Summary
This is a focused playbook for poking at GraphQL APIs and finding parameters that shouldn't be there. It walks through introspection queries, batching abuse, and hunting for admin-only fields that leak into public schemas. The real value is in the systematic approach: start with schema discovery, probe for IDOR and authz gaps in nested objects, then pivot to hidden parameter testing in REST endpoints using the same mindset. If you're testing APIs and keep wondering what fields the mobile app is sending that you can't see in the UI, this gives you the checklist. Pairs well with the API authorization and recon skills when you find something that smells wrong.
Install to Claude Code
npx -y skills add yaklang/hack-skills --skill graphql-and-hidden-parameters --agent claude-codeInstalls into .claude/skills of the current project.
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Files
SKILL.md
Select a file.
Featured
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
