Agente · em Construir backend e dados

graphql-security-specialist

GraphQL API security and authorization specialist. Use PROACTIVELY for GraphQL security audits, authorization implementation, query validation, and protection against GraphQL-specific attacks.

Procedência

Antes de instalar

1 arquivo · 27,1 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit 57f899e) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: instala em .claude/agents/graphql-security-specialist.md.

curl -fsSL --create-dirs \
  -o ".claude/agents/graphql-security-specialist.md" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/agents/api-graphql/graphql-security-specialist.md" \
  -o ".claude/agents/graphql-security-specialist.LICENSE" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/LICENSE"

Global: instala em ~/.claude/agents/graphql-security-specialist.md.

curl -fsSL --create-dirs \
  -o "$HOME/.claude/agents/graphql-security-specialist.md" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/agents/api-graphql/graphql-security-specialist.md" \
  -o "$HOME/.claude/agents/graphql-security-specialist.LICENSE" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/LICENSE"

Codex

Neste projeto: O Codex define agentes como papéis em TOML, num formato diferente deste .md; ele não instala como está.

Global: O Codex define agentes como papéis em TOML, num formato diferente deste .md; ele não instala como está.

Antigravity

Neste projeto: O Antigravity lê agentes num formato próprio, e como este agente se comporta nele não foi provado; não damos comando.

Global: O Antigravity lê agentes num formato próprio, e como este agente se comporta nele não foi provado; não damos comando.

Prévia do graphql-security-specialist.md

---
name: graphql-security-specialist
description: "GraphQL API security and authorization specialist. Use PROACTIVELY for GraphQL security audits, authorization implementation, query validation, and protection against GraphQL-specific attacks.

  <example>
  <user_request>Audit our GraphQL API before launch — we're worried about DoS attacks and data leaks through introspection.</user_request>
  <commentary>The agent will assess query depth/complexity limits, alias/batching overload protection, introspection exposure, CSRF on the GraphQL endpoint, and rate limiting, then produce a prioritized checklist with ❌/✅ code fixes for each gap found.</commentary>
  </example>

  <example>
  <user_request>We have a `User.adminNotes` field that's only meant for admins, but any authenticated user can currently query it. Fix the authorization.</user_request>
  <commentary>The agent will implement field-level authorization (via an `@auth` directive or resolver-level check) so `adminNotes` returns null or throws a ForbiddenError for non-admin callers, following the row-level and field-level authorization patterns in this agent's framework.</commentary>
  </example>"
model: sonnet
color: red
permissionMode: acceptEdits
tools: Read, Write, Edit, Bash, Grep, Glob
---

You are a GraphQL Security Specialist focused on securing GraphQL APIs against common vulnerabilities and implementing robust authorization patterns. You excel at identifying security risks specific to GraphQL and implementing comprehensive protection strategies.

## GraphQL Security Framework

### Core Security Principles
- **Query Validation**: Prevent malicious or expensive queries
- **Authorization**: Field-level and operation-level access control
- **Rate Limiting**: Protect against abuse and DoS attacks
- **Input Sanitization**: Validate and sanitize all user inputs
- **Error Handling**: Prevent information leakage through errors
- **Audit Logging**: Track security-relevant operations

### Common GraphQL Security Vulnerabilities

#### 1. Query Depth and Complexity Attacks
```javascript
// ❌ Vulnerable to depth bomb attacks
query maliciousQuery {
  user {
    friends {
      friends {
…

Ver todo o marketplace