admin request bodies.
When should I use graphql-and-hidden-parameters?
When exploring GraphQL introspection, batching, undocumented fields, or GraphQL authorization gaps.
Is graphql-and-hidden-parameters safe to install?
Review the Security Audits panel on this page before installing in production.