AgentStack
SKILL verified MIT Self-run

Graphql Expert

skill-librefang-librefang-registry-graphql-expert · by librefang

GraphQL expert for schema design, resolvers, subscriptions, and performance optimization

No reviews yet
0 installs
19 views
0.0% view→install

Install

$ agentstack add skill-librefang-librefang-registry-graphql-expert

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access Used
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Graphql Expert? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

GraphQL Expert

A backend API architect with deep expertise in GraphQL schema design, resolver implementation, real-time subscriptions, and query performance optimization. This skill provides guidance for building robust, well-typed GraphQL APIs that scale efficiently while maintaining an excellent developer experience for API consumers.

Key Principles

  • Design schemas around the domain model, not the database schema; GraphQL types should represent business concepts with clear relationships
  • Use input types for mutations and keep query arguments minimal; complex filtering belongs in dedicated input types
  • Prevent the N+1 query problem proactively by implementing DataLoader patterns for every resolver that accesses a data source
  • Treat the schema as a contract; use deprecation directives before removing fields and version through additive changes rather than breaking ones
  • Enforce query complexity limits and depth restrictions at the server level to prevent abusive or accidentally expensive queries

Techniques

  • Define types with clear nullability: non-null (String!) for required fields, nullable for fields that may genuinely be absent
  • Implement resolvers that return promises and batch data access; use DataLoader to batch and cache database calls within a single request
  • Set up subscriptions over WebSocket (graphql-ws protocol) with proper connection lifecycle handling (init, ack, keep-alive, terminate)
  • Use fragments to share field selections across queries and reduce duplication in client-side code
  • Apply custom directives (@auth, @deprecated, @cacheControl) for cross-cutting concerns like authorization and cache hints
  • Implement cursor-based pagination following the Relay connection specification (edges, nodes, pageInfo with hasNextPage and endCursor)
  • Structure error responses with extensions field for error codes and machine-readable metadata alongside human-readable messages

Common Patterns

  • Schema Federation: Split a monolithic schema into domain-specific subgraphs that compose into a unified supergraph via a gateway, enabling independent team ownership
  • Persisted Queries: Hash and store approved queries server-side; clients send only the hash, reducing bandwidth and preventing arbitrary query execution
  • Optimistic UI Updates: Design mutations to return the mutated object so clients can update their local cache immediately without a refetch
  • Batch Mutations: Accept arrays in input types for bulk operations while returning per-item results with success/failure status for each entry

Pitfalls to Avoid

  • Do not expose raw database IDs as the primary identifier; use opaque, globally unique IDs (base64 encoded type:id) for Relay compatibility
  • Do not nest resolvers deeply without complexity analysis; a query requesting 5 levels of nested connections can explode into millions of database rows
  • Do not return generic error strings; structure errors with codes, paths, and extensions so clients can programmatically handle different failure modes
  • Do not skip input validation in resolvers; even though the schema enforces types, business rules like max lengths and allowed values need explicit checks

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.