# Build Secure GraphQL APIs

GraphQL systems can suffer from inefficient resolvers, unsafe query flexibility, and inconsistent schemas. This skill provides patterns for schemas, clients, performance, authorization, and production safeguards.

## Install

```bash
npx skillstore add sickn33/graphql
```

## Metadata

- Status: approved
- Slug: sickn33-graphql
- Skillstore revision: r2
- Version status: missing
- Tree hash: b58823a62fd99bd39d27c9e2dad91f96f3315392c21dc20fcd9fec182992f799
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/graphql
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-graphql
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-graphql/manifest

## Capabilities

- Designs typed schemas with intentional nullability, inputs, payloads, unions, pagination, and relationships.
- Creates resolver patterns with request-scoped DataLoader batching to reduce repeated database queries.
- Configures Apollo Client caching, fragments, queries, mutations, and cache updates.
- Guides GraphQL Code Generator setup for typed TypeScript operations and React hooks.
- Applies query depth, complexity, authorization, introspection, and persisted-query safeguards.
- Explains subscription setup, cleanup, filtering, and resource tracking.

## Use Cases

- Design a New API: Create a typed schema with clear nullability, pagination, mutation payloads, and expected error unions.
- Improve Resolver Performance: Identify N\+1 behavior and introduce request-scoped DataLoader instances with correctly ordered results.
- Integrate a Typed Client: Configure client caching and generate typed operations for a TypeScript application.

## Prompt Templates

### Draft a Schema

```
Design a GraphQL schema for [domain] with queries, mutations, pagination, intentional nullability, and expected error types.
```

### Fix N\+1 Queries

```
Review these resolvers for N+1 queries and propose request-scoped DataLoader implementations that preserve result order: [resolvers].
```

### Secure a GraphQL Server

```
Audit this GraphQL server for authorization, introspection, query depth, complexity, rate limits, and sensitive field exposure: [configuration].
```

### Plan a Federated Migration

```
Create a staged migration from [current architecture] to GraphQL federation, including ownership, entity boundaries, compatibility, observability, and rollback.
```

## Limitations

- It does not implement database queries, authentication systems, or WebSocket infrastructure without project context.
- Examples require adaptation to the selected GraphQL server, client, database, and framework versions.
- It does not replace load testing, authorization testing, or production monitoring.
- The subscription example needs verified identity and room authorization before production use.

## Best Practices

- Treat the schema as a versioned contract and design nullability intentionally.
- Create DataLoader instances per request to prevent cross-user cache leakage.
- Enforce authorization at resolver and sensitive-field boundaries.

## Anti Patterns

- Do not expose unbounded nested queries or large list fields.
- Do not rely only on schema directives for complex authorization.
- Do not trust subscription identity values supplied directly by clients.

## Security Audit

- Audited at: 2026-07-24T00:53:32.568\+00:00
- Summary: All 40 static alerts are false positives caused by GraphQL templates, JavaScript interpolation, development configuration, and ordinary identifier checks. However, the subscription example trusts a client-supplied identity and lacks room authorization, which can expose events if copied into production.

## Stats

- Views: 95
- Downloads: 9
- Favorites: 0
- Popularity score: 0