# Design Scalable GraphQL Systems

Complex GraphQL systems can suffer from fragile schemas, slow resolvers, and inconsistent security. This skill provides guidance for federation, caching, authorization, testing, and safe evolution.

## Install

```bash
npx skillstore add sickn33/graphql-architect
```

## Metadata

- Status: approved
- Slug: sickn33-graphql-architect
- Skillstore revision: r2
- Version status: missing
- Tree hash: b21094959cbacb5c3cb090057b7c2c1fdcb531c435815d008749fa62da5d075f
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/graphql-architect
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-graphql-architect
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-graphql-architect/manifest

## Capabilities

- Designs GraphQL schemas using interfaces, unions, connections, custom scalars, and evolution strategies.
- Plans Apollo Federation v2 subgraphs, composition, gateways, registries, and cross-team governance.
- Recommends DataLoader, batching, caching, persisted queries, complexity limits, and resolver tracing.
- Defines JWT, RBAC, field authorization, rate limits, input validation, CORS, and production hardening.
- Plans subscriptions with filtering, authorization, and scalable event infrastructure.
- Creates testing, monitoring, migration, and backward-compatibility strategies for GraphQL services.

## Use Cases

- Model a New API: Turn domain entities and workflows into an evolvable GraphQL schema with clear resolver responsibilities.
- Plan Federated Services: Define subgraph boundaries, entity ownership, composition checks, and governance for distributed teams.
- Harden Production Queries: Review authorization, query costs, caching, tracing, and load-testing controls for a high-traffic service.

## Prompt Templates

### Draft a Schema

```
Review these entities and relationships: [details]. Propose a GraphQL schema structure, explain key type choices, and identify missing requirements.
```

### Improve Query Performance

```
Assess this schema and resolver behavior: [details]. Find N+1 risks, propose DataLoader boundaries, and recommend caching and complexity controls.
```

### Design Federation

```
Design Apollo Federation v2 subgraphs for [domain]. Define ownership, entity boundaries, composition risks, governance, deployment sequencing, and backward-compatible evolution.
```

### Plan Production Architecture

```
Create a production architecture for [workload]. Address federation, subscriptions, authorization, caching, observability, failure modes, load testing, and phased REST migration.
```

## Limitations

- Provides guidance and designs but does not deploy, execute, or benchmark a GraphQL service.
- Requires project-specific schemas, traffic data, authorization rules, and infrastructure constraints for precise recommendations.
- Does not replace security testing, load testing, or review by engineers familiar with the production environment.
- References a detailed implementation playbook that is not included in this package.

## Best Practices

- Provide domain relationships, expected traffic, client needs, and current infrastructure before requesting an architecture.
- Validate recommendations with schema checks, resolver tests, traces, security tests, and representative load tests.
- Evolve schemas through additive changes, measured deprecations, usage analytics, and documented ownership.

## Anti Patterns

- Do not expose database models directly without domain boundaries, authorization rules, and client-focused schema design.
- Do not rely on caching alone to hide N\+1 queries or inefficient resolver behavior.
- Do not deploy unrestricted queries without depth, cost, rate, and authorization controls.

## Security Audit

- Audited at: 2026-07-23T23:08:24.239\+00:00
- Summary: Both static findings are false positives. SKILL.md line 24 uses Markdown backticks for a referenced path, and line 101 describes API gateway integration without executing commands or performing reconnaissance. No prompt injection, exfiltration intent, or other semantic security issue was found.

## Stats

- Views: 94
- Downloads: 8
- Favorites: 0
- Popularity score: 0