graphql
Guidelines for designing efficient, secure, and type-safe GraphQL APIs that avoid common pitfalls like performance bottlenecks.
Install
mkdir -p .claude/skills/graphql && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/1464" && unzip -o skill.zip -d .claude/skills/graphql && rm skill.zipInstalls to .claude/skills/graphql
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully.Key capabilities
- →Design type-safe schemas
- →Implement DataLoader for N+1 prevention
- →Configure query depth limiting
- →Integrate Apollo client
How it works
The skill applies established patterns like DataLoader and query depth limiting to ensure API performance and security.
Inputs & outputs
When to use graphql
- →Implement DataLoader to fix N+1 performance issues
- →Design a type-safe GraphQL schema
- →Configure query depth limiting for security
- →Integrate Apollo client with caching
About this skill
GraphQL
You're a developer who has built GraphQL APIs at scale. You've seen the N+1 query problem bring down production servers. You've watched clients craft deeply nested queries that took minutes to resolve. You know that GraphQL's power is also its danger.
Your hard-won lessons: The team that didn't use DataLoader had unusable APIs. The team that allowed unlimited query depth got DDoS'd by their own clients. The team that made everything nullable couldn't distinguish errors from empty data. You've l
Capabilities
- graphql-schema-design
- graphql-resolvers
- graphql-federation
- graphql-subscriptions
- graphql-dataloader
- graphql-codegen
- apollo-server
- apollo-client
- urql
Patterns
Schema Design
Type-safe schema with proper nullability
DataLoader for N+1 Prevention
Batch and cache database queries
Apollo Client Caching
Normalized cache with type policies
Anti-Patterns
❌ No DataLoader
❌ No Query Depth Limiting
❌ Authorization in Schema
⚠️ Sharp Edges
| Issue | Severity | Solution |
|---|---|---|
| Each resolver makes separate database queries | critical | # USE DATALOADER |
| Deeply nested queries can DoS your server | critical | # LIMIT QUERY DEPTH AND COMPLEXITY |
| Introspection enabled in production exposes your schema | high | # DISABLE INTROSPECTION IN PRODUCTION |
| Authorization only in schema directives, not resolvers | high | # AUTHORIZE IN RESOLVERS |
| Authorization on queries but not on fields | high | # FIELD-LEVEL AUTHORIZATION |
| Non-null field failure nullifies entire parent | medium | # DESIGN NULLABILITY INTENTIONALLY |
| Expensive queries treated same as cheap ones | medium | # QUERY COST ANALYSIS |
| Subscriptions not properly cleaned up | medium | # PROPER SUBSCRIPTION CLEANUP |
Related Skills
Works well with: backend, postgres-wizard, nextjs-app-router, react-patterns
When not to use it
- →When the API does not require complex data fetching
- →When introspection is needed in production
Prerequisites
Limitations
- →Requires careful nullability design
- →Authorization must be implemented at the field level
How it compares
It focuses on preventing common GraphQL failures like N+1 queries and DDoS attacks through structured design patterns.
Compared to similar skills
graphql side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| graphql (this skill) | 6 | 6mo | No flags | Advanced |
| api-security-best-practices | 15 | 6mo | Review | Intermediate |
| nodejs-backend-patterns | 12 | 2mo | No flags | Intermediate |
| graphql-architect | 1 | 4mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by davila7
View all by davila7 →You might also like
api-security-best-practices
davila7
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities
nodejs-backend-patterns
wshobson
Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.
graphql-architect
sickn33
Master modern GraphQL with federation, performance optimization, and enterprise security. Build scalable schemas, implement advanced caching, and design real-time systems. Use PROACTIVELY for GraphQL architecture or performance optimization.
api-design
Yisuescopeta
Design robust, scalable, and intuitive APIs (REST, GraphQL, etc.). Enforces best practices for resource naming, HTTP methods, error handling, versioning, and security. Use this when designing or refactoring backend endpoints.
apollo-caching-strategies
majiayu000
Use when implementing Apollo caching strategies including cache policies, optimistic UI, cache updates, and normalization.
file-uploads
davila7
Expert at handling file uploads and cloud storage. Covers S3, Cloudflare R2, presigned URLs, multipart uploads, and image optimization. Knows how to handle large files without blocking. Use when: file upload, S3, R2, presigned URL, multipart.