graphql-architect

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, architecture, documentation, graphql, performance, web.

What it does

Use when designing GraphQL schemas, implementing Apollo Federation, or building real-time subscriptions. Invoke for schema design, resolvers with DataLoader, query optimization, federation directives.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill graphql-architect

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/graphql-architect ~/.claude/skills/graphql-architect

Safety box score

Grade B, low risk: 16 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only GraphQL architecture skill: it ships Markdown guidance and code examples, not runnable scripts. Its main blast radius comes from the patterns it promotes—federated GraphQL services, WebSocket/Redis subscriptions, and auth/JWT handling—which can create network exposure and credential-sensitive code when an agent applies them.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	The files are plain Markdown with code samples only; there are no shell scripts, installers, or executable binaries.
Network access	2 (moderate)	It explicitly promotes Apollo Federation and subscriptions using `fetchSupergraphSdl()`, `IntrospectAndCompose`, `WebSocketServer`, and `RedisPubSub`, which create outbound dependencies and exposed network endpoints.
Filesystem reach	0 (none)	The skill does not instruct edits or deletions outside the project; the only file access shown is local example reads like `readFileSync('./schema.graphql', 'utf8')`.
Secrets & credentials	1 (low)	Security examples handle bearer tokens and JWT verification with `process.env.JWT_SECRET`, so generated code will likely touch authentication material and request headers.
Privilege & persistence	0 (none)	There is no `sudo`, service registration, global install, or OS/shell configuration in the skill files.
Instruction hijack surface	0 (none)	The content does not tell the agent to ignore instructions, follow remote content, or hide actions; it is standard GraphQL architecture guidance.
Irreversible actions	1 (low)	It includes effectful application actions like `pubsub.publish(...)` and returning HTTP 410 to retire REST endpoints, but nothing that reaches external payments, deployments, or irreversible admin actions.
Transparency	0 (none)	All shipped files are readable Markdown; there are no binaries, minified blobs, or decoded-at-runtime code.

Before installing

Check whether you want the agent generating code that connects to Apollo Studio, Redis, and WebSocket subscription infrastructure.
Ensure JWT secrets stay in your secret manager and are never pasted into prompts or files.
Review any generated federation/subscription server code before deployment, especially network endpoints and auth handling.

Rated 2026-10-20 by an automated review of 7 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/graphql-architect/SKILL.md
Branch: main
Updated: 2026-09-19

api-designer — Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture.
code-documenter — Generates, formats, and validates technical documentation — including docstrings, OpenAPI/Swagger specs, JSDoc annotations, doc portals, and user guides.
dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.
fastapi-expert — Use when building high-performance async Python APIs with FastAPI and Pydantic V2.
java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
microservices-architect — Designs distributed system architectures, decomposes monoliths into bounded-context services, recommends communication patterns.