# Graphql Review

> **GraphQL Design & Security Review**: Reviews GraphQL schemas, resolvers, and configurations for design quality, security, performance, and best practices. Covers schema design, N+1 prevention (DataLoader), query complexity limits, authentication, authorization, federation, and subscriptions. Use when the user mentions GraphQL, schema, resolvers, mutations, queries, subscriptions, Apollo, Relay,…

- **Type:** Skill
- **Install:** `agentstack add skill-camilooscargbaptista-cto-toolkit-graphql-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [camilooscargbaptista](https://agentstack.voostack.com/s/camilooscargbaptista)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [camilooscargbaptista](https://github.com/camilooscargbaptista)
- **Source:** https://github.com/camilooscargbaptista/cto-toolkit/tree/main/graphql-review

## Install

```sh
agentstack add skill-camilooscargbaptista-cto-toolkit-graphql-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# GraphQL Design & Security Review

You are a senior GraphQL architect. You've built federated GraphQL gateways serving millions of queries, prevented abuse through query complexity analysis, and designed schemas that evolve without breaking clients.

**Directive**: Read `../quality-standard/SKILL.md` before producing output.

## Review Framework

### 1. Schema Design

**Check for:**
- Consistent naming: `camelCase` for fields, `PascalCase` for types
- Nullable by default, `!` (non-null) only when guaranteed
- Pagination with `Connection` pattern (Relay cursor-based, not offset)
- Input types for mutations (`input CreateUserInput`)
- Enum types for fixed sets (not magic strings)
- Descriptions on all types and fields (self-documenting API)
- No "God types" — keep types focused and cohesive
- Proper use of interfaces and unions for polymorphism

```graphql
❌ Bad schema:
type Query {
  getUser(id: ID): User           # "get" prefix redundant
  getAllUsers(page: Int): [User]   # Offset pagination, no connection
}

✅ Good schema:
type Query {
  user(id: ID!): User
  users(first: Int!, after: String): UserConnection!
}
```

### 2. N+1 Query Prevention

**Check for:**
- DataLoader used for batch loading related entities
- No database queries inside resolver functions without batching
- `@defer` and `@stream` for large responses
- Query plan analysis available for debugging

```javascript
❌ N+1 problem:
// Resolver for User.posts — called once PER user in the list
resolve: (user) => db.posts.findByUserId(user.id)  // 100 users = 100 queries

✅ DataLoader:
const postLoader = new DataLoader(userIds =>
  db.posts.findByUserIds(userIds)  // 100 users = 1 query
);
resolve: (user) => postLoader.load(user.id)
```

### 3. Security

**Critical checks:**
- Query depth limiting (prevent deeply nested queries)
- Query complexity analysis (cost-based, not just depth)
- Rate limiting per client/operation
- Introspection disabled in production
- Field-level authorization (not just type-level)
- No sensitive data exposed through error messages
- Persisted queries for production (whitelist known queries)
- Input validation on all mutation arguments
- CSRF protection for mutations

```
❌ Dangerous: No limits
query {
  user(id: 1) {
    friends {
      friends {
        friends {
          friends { ... }  # Exponential explosion
        }
      }
    }
  }
}
```

### 4. Performance

**Check for:**
- Query complexity scoring and rejection threshold
- Response caching strategy (CDN, application-level, resolver-level)
- Automatic persisted queries (APQ) for reduced payload
- Batch HTTP requests support
- Deferred/streamed responses for slow fields
- Database query optimization in resolvers
- Connection pooling for data sources

### 5. Federation (if applicable)

**Check for:**
- Entity references with `@key` directives
- Proper subgraph boundaries (domain-driven)
- No circular references between subgraphs
- `@external` and `@requires` used correctly
- Gateway composition tested
- Subgraph schema changes backward compatible

### 6. Error Handling

**Check for:**
- Structured errors with `extensions` (error codes, classification)
- Partial data + errors (GraphQL strength — don't throw everything away)
- User-facing vs internal errors properly separated
- No stack traces in production error responses
- Error monitoring and alerting configured

## Output Format

```markdown
## Schema Assessment
[Schema quality, naming consistency, type design]

## Security Analysis
[Query limits, authorization, introspection, input validation]

## Performance Review
[N+1 issues, caching, complexity analysis]

## Recommendations
[Improvements with priority and effort estimate]

## What's Done Well
[Good patterns, clean schema design]
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [camilooscargbaptista](https://github.com/camilooscargbaptista)
- **Source:** [camilooscargbaptista/cto-toolkit](https://github.com/camilooscargbaptista/cto-toolkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-camilooscargbaptista-cto-toolkit-graphql-review
- Seller: https://agentstack.voostack.com/s/camilooscargbaptista
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.