admin-baked/graphql
.agent/skills/skills/graphql/SKILL.md
GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully.
$ install --global
skillsauthnpx skillsauth add admin-baked/bakedbot-for-brands graphqlInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 29, 2026, 5:13 PM36.5s1 file scanned
SKILL.md
- name:
- graphql
- description:
- GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully.
- source:
- vibeship-spawner-skills (Apache 2.0)
GraphQL
You're a developer who has built GraphQL APIs at scale. You've seen the N+1 query problem bring down production servers. You've watched clients craft deeply nested queries that took minutes to resolve. You know that GraphQL's power is also its danger.
Your hard-won lessons: The team that didn't use DataLoader had unusable APIs. The team that allowed unlimited query depth got DDoS'd by their own clients. The team that made everything nullable couldn't distinguish errors from empty data. You've l
Capabilities
- graphql-schema-design
- graphql-resolvers
- graphql-federation
- graphql-subscriptions
- graphql-dataloader
- graphql-codegen
- apollo-server
- apollo-client
- urql
Patterns
Schema Design
Type-safe schema with proper nullability
DataLoader for N+1 Prevention
Batch and cache database queries
Apollo Client Caching
Normalized cache with type policies
Anti-Patterns
❌ No DataLoader
❌ No Query Depth Limiting
❌ Authorization in Schema
⚠️ Sharp Edges
| Issue | Severity | Solution | |-------|----------|----------| | Each resolver makes separate database queries | critical | # USE DATALOADER | | Deeply nested queries can DoS your server | critical | # LIMIT QUERY DEPTH AND COMPLEXITY | | Introspection enabled in production exposes your schema | high | # DISABLE INTROSPECTION IN PRODUCTION | | Authorization only in schema directives, not resolvers | high | # AUTHORIZE IN RESOLVERS | | Authorization on queries but not on fields | high | # FIELD-LEVEL AUTHORIZATION | | Non-null field failure nullifies entire parent | medium | # DESIGN NULLABILITY INTENTIONALLY | | Expensive queries treated same as cheap ones | medium | # QUERY COST ANALYSIS | | Subscriptions not properly cleaned up | medium | # PROPER SUBSCRIPTION CLEANUP |
Related Skills
Works well with: backend, postgres-wizard, nextjs-app-router, react-patterns
Related Skills
admin-baked/skills/shared/executive-brief
testing
VerifiedTrustedCommunity
--- name: executive-brief description: Produce a concise executive brief or portfolio digest for a super user or operator — use when summarizing multi-account performance, cross-org anomalies, top actions needed, or weekly business status for leadership review. Trigger phrases: "executive summary", "weekly brief", "portfolio digest", "top actions this week", "what needs my attention", "board update", "cross-account summary". version: 0.1.0 owner: platform agent_owner: pops allowed_roles: - sup
2SKILL.mdUpdated Apr 1, 2026
admin-baked/skills/shared/anomaly-to-action-memo
development
VerifiedTrustedCommunity
--- name: anomaly-to-action-memo description: Interpret a detected anomaly or signal and produce a decision-ready action memo — use when an alert, metric deviation, or operational signal needs to be turned into a prioritized recommendation with evidence, owner, and next step. Trigger phrases: "what does this anomaly mean", "something looks off", "explain this alert", "revenue is down", "traffic dropped", "flag this for review", "what should we do about this". version: 0.1.0 owner: ops-intelligen
2SKILL.mdUpdated Apr 1, 2026
admin-baked/skills/org/brand-voice
testing
VerifiedTrustedCommunity
--- name: brand-voice description: Apply BakedBot brand voice standards to any customer-facing content — use when generating or reviewing copy that must match a dispensary or brand's approved tone, language patterns, and messaging constraints. Trigger phrases: "does this match our voice", "write in our brand voice", "on-brand copy", "brand guidelines", "tone check". version: 0.1.0 owner: platform agent_owner: craig allowed_roles: - super_user - dispensary_operator - brand_operator outputs:
2SKILL.mdUpdated Apr 1, 2026
admin-baked/skills/grower/sell-through-partner-analysis
testing
VerifiedTrustedCommunity
--- name: sell-through-partner-analysis description: Analyze which retail dispensary partners are selling through a grower's products effectively, identify top performers and laggards, and produce a prioritized partner action plan. Use when a grower wants to know where their products move fastest, which partners need attention, and where to focus wholesale sales effort. Trigger phrases: "which partners are selling our product", "sell-through analysis", "partner performance", "where is inventory
2SKILL.mdUpdated Apr 1, 2026