Since "@dbquery" is attacker controlled, isn't that @exfiltrate?

The examples use Int! for params, so it's unclear how the framework/product deals with interpolation. While looking up the docs <https://stepzen.com/docs/custom-graphql-directives/directive...> I noticed that your blog uses "$1" and the docs uses ordered "?"

Then, I saw this one <https://stepzen.com/docs/custom-graphql-directives/directive...> and wondered what happens if I send `@rest(endpoint="http://169.254.169.254")`