技能 ask-graphql-mcp
📦
ask-graphql-mcp
内容修订 r1 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令
分析 Web3 GraphQL 端点
区块链团队需要从 SubQuery 和 SubGraph 端点快速获得答案。此技能通过 Ask GraphQL MCP 路由自然语言问题，以进行感知端点的分析。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "ask-graphql-mcp" from https://skillstore.io/skills/sn-hermes-ask-graphql-mcp.md and its manifest at https://skillstore.io/api/skills/sn-hermes-ask-graphql-mcp/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“ask-graphql-mcp”。 Analyze recent activity for this SubQuery endpoint.
预期结果:
- 说明端点假设和 MCP 连接状态。
- 总结活跃账户、交易量方向和时间窗口限制。
- 列出针对 schema 字段或分页的后续检查。
正在使用“ask-graphql-mcp”。 My GraphQL query fails on a field name.
预期结果:
- 用通俗语言解释可能的 schema 不匹配。
- 建议 MCP 返回的兼容字段替代项。
- 建议在运行完整分析前执行一个小的验证步骤。
正在使用“ask-graphql-mcp”。 Set up Ask MCP after the free quota is reached.
预期结果:
- 将付费模式识别为下一步路径。
- 描述所需的网关、端点标头和 API 密钥标头。
- 提醒用户保持密钥作用域受限，并避免共享权限过大的凭据。
安全审计
高风险v5 • 2026/7/7 打开版本化报告
Most static command-execution and system-reconnaissance alerts are Markdown false positives. The skill still routes data to an external MCP gateway and includes instructions that can expose API keys or private endpoint authorization headers. No prompt injection attempt was found in the reviewed files.
4
已扫描文件
299
分析行数
9
复核项
0
已忽略误报
已确认安全问题 (2)
高
Chat-Based API Key Collection
The skill tells the agent to ask users to create an API key and send it in chat so execution can continue. This can expose paid service credentials in conversation logs.
Multiple files require API key requests as first or high-priority guidance, including wording that asks users to send the key here.
高
SKILL.md:54-64references/config-templates.md:17-20references/config-templates.md:36-40references/tools-and-prompts.md:20-23
Forwarding Endpoint Authorization To Third-Party Gateway
The skill sends X-ENDPOINT-AUTHORIZATION through Ask MCP when upstream endpoints are private. That can disclose private endpoint bearer tokens or session credentials to the external gateway.
The reviewed files explicitly combine private endpoint authorization headers with the external Ask MCP HTTP gateway path.
能力复核项 (9)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Hardcoded URL
url: "https://ask-api.hermes-subnet.ai/mcp/graphql-agent"
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp/graphql-agent",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
"url": "https://ask-api.hermes-subnet.ai/mcp",
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
1. Default to free gateway: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
2. Use paid gateway only when needed: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
- Free: `https://ask-api.hermes-subnet.ai/mcp/graphql-agent`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
- Paid: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
- Switch user to paid gateway `https://ask-api.hermes-subnet.ai/mcp` with `X-API-KEY`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
中
Hardcoded URL
1. Paid gateway URL: `https://ask-api.hermes-subnet.ai/mcp`
The line configures a real external Ask MCP gateway. Calls can disclose user questions, endpoint URLs, and configured headers to that service.
风险因素
🌐 网络访问 (19)
agents/openai.yaml:4 agents/openai.yaml:12 references/config-templates.md:17 references/config-templates.md:19 references/config-templates.md:36 references/config-templates.md:38 SKILL.md:40 SKILL.md:52 SKILL.md:53 SKILL.md:73 SKILL.md:74 SKILL.md:94 SKILL.md:95 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:132 SKILL.md:135 SKILL.md:137
🔑 环境变量 (1)
⚙️ 外部命令 (45)
SKILL.md:18 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:32 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:73 SKILL.md:74 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:94 SKILL.md:95 SKILL.md:97 SKILL.md:101 SKILL.md:114 SKILL.md:115 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:132 SKILL.md:135 SKILL.md:136 SKILL.md:137 SKILL.md:139
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sn-hermes-ask-graphql-mcp/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sn-hermes-ask-graphql-mcp?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sn-hermes-ask-graphql-mcp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sn-hermes-ask-graphql-mcp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sn-hermes-ask-graphql-mcp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
SN-Hermes. (2026). ask-graphql-mcp security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sn-hermes-ask-graphql-mcp/audits/5BibTeX 引用
@techreport{sn-hermes-sn-hermes-ask-graphql-mcp-2026,
author = {SN-Hermes},
title = {ask-graphql-mcp security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sn-hermes-ask-graphql-mcp/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ask-graphql-mcp security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "SN-Hermes"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sn-hermes-ask-graphql-mcp/audits/5"
identifiers:
- type: other
value: "skillstore:sn-hermes-ask-graphql-mcp:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 41
架构
85
可维护性
87
内容
68
社区
91
规范符合性
你能构建什么
分析协议活动
从受支持的 GraphQL 端点请求链上指标、活跃账户、交易量趋势或质押活动。
调试端点查询
借助 MCP 辅助推理诊断 GraphQL 错误、缺失字段、schema 不匹配和分页问题。
配置 MCP 访问
为用户提供的 SubQuery 或 SubGraph 端点创建免费或付费 Ask MCP 连接指导。
试试这些提示
连接到端点
Use Ask GraphQL MCP with this endpoint: <endpoint>. Confirm connectivity and summarize what data it indexes.
检查可用数据
Inspect this endpoint with Ask GraphQL MCP and describe the main entities, useful metrics, and any schema assumptions.
调试失败的查询
Use Ask GraphQL MCP to explain this query error and suggest a compatible query shape for the endpoint schema.
设计仪表板指标
Use Ask GraphQL MCP to propose three dashboard metrics for this protocol and explain the endpoint fields needed for each metric.
最佳实践
- 尽可能使用公共端点或作用域严格受限的端点令牌。
- 先从免费模式开始，仅在配额限制后或用户明确请求时切换到付费模式。
- 在共享日志、错误或配置片段前移除或遮蔽密钥。
避免
- 不要使用权限过大的生产凭据进行端点授权。
- 不要将此技能用于非 Web3 问题或通用数据库工作。
- 除非用户请求，否则不要绕过 Ask MCP 直接执行 GraphQL。
常见问题
此技能支持哪些端点？
它专为 Web3 项目使用的 GraphQL 端点而设计，包括 SubQuery 和 SubGraph 端点。
它需要端点 URL 吗？
是的。它可以先使用端点发现，但执行需要可靠的 GraphQL 端点。
此技能会调用外部服务吗？
是的。它通过 Ask GraphQL MCP 网关路由请求。
什么时候使用付费模式？
仅在免费层配额受限后，或用户明确请求时，才会使用付费模式。
它能调试 GraphQL 错误吗？
可以。它可以请求 MCP 检查 schema 问题、缺失字段和查询结构问题。
用户应该共享密钥吗？
用户应避免使用权限过大的密钥，并在需要私有端点访问时使用有作用域限制的临时凭据。
开发者详情
作者
SN-Hermes许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
f93e9bb0daca99badb6a7e574b97737155d57cb3
维护新鲜度
2026/7/18
使用量
5 次下载 · 84 次浏览
文件结构