Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hoangatg/ai-agent-toolkit --skill graphql-expertgit clone --depth 1 https://github.com/hoangatg/ai-agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hoangatg/ai-agent-toolkit/graphql-expert)<a href="https://agentmods.dev/skills/hoangatg/ai-agent-toolkit/graphql-expert"><img src="https://agentmods.dev/badge/skills/hoangatg/ai-agent-toolkit/graphql-expert.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00759 |
| Opus 5 | $0.00017 | $0.00380 |
| Sonnet 5 | $0.00007 | $0.00152 |
| Haiku 4.5 | $0.00003 | $0.00076 |
Grade A, and why
graphql-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GraphQL Expert
Ask for exactly what you need. Nothing more, nothing less.
1. Schema Design
Design Principles
| Principle | Application |
|---|---|
| Domain-first | Model business entities, not database tables |
| Naming | PascalCase types, camelCase fields |
| Nullability | Non-null by default, nullable when uncertain |
| Pagination | Cursor-based (Relay spec) for lists |
| Versioning | Evolve schema, don't version |
Type Patterns
| Type | Use Case |
|---|---|
| Object | Domain entities |
| Input | Mutation arguments |
| Interface | Shared fields across types |
| Union | "One of" return types |
| Enum | Fixed set of values |
| Scalar | Custom types (DateTime, URL, JSON) |
2. Resolver Patterns
| Pattern | Purpose |
|---|---|
| DataLoader | Batch + cache N+1 queries |
| Field resolver | Lazy load nested data |
| Context | Share auth, DB, services |
| Middleware | Auth, logging, validation |
N+1 Problem
❌ Without DataLoader: 1 query + N queries
✅ With DataLoader: 1 query + 1 batched query
3. Client Patterns
| Client | Best For |
|---|---|
| Apollo Client | Full-featured, React ecosystem |
| urql | Lightweight, framework-agnostic |
| Relay | Facebook-scale, compiler-driven |
| graphql-request | Minimal, no framework |
Client Cache
| Strategy | When |
|---|---|
| Normalized cache | Complex relationships |
| Document cache | Simple queries |
| No cache | Real-time/frequently changing |
4. Federation (Microservices)
| Concept | Purpose |
|---|---|
| Subgraph | Domain-specific GraphQL service |
| Supergraph | Unified schema from subgraphs |
| Gateway | Routes queries to subgraphs |
| @key | Entity identity across services |
| @external | Reference fields from other services |
5. Security
| Threat | Defense |
|---|---|
| Query depth | Max depth limit (e.g., 10) |
| Query complexity | Cost analysis per field |
| Introspection | Disable in production |
| Batching attacks | Limit batch size |
| Authorization | Field-level auth in resolvers |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 121 lines · 35 tokens per session scan A dba5139cfc13
graphql-expert is a skill published in the GitHub repository hoangatg/ai-agent-toolkit (1 stars, last pushed 5mo ago), licensed MIT. It adds 35 tokens to every session and 759 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
springboot-patterns
Spring Boot architecture patterns, REST API design, layered services, data access, caching, async processing, and logging. Use for Java Spring Boot backend work.
django-patterns
Django architecture patterns, REST API design with DRF, ORM best practices, caching, signals, middleware, and production-grade Django apps.
api-design
REST API design patterns including resource naming, status codes, pagination, filtering, error responses, versioning, and rate limiting for production APIs.
backend-patterns
Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.
sdd-apply
Skill "sdd-apply" from Gentleman-Programming/gentle-ai, covering execution role, language domain contract, purpose, what you receive and execution and persistence contract.
api-design
You are the API Design Specialist, responsible for designing RESTful, GraphQL, or other API interfaces. You ensure APIs are well-designed, documented, versioned, and follow best practices.