Schemathesis
- 1 installs
- 12 repo stars
- Updated August 4, 2026
- aeondave/malskill
schemathesis is a Claude Code skill for an OpenAPI/GraphQL property-based API fuzzer that auto-generates tests to catch schema violations and server errors.
About
schemathesis is a Claude Code skill for schema-driven API fuzzing. It generates tests automatically from an OpenAPI or GraphQL schema, detects server errors and schema-conformance violations, and supports stateful operation sequences. Developers and AppSec engineers use it to catch contract drift and validation bugs, running fast smoke checks on PRs and longer campaigns nightly.
- Property-based API fuzzing driven by an OpenAPI or GraphQL schema
- Detects 500s, schema/contract drift, and validation bypasses automatically
- CI pattern: fast smoke on PRs, deep stateful campaigns nightly
Schemathesis by the numbers
- 1 all-time installs (skills.sh)
- Ranked #1,750 of 2,153 Testing & QA skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
schemathesis capabilities & compatibility
Free open-source (MIT); runs via uvx or installed CLI.
- Capabilities
- api fuzzing · contract testing · schema validation
- Use cases
- testing · api development · security audit
- Pricing
- Free
What schemathesis says it does
Schema-driven API fuzzing for developer and AppSec workflows.
- Detects 500s, contract/schema drift, validation bypasses.
npx skills add https://github.com/aeondave/malskill --skill schemathesisAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 1 |
|---|---|
| repo stars | ★ 12 |
| Last updated | August 4, 2026 |
| Repository | aeondave/malskill ↗ |
What it does
Auto-generate property-based tests from an API schema to catch 500s, schema drift, and validation bypasses in REST or GraphQL services.
Who is it for?
Auto-generating high-coverage API tests from an OpenAPI or GraphQL schema.
Skip if: Fixing every first-run failure globally at once.
When should I use this skill?
You want to fuzz a REST or GraphQL API against its schema in CI or before a release gate.
What you get
Large input spaces are generated from the schema to surface 500s and contract violations.
By the numbers
- 5-step operator flow
- deep run example: --max-examples 1000
Files
schemathesis
Schema-driven API fuzzing for developer and AppSec workflows.
Quick Start
# CLI
uvx schemathesis run https://example.schemathesis.io/openapi.json
# Installed CLI
schemathesis run https://your-api/openapi.jsonimport schemathesis
schema = schemathesis.openapi.from_url("https://your-api/openapi.json")
@schema.parametrize()
def test_api(case):
case.call_and_validate()Operator Flow
1. First run with defaults to map baseline failure landscape. 2. Triage in this order: undocumented status codes -> schema conformance -> server errors. 3. Narrow scope by tag/path to fix incrementally. 4. Run longer optimization profile for release/security gates. 5. Keep CI smoke + nightly deep profiles separated.
Strengths
- Generates large input space from API schema automatically.
- Detects 500s, contract/schema drift, validation bypasses.
- Supports stateful API workflows (operation sequences).
Optimization Profile (Deep Runs)
schemathesis run <schema_url> \
--max-examples 1000 \
--continue-on-failureOften paired with targeted generation and health-check suppression on complex schemas.
Practical Tricks
- Use include-path/include-tag scope to eliminate triage noise.
- Keep one strict schema-conformance pass and one exploratory bug-hunting pass.
- Export machine-readable artifacts (JUnit/Allure) for team triage.
- Re-run minimal reproducer from failing example before opening defect ticket.
Common Pitfalls
- Trying to fix every first-run failure globally at once.
- Ignoring repetitive undocumented status patterns that should be schema-level fixes.
- Treating long-run health-check warnings as always ignorable.
CI Pattern
- Run fast smoke profile on PRs.
- Run longer stateful/negative campaigns nightly.
- Publish JUnit/Allure artifacts for triage.
Resources
- https://github.com/schemathesis/schemathesis
- https://schemathesis.readthedocs.io/
- https://schemathesis.readthedocs.io/en/stable/guides/triage/
- https://schemathesis.readthedocs.io/en/stable/guides/config-optimization/
Related skills
TddFollow test-driven development with a strict red-green-refactor loop when creating reliable features or fixing bugs.544k196k
Test Driven DevelopmentEnforce writing failing tests before any production implementation code.181k264kQaRun conversational QA sessions that turn user-reported bugs into well-written, domain-aware GitHub issues without manual ticket writing.179k196kMigrate To ShoehornAutomatically update TypeScript test files that rely on unsafe `as` type assertions by replacing them with type-safe partial objects from @total-typescript/shoehorn.164k196k
Webapp TestingVerify frontend behavior, debug UI issues, capture screenshots, and inspect logs of a running local web application using Playwright.123k165k
Playwright CliRun browser automation, generate element snapshots, inspect DOM attributes, and execute Playwright tests from the terminal.102k12.3kFAQ
What triage order does it recommend?
Undocumented status codes, then schema conformance, then server errors.
How should it run in CI?
A fast smoke profile on PRs and longer stateful/negative campaigns nightly, publishing JUnit/Allure artifacts.