{"slug":"utkusen-sast-graphql","source_name":"utkusen/sast-graphql","name":"Utkusen/Sast GraphQL","description":"Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to f","version":1,"lift":{"pass_rate_delta_pts":36.36,"pass_rate_pct":81.8,"total_cases":22,"passed_cases":18,"tokens_delta_pct":300.3,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-14T00:59:39.775841+00:00"},"skill_score":0.8182,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":36.36,"with_pass_pct":81.8,"without_pass_pct":45.5,"tokens_delta_pct":300.3,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-08-14T00:59:39.775841+00:00","run_id":"16fb18a2-2897-4b7b-bb10-d7a48f95ac67","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"MIT","install_count":0,"manifest_hash":"5e0625337c13a46b3ca6408e01bbaf57d6cc3154664cbc4adc2c55bcf1c27d0a","raw_url":"https://app.decimal.ai/s/utkusen-sast-graphql/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/utkusen-sast-graphql"}