[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EG3PESMMBTPF2A5RXYZ0ST":3,"skill-same:01M6EG3PESMMBTPF2A5RXYZ0ST":50},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":32,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M6EG3PESMMBTPF2A5RXYZ0ST","schemathesis",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FTerminalSkills\u002Fskills\u002Fschemathesis\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[5],"2026-11-10 10:12:30",false,"# Schemathesis\n\n## Overview\n\nAutomatically generate and run API tests from OpenAPI and GraphQL schemas. Schemathesis finds bugs by generating thousands of test cases — boundary values, invalid types, malformed payloads, deep nesting — that developers never think to write manually.\n\n## Instructions\n\n### Installation\n\n```bash\npip install schemathesis\n\n# Or with all extras\npip install schemathesis[all]\n```\n\n### Quick Start\n\n```bash\n# Test a live API using its OpenAPI schema\nst run https:\u002F\u002Fapi.example.com\u002Fopenapi.json\n\n# Test from a local schema file\nst run .\u002Fopenapi.yaml --base-url http:\u002F\u002Flocalhost:8080\n\n# Test a GraphQL API\nst run https:\u002F\u002Fapi.example.com\u002Fgraphql\n```\n\n### How It Works\n\nSchemathesis reads your API schema (OpenAPI 2.0\u002F3.0\u002F3.1 or GraphQL) and:\n\n1. **Generates test cases** — valid and invalid inputs based on parameter types, constraints, and formats\n2. **Sends requests** — fires thousands of combinations at your API\n3. **Checks for failures** — 500 errors, schema violations, response timeouts, crashes\n4. **Shrinks failures** — reduces failing test cases to the minimal reproducible example\n5. **Reports results** — shows exactly which input caused which failure\n\n```\nSchema → Generator → Request → Response → Checker → Report\n         ├── Valid values        ├── Status code OK?\n         ├── Boundary values     ├── Response matches schema?\n         ├── Invalid types       ├── No 500 errors?\n         ├── Null\u002Fempty          ├── Response time OK?\n         ├── Overflow values     └── No crashes?\n         └── Unicode\u002Fspecial chars\n```\n\n### CLI Options\n\n```bash\n# Basic testing\nst run https:\u002F\u002Fapi.example.com\u002Fopenapi.json\n\n# Authentication\nst run URL --auth user:password                    # Basic auth\nst run URL --header \"Authorization: Bearer TOKEN\"  # Bearer token\nst run URL --header \"X-API-Key: KEY\"               # API key\n\n# Target specific endpoints\nst run URL --include-path \"\u002Fapi\u002Fusers\"             # Only test \u002Fapi\u002Fusers\nst run URL --include-method POST                   # Only test POST endpoints\nst run URL --exclude-path \"\u002Fapi\u002Fadmin\"             # Skip admin endpoints\n\n# Control test volume\nst run URL --hypothesis-max-examples=500    # Max test cases per endpoint\nst run URL --hypothesis-deadline=5000       # Max ms per test case\nst run URL --workers 4                      # Parallel workers\n\n# Output\nst run URL --report                     # Generate HTML report\nst run URL --cassette-path=cassette.yaml  # Save all requests\u002Fresponses\nst run URL --junit-xml=results.xml      # JUnit format for CI\n```\n\n### Test Strategies\n\n### Negative testing\n\nSchemathesis automatically generates inputs that violate schema constraints:\n\n```\nIf schema says: { \"type\": \"integer\", \"minimum\": 1, \"maximum\": 100 }\nSchemathesis tries: 0, -1, -2147483648, 101, 999999999, null, \"string\", 1.5, []\n\nIf schema says: { \"type\": \"string\", \"format\": \"email\" }\nSchemathesis tries: \"\", \"not-an-email\", \"a@b\", null, 12345, very-long-string...\n\nIf schema says: { \"type\": \"array\", \"maxItems\": 10 }\nSchemathesis tries: [], [1000 items], null, \"not-array\", nested arrays...\n```\n\n### Stateful testing (link-based)\n\nSchemathesis can chain API calls using OpenAPI links:\n\n```bash\n# Enable stateful testing — creates resources, then tests operations on them\nst run URL --stateful=links\n\n# Example flow:\n# 1. POST \u002Fusers → creates user, gets ID\n# 2. GET \u002Fusers\u002F{id} → uses the created ID\n# 3. PUT \u002Fusers\u002F{id} → updates with fuzzed data\n# 4. DELETE \u002Fusers\u002F{id} → cleanup\n```\n\nThis catches bugs that only appear with real resource IDs, not random values.\n\n### Custom checks\n\n```python\n# custom_checks.py\n# Add custom validation logic to Schemathesis test runs\n\nimport schemathesis\n\n@schemathesis.check\ndef no_sensitive_data_in_errors(response, case):\n    \"\"\"Ensure error responses don't leak sensitive information.\n    \n    Checks that 4xx\u002F5xx responses don't contain stack traces,\n    database queries, or internal paths.\n    \"\"\"\n    if response.status_code >= 400:\n        body = response.text.lower()\n        sensitive_patterns = [\n            \"traceback\",\n            \"stack trace\",\n            \"sql\",\n            \"select * from\",\n            \"\u002Fusr\u002Flocal\u002F\",\n            \"\u002Fhome\u002F\",\n            \"password\",\n            \"secret\",\n            \"internal server\",\n        ]\n        for pattern in sensitive_patterns:\n            assert pattern not in body, (\n                f\"Sensitive data '{pattern}' found in error response\"\n            )\n\n@schemathesis.check\ndef response_time_acceptable(response, case):\n    \"\"\"Ensure no endpoint takes longer than 5 seconds.\n    \n    Slow responses might indicate injection vulnerabilities\n    (time-based SQL injection) or denial-of-service potential.\n    \"\"\"\n    assert response.elapsed.total_seconds() \u003C 5.0, (\n        f\"Response took {response.elapsed.total_seconds():.1f}s \"\n        f\"(limit: 5s) — possible DoS vector\"\n    )\n```\n\n```bash\n# Run with custom checks\nst run URL --checks all --hypothesis-max-examples=200\n```\n\n### Python API\n\n```python\n# test_api.py\n# Use Schemathesis in pytest for CI integration\n\nimport schemathesis\n\n# Load schema\nschema = schemathesis.from_url(\"https:\u002F\u002Fapi.example.com\u002Fopenapi.json\")\n\n# Or from file\nschema = schemathesis.from_path(\".\u002Fopenapi.yaml\", base_url=\"http:\u002F\u002Flocalhost:8080\")\n\n# Generate test cases for all endpoints\n@schema.parametrize()\ndef test_api(case):\n    \"\"\"Property-based test generated from OpenAPI schema.\n    \n    Schemathesis generates hundreds of test cases per endpoint,\n    testing boundary values, invalid types, and edge cases.\n    \"\"\"\n    response = case.call()\n    case.validate_response(response)  # Check response matches schema\n\n# Target specific endpoint\n@schema.parametrize(endpoint=\"\u002Fapi\u002Fusers\", method=\"POST\")\ndef test_create_user(case):\n    \"\"\"Test user creation with generated inputs.\"\"\"\n    response = case.call()\n    case.validate_response(response)\n    assert response.status_code != 500, f\"Server error with input: {case.body}\"\n```\n\n### CI Integration\n\n```yaml\n# .github\u002Fworkflows\u002Fapi-test.yml\nname: API Schema Testing\non: [push, pull_request]\n\njobs:\n  schemathesis:\n    runs-on: ubuntu-latest\n    services:\n      api:\n        image: your-api:latest\n        ports:\n          - 8080:8080\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      \n      - name: Run Schemathesis\n        uses: schemathesis\u002Faction@v1\n        with:\n          schema: http:\u002F\u002Flocalhost:8080\u002Fopenapi.json\n          args: >-\n            --checks all\n            --stateful=links\n            --hypothesis-max-examples=200\n            --junit-xml=results.xml\n      \n      - name: Upload results\n        if: always()\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: api-test-results\n          path: results.xml\n```\n\n### Security-Focused Testing\n\nFor penetration testing, configure Schemathesis to look for security issues:\n\n```bash\n# Test for injection vulnerabilities\n# Schemathesis will try SQL injection, XSS, and command injection payloads\n# in string parameters\nst run URL \\\n  --checks all \\\n  --hypothesis-max-examples=1000 \\\n  --header \"Authorization: Bearer TOKEN\" \\\n  --stateful=links \\\n  --report\n\n# Common findings:\n# - 500 errors on special characters → potential injection\n# - Slow responses on certain inputs → time-based injection\n# - Different error messages → information disclosure\n# - Bypassed validation → missing server-side checks\n# - Schema violations in responses → data leakage\n```\n\n## Examples\n\n### Fuzz a REST API to find crashes\n\n```prompt\nOur REST API has an OpenAPI 3.0 spec at \u002Fapi\u002Fdocs\u002Fopenapi.json. Run Schemathesis against all endpoints with 500 test cases per endpoint. Focus on finding 500 errors, schema violations, and slow responses (>3 seconds). Use stateful testing to chain CRUD operations. Generate an HTML report showing all findings with reproducible curl commands.\n```\n\n### Add API fuzzing to CI pipeline\n\n```prompt\nSet up Schemathesis in our GitHub Actions CI to run on every PR. The API starts in Docker (docker-compose up), schema is at localhost:8080\u002Fopenapi.json. Run with 200 test cases per endpoint, fail the build on any 500 error or schema violation. Output JUnit XML for GitHub's test reporter. Include authentication via Bearer token from GitHub Secrets.\n```\n\n### Security-focused API testing\n\n```prompt\nWe're doing a security assessment of our payment API. Use Schemathesis to test all endpoints with maximum fuzzing intensity. Check for: SQL injection indicators (500 errors with special chars), information disclosure in error responses, slow queries suggesting time-based injection, and missing input validation. Produce a security findings report with severity ratings.\n```\n\n## Guidelines\n\n- Always test against staging or development environments first — never fuzz a production API without explicit authorization\n- Start with a low `--hypothesis-max-examples` value (50-100) to validate setup before running full intensity\n- Use `--workers` carefully — too many parallel workers can overwhelm the target and cause false failures\n- Ensure your OpenAPI\u002FGraphQL schema is up to date — stale schemas produce misleading results\n- Schemathesis finds crashes and violations but does not confirm exploitability — triage 500 errors manually\n- Use `--cassette-path` to record all requests for reproducibility and audit trails\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FTerminalSkills\u002Fskills\u002Fschemathesis",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill schemathesis",{"tool":42,"command":43},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill schemathesis",{"tool":45,"command":46},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill schemathesis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FTerminalSkills\u002Fskills\u002Fschemathesis\u002FSKILL.md",true,[],[51,63,73,82,88,95],{"skillNo":52,"name":53,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":59,"publishedAt":23},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[56],{"categoryNo":57,"categoryName":58,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[60,61,62],"model","model hierarchy","model hierarchy skill",{"skillNo":64,"name":65,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":69,"publishedAt":23},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[68],{"categoryNo":57,"categoryName":58,"taxonomyType":20,"taxonomyTypeDesc":21},[70,71,72],"MCP","zoom","zoom mcp",{"skillNo":74,"name":75,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":23},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[79,80,81,71],"sdk","zoom apps sdk","apps",{"skillNo":83,"name":84,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[84],{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":94,"publishedAt":23},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[93],{"categoryNo":57,"categoryName":58,"taxonomyType":20,"taxonomyTypeDesc":21},[90],{"skillNo":96,"name":97,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":23},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[97]]