graphql-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/graphql-security/SKILL.md. --> # GraphQL Security Bound and control a GraphQL endpoint: operation cost budgets, cost-based rate limiting, pre-registered operations, alias and batch abuse on authentication paths, introspection, cache keying, and untyped scalar inputs. Use when generating schemas, resolvers, or server config, wiring limits or persisted operations, or reviewing a public /graphql endpoint. ## ALWAYS - Enforce a **cost budget** on every operation: a maximum depth, plus a complexity score that weights list fields by the page size they can request. Derive the numbers from your own schema and measure them — a depth of 7 is generous for a flat schema and far too permissive for one with a many-to-many edge, where five levels of nesting can address billions of nodes. `references/graphql-limits.md` covers how to derive them and where each server configures them. - Rate-limit by **cost consumed**, not by request count. Every operation arrives at the same URL, so the per-route limit `api-security` specifies cannot tell a trivial query from one costing a thousand times more. Charge the complexity score against the caller's budget. - For a public or high-traffic API, restrict it to **pre-registered operations** — a build-time allowlist of the documents the client bundle actually contains, keyed by hash. Automatic Persisted Queri