One introspection: true left in your Apollo Server options hands the whole production schema, admin mutations included, to anyone who asks. One passwordHash field on type User lets any client read it through post.author or any other path to that type. This skill finds those and seven other GraphQL mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your .graphql, .gql and .graphqls schema files, schema text inside code (gql tags, #graphql strings, typeDefs, Ariadne gql), and the server code of Apollo Server 2 to 5, NestJS GraphQL, GraphQL Yoga, Mercurius, express-graphql, graphql-http, TypeGraphQL, Strawberry, graphene and graphene-django, Ariadne and gqlgen. It tells output types from input types, knows each library's defaults (Apollo turns introspection off when NODE_ENV is production; Yoga and Strawberry serve GraphiQL unless told not to; gqlgen's starter server.go turns introspection on), accepts settings behind a check that keeps them out of production (NODE_ENV !== 'production', isDev ternaries, if settings.DEBUG) but not checks such as NODE_ENV !== 'test', and looks across all scanned files before it says a depth limit or an introspection switch is missing. Login payloads such as AuthPayload.token, links such as token: Token, paging tokens such as nextToken, and key fields behind an auth directive, guard or permission class are left alone. It never runs your server or app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• G01: introspection forced on with no check that keeps it out of production (introspection: true in Apollo Server or NestJS, introspection=True in Ariadne)

• G02: passwords, password hashes, SSNs, card numbers, and secrets, tokens and API keys held as text on output types (SDL, Strawberry, graphene, NestJS and TypeGraphQL @ObjectType classes, graphene-django or strawberry-django User types with all fields)

REVIEW (check before release)

• G11: servers with no query depth or cost limit anywhere in the project

• G12: introspection left on by default (Yoga, Mercurius, express-graphql, graphql-http, Strawberry, graphene, Ariadne, gqlgen NewDefaultServer and the extension.Introspection line gqlgen init writes)

• G13: GraphiQL, GraphQL Playground or Apollo Sandbox served in production

• G14: csrfPrevention: false, or a Django GraphQL view wrapped in csrf_exempt

• G15: stack traces and raw errors sent to clients (includeStacktraceInErrorResponses, debug, maskedErrors: false, formatError with error.stack)

• G16: root query lists without first, limit, page or cursor arguments

• G17: batched requests without a limit (allowBatchedHttpRequests, Apollo Server 3 defaults, allowBatchedQueries, graphene-django batch=True)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (an Apollo Server 4 shop API with its schema and resolvers, and a Strawberry reports service), and the real report the scanner produces on the risky one

Limits

It reads file text. Server options built in another file and passed in as a variable, schemas built at run time, permission checks inside resolvers, and gateway or router settings (Apollo Router, Hasura, PostGraphile) are not followed. An environment check is recognised around the setting itself, not an early return or a feature flag. Rate limiting, authentication, persisted operations, CORS and dependency vulnerabilities are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 20 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (11 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.