CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

testland/schemathesis-fuzzing

Use whenever an API has an OpenAPI or GraphQL schema and needs tests generated from it: fuzzing every endpoint for 5xx errors and schema violations. Runs Schemathesis from the CLI or pytest, picks the conformance checks and gates CI on failures as the API evolves.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, highly actionable skill body: executable commands throughout, dense reference tables, thoughtful anti-patterns and limitations, and a clean split between the inline overview and a single well-signaled reference file. The main improvement opportunities are removing the duplicated install/run material and making validation steps more explicit in the main workflow.

Suggestions

Fold the Install section into 'How to use' step 2 — the pip and uvx commands are already stated there — and drop the explanation of what uvx is to remove the duplication.

Promote validation to explicit numbered checkpoints in 'How to use' (e.g., 'Step 3b: reproduce any failure via the printed curl command + Hypothesis seed before proceeding to the CI gate') so the feedback loop is visible in the sequence itself.

The basic invocation `schemathesis run <schema-url>` appears in both step 3 of 'How to use' and the 'Running via CLI' section; state it once and keep the detailed flags in the CLI section.

DimensionReasoningScore

Conciseness

The body is largely dense and earning its tokens (flags table, checks table, anti-patterns table, worked example) with no padding explaining basic concepts, but there are trimmable redundancies: the pip/uvx install commands appear both in "How to use" step 2 and again in a separate Install section, and it explains what `uvx` is ("the `uv` runner for one-off tool execution") — something Claude already knows. This sits at anchor 4 ("efficient; minor instances of over-explanation") rather than anchor 3, since the over-explanation is incidental rather than pervasive.

4 / 5

Actionability

Everything is executable and copy-paste ready: `pip install schemathesis` / `uvx schemathesis run <schema-url>`, a fully populated worked CLI example with real flag values, exact check names (`status_code_conformance`, `not_a_server_error`, ...), a runnable pytest snippet, and a complete GitHub Actions workflow in the reference. Anchor 5's "specific examples cover the common cases" is met (basic run, strict run, 5xx-only smoke test, pytest integration, CI).

5 / 5

Workflow Clarity

The 4-step "How to use" sequence is clear and safety-conscious (run against staging, never prod — reinforced by the anti-patterns table), and includes a genuine error-recovery mechanism ("reproduce any failure from the printed `curl` command + Hypothesis seed", "Triage every failure"). It falls short of anchor 5 because validation is woven into prose rather than appearing as explicit numbered checkpoints with feedback loops, leaving minor gaps like when to re-run after a schema amendment.

4 / 5

Progressive Disclosure

The SKILL.md body is a well-organized overview that keeps deep CI wiring and auth hooks in references/ci-and-pytest-integration.md (a real file, verified), cited three times with purpose statements ("deep CI wiring and advanced auth hooks live in...", "The full GitHub Actions workflow... and the per-PR / nightly / weekly cadence table live in..."). The reference is exactly one level deep with no nested references, matching anchor 5's clear overview with well-signaled one-level-deep references.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted description: third-person voice, explicit 'Use whenever' trigger, multiple concrete capabilities, and a distinct tool-named niche. Its only weakness is synonym coverage — most notably the absent 'Swagger' shorthand that many users say instead of OpenAPI.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — "fuzzing every endpoint for 5xx errors and schema violations", "Runs Schemathesis from the CLI or pytest", "picks the conformance checks", "gates CI on failures" — comprehensively covering the skill's generate/fuzz/detect/gate workflow. It matches the anchor-5 example's breadth; anchor 4 would require minor coverage gaps, and none are apparent.

5 / 5

Completeness

Both halves are explicit: the what ("fuzzing every endpoint for 5xx errors and schema violations... picks the conformance checks and gates CI on failures") and the when ("Use whenever an API has an OpenAPI or GraphQL schema and needs tests generated from it"). This mirrors the anchor-5 example with a clear 'Use when' clause and concrete trigger conditions; anchor 4 would need a vaguer 'when'.

5 / 5

Trigger Term Quality

Strong natural keywords: "OpenAPI", "GraphQL schema", "fuzzing", "5xx errors", "schema violations", "pytest", "CI" — phrases users would actually say. However, common synonyms like "Swagger" (the most frequent user shorthand for OpenAPI specs), "spec", and "property-based testing" are absent, so it falls at anchor 4 ("good keyword coverage; a few natural terms missing") rather than the comprehensive synonym coverage of anchor 5.

4 / 5

Distinctiveness Conflict Risk

It carves a clear niche — schema-derived test generation via a named tool ("Schemathesis") triggered by the presence of an OpenAPI/GraphQL schema — which distinguishes it from generic example-based API-testing skills. Anchoring on a specific tool name plus schema presence gives minimal conflict risk, matching anchor 5; anchor 4 would imply notable overlap with closely related skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

On this page