Nodejs Backend Patterns
ever-works/ever-works
Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices.
GraphQL and hidden parameter testing playbook. An agent skill from yaklang/hack-skills.
Install Graphql And Hidden Parameters
$ npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install yaklang/hack-skills graphql-and-hidden-parameters --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/graphql-and-hidden-parameters .claude/skills/graphql-and-hidden-parameters && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "graphql-and-hidden-parameters" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parameters into .claude/skills/graphql-and-hidden-parameters/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "graphql-and-hidden-parameters", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parametersType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install yaklang/hack-skills graphql-and-hidden-parameters --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/graphql-and-hidden-parameters .agents/skills/graphql-and-hidden-parameters && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "graphql-and-hidden-parameters" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parameters into .agents/skills/graphql-and-hidden-parameters/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "graphql-and-hidden-parameters", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install yaklang/hack-skills graphql-and-hidden-parameters --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/graphql-and-hidden-parameters .cursor/skills/graphql-and-hidden-parameters && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "graphql-and-hidden-parameters" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parameters into .cursor/skills/graphql-and-hidden-parameters/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "graphql-and-hidden-parameters", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/yaklang/hack-skills.git --path skills/graphql-and-hidden-parameters--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install yaklang/hack-skills graphql-and-hidden-parameters --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/graphql-and-hidden-parameters .gemini/skills/graphql-and-hidden-parameters && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "graphql-and-hidden-parameters" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parameters into .gemini/skills/graphql-and-hidden-parameters/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "graphql-and-hidden-parameters", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install yaklang/hack-skills graphql-and-hidden-parametersInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/graphql-and-hidden-parameters .github/skills/graphql-and-hidden-parameters && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "graphql-and-hidden-parameters" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parameters into .github/skills/graphql-and-hidden-parameters/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "graphql-and-hidden-parameters", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install yaklang/hack-skills graphql-and-hidden-parameters --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/graphql-and-hidden-parameters .opencode/skills/graphql-and-hidden-parameters && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "graphql-and-hidden-parameters" agent skill from https://github.com/yaklang/hack-skills/tree/main/skills/graphql-and-hidden-parameters into .opencode/skills/graphql-and-hidden-parameters/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "graphql-and-hidden-parameters", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
graphql-and-hidden-parameters- GitHub stars
- 2.4k
- Token cost
- ~441 tokens
- SKILL.md length
- 176 words
- Files
- 1
- Skills in repo
- 27
- Repo updated
- First seen
- Licence
- MIT
At a glance
GraphQL and hidden parameter testing playbook. An agent skill from yaklang/hack-skills.
- Works in 4 steps: GRAPHQL FIRST PASS → HIGH-VALUE GRAPHQL TESTS → HIDDEN PARAMETER DISCOVERY → …
- Exploring introspection
- SKILL.md covers 1. GRAPHQL FIRST PASS, 2. HIGH-VALUE GRAPHQL TESTS, 3. HIDDEN PARAMETER DISCOVERY and 4. NEXT ROUTING
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Graphql And Hidden Parameters is an agent skill from yaklang/hack-skills. GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.
Its SKILL.md is about 440 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering GraphQL. It works with GraphQL. The repository describes itself as: Helping AI Agent become an awesome practical hacker! The licence is MIT.
When your agent uses it
- Exploring introspection
- Undocumented fields
- Hidden parameters
- GraphQL authorization gaps
Example prompts
- “/graphql-and-hidden-parameters”
Workflow steps
4 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 6fbf0bc. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are graphql).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Graphql And Hidden Parameters loads about 441 tokens when it runs. Until then it costs about 52 tokens; SKILL.md has 176 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from yaklang/hack-skills at commit 6fbf0bc, republished under its MIT licence (© yaklang). 176 words, ~441 tokens.
Download SKILL.mdSave it as
.claude/skills/graphql-and-hidden-parameters/SKILL.md (or your agent's skills folder).- name
- graphql-and-hidden-parameters
- description
- GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.
SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields
AI LOAD INSTRUCTION: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.
1. GRAPHQL FIRST PASS
query { __typename }
query {
__schema {
types { name }
}
}If introspection is restricted, continue with:
- field suggestions and error-based discovery
- known type probes like
__type(name: "User") - JS and mobile bundle route extraction
2. HIGH-VALUE GRAPHQL TESTS
| Theme | Example |
|---|---|
| IDOR | user(id: "victim") |
| batching | array of login or object fetch operations |
| hidden fields | admin-only fields exposed in type definitions |
| nested authz gaps | related object fields with weaker checks |
3. HIDDEN PARAMETER DISCOVERY
Look for:
- fields present in admin docs but not public docs
additionalPropertiesor permissive schemas- frontend code using richer request bodies than visible UI controls
- mobile endpoints carrying role, org, feature-flag, or internal filter fields
4. NEXT ROUTING
- If hidden fields affect privilege: api authorization and bola
- If GraphQL batching changes auth or rate behavior: api auth and jwt abuse
- If endpoint discovery is incomplete: api recon and docs
© yaklang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/graphql-and-hidden-parameters of yaklang/hack-skills.
Open the folder on GitHubat commit 6fbf0bc
Compare with similar skills
Graphql And Hidden Parameters next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Graphql And Hidden Parameters this skillyaklang/hack-skills | 2.4k | — | ~441 | Automated safety check: Pass | MIT | |
| Nodejs Backend Patternsever-works/ever-works | 162 | 18 repos | ~4k | Automated safety check: Pass | AGPL-3.0 | |
| API DesignerJeffallan/claude-skills | 12k | 1 repos | ~2k | Automated safety check: Pass | MIT | |
| GraphQL Operations with CodegenChrisWiles/claude-code-showcase | 6.1k | 3 repos | ~1.5k | Automated safety check: Pass | None | |
| API Design Principlesjh941213/my-cc-harness | 125 | 18 repos | ~3.4k | Automated safety check: Pass | None | |
| API And Interface Designdzhalaevd/Donatello | 135 | 8 repos | ~2.6k | Automated safety check: Pass | Apache-2.0 |
Similar skills
API Designer
Jeffallan/claude-skills
Designs REST and GraphQL APIs from resource modeling to an OpenAPI 3.1 contract, with versioning, pagination and RFC 7807 error handling.
GraphQL Operations with Codegen
ChrisWiles/claude-code-showcase
Sets the rules for writing GraphQL queries and mutations in .gql files, running codegen, and using generated Apollo hooks with proper error and loading handling.
API Design Principles
jh941213/my-cc-harness
REST 및 GraphQL API 설계 원칙 가이드. An agent skill from jh941213/my-cc-harness.
API And Interface Design
dzhalaevd/Donatello
Guides stable API and interface design. An agent skill from dzhalaevd/Donatello.
Twenty Syncable Entity Wiring
twentyhq/twenty
Registers a new syncable entity in three NestJS modules and adds its service and GraphQL resolver layers when contributing to the Twenty server.
More from yaklang/hack-skills
All 27 skills in this repoAnti Debugging Techniques
yaklang/hack-skills
Anti-debugging detection and bypass playbook. An agent skill from yaklang/hack-skills.
API Auth And JWT Abuse
yaklang/hack-skills
API authentication and JWT abuse playbook. An agent skill from yaklang/hack-skills.
API Authorization And Bola
yaklang/hack-skills
API authorization and BOLA testing playbook. An agent skill from yaklang/hack-skills.
API Recon And Docs
yaklang/hack-skills
API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills.
Attack Surface Mapping
yaklang/hack-skills
Draw a testable attack surface from one authorized target URL or one application.
Classical Cipher Analysis
yaklang/hack-skills
Classical cipher analysis playbook. An agent skill from yaklang/hack-skills.
Related
Works with
Categories
Questions about Graphql And Hidden Parameters
What does Graphql And Hidden Parameters do?
GraphQL and hidden parameter testing playbook. An agent skill from yaklang/hack-skills. Graphql And Hidden Parameters is an agent skill from yaklang/hack-skills. GraphQL and hidden parameter testing playbook.
When should I use Graphql And Hidden Parameters?
Graphql And Hidden Parameters fits situations like: exploring introspection; undocumented fields; hidden parameters; graphQL authorization gaps.
How do I install Graphql And Hidden Parameters in Claude Code?
Run `npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a claude-code`. Or copy the skill folder (skills/graphql-and-hidden-parameters in yaklang/hack-skills) into .claude/skills/graphql-and-hidden-parameters in your project. Claude Code loads it when a task matches its description.
How do I install Graphql And Hidden Parameters in Codex?
Run `npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a codex`. Or copy the skill folder (skills/graphql-and-hidden-parameters in yaklang/hack-skills) into .agents/skills/graphql-and-hidden-parameters in your project. Codex loads it when a task matches its description.
Can I use Graphql And Hidden Parameters in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/graphql-and-hidden-parameters, .gemini/skills/graphql-and-hidden-parameters, .github/skills/graphql-and-hidden-parameters and .opencode/skills/graphql-and-hidden-parameters in your project.
What does Graphql And Hidden Parameters need to run?
SKILL.md names no scripts, command-line tools or credentials: Graphql And Hidden Parameters is instructions for the agent only.
Does Graphql And Hidden Parameters access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Graphql And Hidden Parameters safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Graphql And Hidden Parameters use?
Graphql And Hidden Parameters is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Graphql And Hidden Parameters use?
About 441 tokens (SKILL.md is roughly 1.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Graphql And Hidden Parameters?
Skills that share tags, products or a category with Graphql And Hidden Parameters: Nodejs Backend Patterns (ever-works/ever-works, 162 stars), API Designer (Jeffallan/claude-skills, 12k stars), GraphQL Operations with Codegen (ChrisWiles/claude-code-showcase, 6.1k stars) and API Design Principles (jh941213/my-cc-harness, 125 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Graphql And Hidden Parameters?
yaklang (a GitHub organization) maintains it in yaklang/hack-skills, which has 2,418 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on September 13, 2026.
Source: yaklang/hack-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.