What problem does it solve? GraphQL APIs with circular schema relationships can be abused through deeply nested or amplified queries that exhaust server CPU, memory, and database connections, causing denial of service. This Skill helps authorized security testers determine whether a GraphQL endpoint enforces depth limits, complexity analysis, and batch restrictions before attackers find the gap. ## Core Features & Use Cases - Depth Limit Probing: Sends progressively deeper nested queries (up to a configurable maximum) and reports the exact depth at which the server blocks requests, with severity classification. - Multiple Attack Vectors: Tests recursive depth attacks, alias-based amplification, fragment spread attacks, field duplication, circular reference queries, and batch query bypasses. - Resource Exhaustion Detection: Measures response latency on wide-plus-deep queries to flag slow responses indicating resource exhaustion risk. - Use Case: During an authorized API security assessment, run the depth test against a staging GraphQL endpoint to confirm whether the server rejects queries deeper than the intended limit, then document findings with severity ratings for the remediation report. ## Quick Start Ask the agent to run the depth limit test against your authorized GraphQL endpoint, for example by requesting a depth probe of https://your-staging-api.example.com/graphql with a maximum depth of 20.
