Graphql And Hidden Parameters

This is a focused playbook for poking at GraphQL APIs and finding parameters that shouldn't be there. It walks through introspection queries, batching abuse, and hunting for admin-only fields that leak into public schemas. The real value is in the systematic approach: start with schema discovery, probe for IDOR and authz gaps in nested objects, then pivot to hidden parameter testing in REST endpoints using the same mindset. If you're testing APIs and keep wondering what fields the mobile app is sending that you can't see in the UI, this gives you the checklist. Pairs well with the API authorization and recon skills when you find something that smells wrong.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill graphql-and-hidden-parameters --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields

AI LOAD INSTRUCTION: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.

1. GRAPHQL FIRST PASS

query { __typename }
query {
  __schema {
    types { name }
  }
}

If introspection is restricted, continue with:

field suggestions and error-based discovery
known type probes like __type(name: "User")
JS and mobile bundle route extraction

2. HIGH-VALUE GRAPHQL TESTS

Theme	Example
IDOR	`user(id: "victim")`
batching	array of login or object fetch operations
hidden fields	admin-only fields exposed in type definitions
nested authz gaps	related object fields with weaker checks