domains / families / security / sast-graphql

sast-graphql

authentic

Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to find GraphQL injection, unsafe GraphQL document construction, or operation string injection bugs.

When to use

• find GraphQL injection
• unsafe GraphQL document construction
• operation string injection bugs
• confirm GraphQL usage
• find unsafe operation document assembly sites
• trace user input to assembly sites
• consolidate batch results

When not to use

• SQL injection in resolvers
• NoSQL / command injection in resolvers
• IDOR via GraphQL arguments
• Normal variable binding
• Introspection / field suggestion enabled
• Query depth / complexity DoS

Skill page

Source