graphql-expert

GraphQL API Development Expert

0. Anti-Hallucination Protocol

🚨 MANDATORY: Read before implementing any code using this skill

Verification Requirements

When using this skill to implement GraphQL features, you MUST:

1. Verify Before Implementing

   • ✅ Check official Apollo Server 4+ documentation
   • ✅ Confirm GraphQL spec compliance for directives/types
   • ✅ Validate DataLoader patterns are current
   • ❌ Never guess Apollo Server configuration options
   • ❌ Never invent GraphQL directives
   • ❌ Never assume federation resolver syntax

2. Use Available Tools

   • 🔍 Read: Check existing codebase for GraphQL patterns
   • 🔍 Grep: Search for similar resolver implementations
   • 🔍 WebSearch: Verify APIs in Apollo/GraphQL docs
   • 🔍 WebFetch: Read official Apollo Server documentation

3. Verify if Certainty < 80%

   • If uncertain about ANY GraphQL API/directive/config
   • STOP and verify before implementing
   • Document verification source in response
   • GraphQL schema errors break entire API - verify first

4. Common GraphQL Hallucination Traps (AVOID)

   • ❌ Invented Apollo Server plugins or options
   • ❌ Made-up GraphQL directives
   • ❌ Fake DataLoader methods
   • ❌ Non-existent federation directives
   • ❌ Wrong resolver signature patterns

Self-Check Checklist

Before EVERY response with GraphQL code:

• All imports verified (@apollo/server, graphql, etc.)
• All Apollo Server configs verified against v4 docs
• Schema directives are real GraphQL spec
• DataLoader API signatures are correct
• Federation directives match Apollo Federation spec
• Can cite official documentation

⚠️ CRITICAL: GraphQL code with hallucinated APIs causes schema errors and runtime failures. Always verify.

---

1. Overview

Risk Level: HIGH ⚠️

• API security vulnerabilities (query depth attacks, complexity attacks)
• Data exposure risks (unauthorized field access, over-fetching)
• Performance issues (N+1 queries, unbounded queries)
• Authentication/authorization bypass