CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/restler-fuzzing

Runs stateful REST API fuzzing using Microsoft's RESTler - infers producer-consumer dependencies from an OpenAPI spec, drives sequences of requests (POST → GET → DELETE chains), and reports 5xx errors, resource leaks, and hierarchy violations. Wraps the canonical 4-stage workflow (compile → test → fuzz-lean → fuzz). Use when the API is stateful (resources are created, queried, modified, deleted) and Schemathesis's stateless fuzzing is missing the multi-step bugs.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-structured, with executable commands, explicit validation checkpoints, and clean one-level-deep references to a verified bundle file. Its only weakness is mild redundancy in the Overview that could be tightened.

Suggestions

Trim or differentiate the Overview paragraph so it does not restate the description's producer-consumer example verbatim; let the description carry that framing.

Consider moving the Bug-detection table's detailed explanations into the triage reference if the body grows, keeping SKILL.md to the four-stage workflow and cadence.

Collapse the repeated "Per [restler-readme]" asides into a single "This workflow follows the restler readme" note to save tokens.

DimensionReasoningScore

Conciseness

The body is mostly efficient — no basic-concept padding, dense tables and code blocks, and bulky CI/tree detail correctly externalized — but the Overview paragraph re-states the description's producer-consumer point and the ~215-line body could be tightened, matching score 2's "mostly efficient but could be tightened" rather than score 3's "every token earns its place".

2 / 3

Actionability

Provides fully executable, copy-paste-ready commands throughout (git clone, docker build, restler compile/test/fuzz-lean/fuzz with concrete flags, a curl|jq auth-dict snippet, and a complete GitHub Actions YAML in the reference), matching the score-3 anchor rather than score 2's pseudocode/incomplete guidance.

3 / 3

Workflow Clarity

The four-stage workflow is clearly sequenced with an explicit validation checkpoint at Stage 2 ("If endpoint coverage is below ... 80%+, stop and amend") and a per-bug triage feedback loop (replay log → restler replay → ticket), matching score 3's explicit validation and error-recovery loops rather than score 2's missing checkpoints.

3 / 3

Progressive Disclosure

A clear overview in SKILL.md points via two well-signaled one-level-deep links to references/triage-and-ci.md (verified to hold the output tree and full CI workflow), with appropriately split content; matches score 3 rather than score 2's inline-bloat or unclear signaling.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and well-differentiated, naming concrete actions and an explicit use-trigger that distinguishes it from the stateless alternative. Every dimension lands at the top of the scale.

DimensionReasoningScore

Specificity

Lists multiple concrete actions ("infers producer-consumer dependencies", "drives sequences of requests (POST → GET → DELETE chains)", "reports 5xx errors, resource leaks, and hierarchy violations", "Wraps the canonical 4-stage workflow"), matching the score-3 anchor; it is not score 2 because the action set is comprehensive rather than partial.

3 / 3

Completeness

Explicitly answers both what (runs fuzzing, infers dependencies, drives sequences, reports bug categories) and when ("Use when the API is stateful ... and Schemathesis's stateless fuzzing is missing the multi-step bugs"), matching the score-3 anchor with an explicit trigger clause.

3 / 3

Trigger Term Quality

Uses natural practitioner terms — "stateful REST API fuzzing", "OpenAPI spec", "resources are created, queried, modified, deleted", and "Schemathesis's stateless fuzzing is missing the multi-step bugs" — that a user would actually say, matching score 3 rather than score 2's partial keyword coverage.

3 / 3

Distinctiveness Conflict Risk

Clear niche (stateful REST API fuzzing via RESTler) explicitly contrasted against Schemathesis's stateless fuzzing, giving distinct triggers unlikely to fire for the wrong skill; matches score 3 rather than score 2's residual overlap.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents