Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

GraphQL · dokhacgiakhoa | DecimalAI

dokhacgiakhoa/graphql

SkillScore91Maintained

GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully.

codingby dokhacgiakhoa

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dokhacgiakhoa-graphql/SKILL.md

decimalai skills pull dokhacgiakhoa-graphql --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dokhacgiakhoa-graphql/SKILL.md https://app.decimal.ai/s/dokhacgiakhoa-graphql/SKILL.md

Raw file: /s/dokhacgiakhoa-graphql/SKILL.md ↗ · machine-readable summary at /s/dokhacgiakhoa-graphql.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 24d ago

Yes — +13% lift+12% tokens0% turns91% of whole cases pass with skill (21/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-06	✗→✓	▲ Improved	5%	0%
case-12	✗→✓	▲ Improved	2%	0%
case-18	✗→✓	▲ Improved	17%	0%
case-01	✓→✓	＝ Same ✓	18%	0%
case-02	✓→✓	＝ Same ✓	-3%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

dokhacgiakhoa / agent-skills-4-vibe-coding-cli

.agent/skills/graphql/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/10/2026Version v1

Skill contents

SKILL.md

GraphQL

You're a developer who has built GraphQL APIs at scale. You've seen the N+1 query problem bring down production servers. You've watched clients craft deeply nested queries that took minutes to resolve. You know that GraphQL's power is also its danger.

Your hard-won lessons: The team that didn't use DataLoader had unusable APIs. The team that allowed unlimited query depth got DDoS'd by their own clients. The team that made everything nullable couldn't distinguish errors from empty data. You've l

Capabilities

graphql-schema-design
graphql-resolvers
graphql-federation
graphql-subscriptions
graphql-dataloader
graphql-codegen
apollo-server
apollo-client
urql

Patterns

🧠 Knowledge Modules (Fractal Skills)

1. Schema Design

2. DataLoader for N+1 Prevention

3. Apollo Client Caching

4. ❌ No DataLoader

5. ❌ No Query Depth Limiting

6. ❌ Authorization in Schema

Illustrative Want to see what dokhacgiakhoa/graphql would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/29/2026, 12:59 UTC · 23 cases

Lift

+13%

91% vs 78%

Agent turns

1.0 vs 1.0

Tokens

+12%

2,358.61 vs 2,109.04

fail → pass · 3pass → pass · 18fail → fail · 2

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We operate a GraphQL API endpoint for mobile clients. We noticed some clients send deeply nested queries 15 levels down. Should we rely on relational database query timeouts to kill these queries after they hit the database, or validate query depth earlier in the request lifecycle? Provide the recommended architecture setup for Node.js.	pass→pass	16,059	22,844	+42%	1	1	0%	2,657	3,123	+18%	0	0	—
case-02 When designing authorization for a GraphQL API, a developer proposes putting all user permission checks inside GraphQL schema directive resolvers like `@auth(requires: ADMIN)` or directly in top-level resolvers. Is this the right architectural boundary for authorization logic, or should it be placed elsewhere?	pass→pass	16,710	17,304	+4%	1	1	0%	2,748	2,654	-3%	0	0	—
case-03 In our GraphQL server, resolving the `author` field for a list of 100 `Post` objects causes 100 separate database query calls `SELECT * FROM users WHERE id = post.author_id`. Should we execute these database queries directly inside each `Post.author` resolver? Provide the standard solution.	pass→pass	10,751	9,577	-11%	1	1	0%	1,917	2,090	+9%	0	0	—
case-04 When organizing batching utility instances in an Apollo Server microservice, should we instantiate a single batch utility instance at the module top level so all incoming requests share the same cache? Explain the correct instantiation pattern.	pass→pass	15,235	13,229	-13%	1	1	0%	2,352	2,527	+7%	0	0	—
case-05 When writing a batch loading function for database entity lookups in TypeScript, if key inputs are `['id1', 'id2', 'id3']`, can the batch database function return an unordered array of 2 items `[user3, user1]` if `id2` is missing?	pass→pass	11,701	9,036	-23%	1	1	0%	1,978	1,880	-5%	0	0	—
case-06 In a GraphQL schema design, a team lead suggests making every output field nullable (e.g., `user: User`, `title: String`) so that any backend runtime exception will gracefully return `null` for that field without failing the whole response. How should field nullability be designed regarding domain errors vs missing optional data?	fail→pass	21,168	21,838	+3%	1	1	0%	3,196	3,350	+5%	0	0	—
case-07 When defining a GraphQL schema mutation to update user profile details, should the mutation signature return `updateUser(...): User` directly, or return a dedicated payload type?	pass→pass	10,448	15,934	+53%	1	1	0%	1,572	2,499	+59%	0	0	—
case-08 When authoring a GraphQL mutation that accepts 12 fields for creating a user account (first name, last name, email, address lines, phone, etc.), should we list all 12 as separate field arguments on the mutation field?	pass→pass	10,405	11,521	+11%	1	1	0%	1,592	2,000	+26%	0	0	—
case-09 We are defining a GraphQL field `items` representing a user's order history items. If the user has zero orders, the server returns an empty array `[]`. Which field type definition is most appropriate: `[Item]`, `[Item!]`, or `[Item!]!`?	pass→pass	10,781	8,826	-18%	1	1	0%	1,593	1,506	-5%	0	0	—
case-10 When configuring Apollo Client cache for a paginated feed query field `feed(cursor: String, filter: String)`, setting `keyArgs: true` causes new pages to overwrite old cached entries. How should `keyArgs` in Apollo Client `typePolicies` be configured for offset or cursor pagination?	fail→fail	13,794	44,512	+223%	1	1	0%	2,552	2,548	-0%	0	0	—
case-11 After executing a GraphQL mutation that deletes a comment by ID, should the Apollo Client application refetch the entire main query from the backend server to update the UI?	pass→pass	12,291	10,885	-11%	1	1	0%	2,321	2,240	-3%	0	0	—
case-12 When initializing Apollo Client, setting `defaultOptions.watchQuery.fetchPolicy` to `network-only` avoids stale data issues by ignoring cache. Is `network-only` recommended as the default policy across a web application?	fail→pass	14,258	12,566	-12%	1	1	0%	2,132	2,182	+2%	0	0	—
case-13 In Apollo Federation, we have a `Products` service and an `Orders` service. The `Orders` service needs to reference the `Product` entity. How does the `Products` subgraph annotate the `Product` type so other subgraphs can extend or resolve it?	pass→pass	10,963	9,947	-9%	1	1	0%	1,735	2,067	+19%	0	0	—
case-14 When implementing an Apollo Federation subgraph service in TypeScript, where should the backend code place entity lookup logic for incoming federated entity references (`{ __typename: 'Product', id: '123' }`)?	pass→pass	11,177	14,020	+25%	1	1	0%	1,997	2,523	+26%	0	0	—
case-15 A team wants to replace all standard HTTP queries in their web app with GraphQL Subscriptions over WebSockets because WebSockets provide real-time updates. What is the recommended guidance on using GraphQL Subscriptions versus standard HTTP queries?	pass→pass	16,002	15,625	-2%	1	1	0%	2,224	2,760	+24%	0	0	—
case-16 We need a GraphQL query endpoint for unified search that returns users, blog posts, and comments. Should we define the return field as a generic JSON string `resultJson: String` for clients to parse, or use schema type constructs?	pass→pass	10,736	13,633	+27%	1	1	0%	1,826	2,704	+48%	0	0	—
case-17 In a GraphQL field resolver, executing `SELECT * FROM users JOIN orders JOIN payments ...` on every request fetches all relational data even if the client only requested `{ user { name } }`. How can the resolver avoid unnecessary database joins?	pass→pass	14,900	12,392	-17%	1	1	0%	2,591	2,536	-2%	0	0	—
case-18 Should GraphQL Introspection queries (`__schema`, `__type`) be left enabled by default in production public API environments?	fail→pass	14,114	12,610	-11%	1	1	0%	2,175	2,540	+17%	0	0	—
case-19 When designing pagination in a GraphQL schema for infinite scroll, should we return simple offset/limit integers or adopt Relay cursor connection patterns (`edges`, `node`, `pageInfo`)?	pass→pass	16,403	14,191	-13%	1	1	0%	2,768	2,906	+5%	0	0	—
case-20 When building a RESTful HTTP endpoint for user account registration, what standard HTTP status code should be returned when the payload fails validation due to a missing required email field, and what status code when database fails unexpectedly?	pass→pass	8,648	7,832	-9%	1	1	0%	1,596	1,488	-7%	0	0	—
case-21 We store user metadata in a PostgreSQL JSONB column `metadata`. Queries that filter on `metadata->>'department'` are executing full sequential scans across millions of rows. Which PostgreSQL index type should be created to index JSONB keys efficiently?	pass→pass	11,692	8,813	-25%	1	1	0%	1,684	1,821	+8%	0	0	—
case-22 We are designing a gRPC backend service in Protocol Buffers v3 for high-throughput sensor telemetry. Write a `.proto` file snippet defining a `TelemetryService` RPC method `SendTelemetry` that streams `TelemetryData` messages from client to server.	pass→pass	8,151	8,167	+0%	1	1	0%	1,676	1,919	+14%	0	0	—
case-23 Create an OpenAPI 3.0 YAML specification snippet for a RESTful HTTP `GET /api/v1/products/{id}` endpoint that returns a 200 JSON product payload or a 404 error.	fail→fail	7,025	9,226	+31%	1	1	0%	1,626	2,385	+47%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 78.3%
Pass rate with the skill: 91.3%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/29/2026, 12:59 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-06

Prompt

In a GraphQL schema design, a team lead suggests making every output field nullable (e.g., `user: User`, `title: String`) so that any backend runtime exception will gracefully return `null` for that field without failing the whole response. How should field nullability be designed regarding domain errors vs missing optional data?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run91

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+12% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 24 days ago

Other measured skills in the registry, with their headline benchmark lift.