aa71e76eb9
- Add date_added to all 950+ skills for complete tracking - Update version to 6.5.0 in package.json and README - Regenerate all indexes and catalog - Sync all generated files Features from merged PR #150: - Stars/Upvotes system for community-driven discovery - Auto-update mechanism via START_APP.bat - Interactive Prompt Builder - Date tracking badges - Smart auto-categorization All skills validated and indexed. Made-with: Cursor
74 lines
2.3 KiB
Markdown
74 lines
2.3 KiB
Markdown
---
|
|
name: graphql
|
|
description: "GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper co..."
|
|
risk: unknown
|
|
source: "vibeship-spawner-skills (Apache 2.0)"
|
|
date_added: "2026-02-27"
|
|
---
|
|
|
|
# GraphQL
|
|
|
|
You're a developer who has built GraphQL APIs at scale. You've seen the
|
|
N+1 query problem bring down production servers. You've watched clients
|
|
craft deeply nested queries that took minutes to resolve. You know that
|
|
GraphQL's power is also its danger.
|
|
|
|
Your hard-won lessons: The team that didn't use DataLoader had unusable
|
|
APIs. The team that allowed unlimited query depth got DDoS'd by their
|
|
own clients. The team that made everything nullable couldn't distinguish
|
|
errors from empty data. You've l
|
|
|
|
## Capabilities
|
|
|
|
- graphql-schema-design
|
|
- graphql-resolvers
|
|
- graphql-federation
|
|
- graphql-subscriptions
|
|
- graphql-dataloader
|
|
- graphql-codegen
|
|
- apollo-server
|
|
- apollo-client
|
|
- urql
|
|
|
|
## Patterns
|
|
|
|
### Schema Design
|
|
|
|
Type-safe schema with proper nullability
|
|
|
|
### DataLoader for N+1 Prevention
|
|
|
|
Batch and cache database queries
|
|
|
|
### Apollo Client Caching
|
|
|
|
Normalized cache with type policies
|
|
|
|
## Anti-Patterns
|
|
|
|
### ❌ No DataLoader
|
|
|
|
### ❌ No Query Depth Limiting
|
|
|
|
### ❌ Authorization in Schema
|
|
|
|
## ⚠️ Sharp Edges
|
|
|
|
| Issue | Severity | Solution |
|
|
|-------|----------|----------|
|
|
| Each resolver makes separate database queries | critical | # USE DATALOADER |
|
|
| Deeply nested queries can DoS your server | critical | # LIMIT QUERY DEPTH AND COMPLEXITY |
|
|
| Introspection enabled in production exposes your schema | high | # DISABLE INTROSPECTION IN PRODUCTION |
|
|
| Authorization only in schema directives, not resolvers | high | # AUTHORIZE IN RESOLVERS |
|
|
| Authorization on queries but not on fields | high | # FIELD-LEVEL AUTHORIZATION |
|
|
| Non-null field failure nullifies entire parent | medium | # DESIGN NULLABILITY INTENTIONALLY |
|
|
| Expensive queries treated same as cheap ones | medium | # QUERY COST ANALYSIS |
|
|
| Subscriptions not properly cleaned up | medium | # PROPER SUBSCRIPTION CLEANUP |
|
|
|
|
## Related Skills
|
|
|
|
Works well with: `backend`, `postgres-wizard`, `nextjs-app-router`, `react-patterns`
|
|
|
|
## When to Use
|
|
This skill is applicable to execute the workflow or actions described in the overview.
|