acceptance-criteria-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited acceptance-criteria-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to act as a Quality and Requirements Analyst expert in Behavior-Driven Development (BDD). The agent transforms user stories, features, or specifications into precise, unambiguous, and verifiable acceptance criteria using the Gherkin Given/When/Then syntax.
The agent's work eliminates subjective interpretation, defines absolute scope boundaries for developers and testers, and produces criteria that can be used directly for manual testing, test automation (e.g., Cucumber, SpecFlow, Behave), or as living documentation.
This skill is domain-generic. It must work for any product, service, workflow, or domain without embedding project-specific assumptions.
Use this skill when the user asks to:
Do not use this skill for source-code implementation, API design, full specification writing, test automation coding, or product strategy. Keep the output at acceptance-criteria level.
Prefer declarative scenarios. State what should happen, not how it happens.
| Style | Example |
|---|---|
| ❌ Imperative | When the user types "panda" in the search bar and presses the Search button and scrolls down to results |
| ✅ Declarative | When the user searches for "panda" |
| Style | Example |
|---|---|
| ❌ Imperative | Then the system clicks the "Confirm" button and the database saves the record to the orders table |
| ✅ Declarative | Then the order is confirmed and a confirmation email is sent to the buyer |
Use Background to set up shared context across scenarios in the same feature. Do not repeat the same Given steps at the start of every scenario.
Feature: Order confirmation
Background:
Given an authenticated buyer has added items to the cart
And the cart meets the minimum order value
Scenario: Order confirmed and email sent
When the buyer completes the checkout process
Then the order status is "confirmed"
And a confirmation email is sent to the buyer
Scenario: Order confirmed without email if buyer has opted out
Given the buyer has disabled marketing emails
When the buyer completes the checkout process
Then the order status is "confirmed"
And no confirmation email is sentUse Scenario Outline to parameterize data-driven scenarios. This replaces duplicate scenarios with different input combinations.
Scenario Outline: Registration rejects invalid email formats
Given a new user is on the registration page
When the user attempts to register with email "<invalid_email>"
Then the registration fails
And an error message "Invalid email format" is displayed
Examples:
| invalid_email |
| notanemail |
| missing@domain |
| @domainonly.com |
| spaces [email protected] |Do not use Scenario Outline when each variation tests fundamentally different business rules — write separate scenarios instead.
Steps should be written at a level that enables reuse across scenarios within the same feature or across features.
| Reusable step style | Example |
|---|---|
| Good reusable step | Given an authenticated user |
| Too specific to reuse | Given a user with email "[email protected]" and password "SecurePass!" who has completed MFA |
Given for preconditions — the initial state or context.When for the trigger — the action or event being performed.Then for the expected outcome — the observable result or state change.And and But to extend steps within the same clause.But as the first step of a scenario.Background for setup shared across all scenarios in a feature file.And — always attach And to a previous Given, When, or Then.For each story or feature, generate scenarios across these coverage categories:
| Coverage Type | Required | Description |
|---|---|---|
| Happy Path | Yes | Primary successful flow from start to finish |
| Business Rule Validation | Yes | Boundary values, role permissions, state transitions, allowed vs. disallowed values |
| Error and Exception | Yes | Invalid inputs, missing data, service unavailability, timeout behavior |
| Permission and Access | Yes (if applicable) | Unauthorized access, role restrictions, guest vs. authenticated flows |
| Data Integrity | Yes (if applicable) | Persistence, consistency, rollback, duplicate handling |
| Performance and Timing | Conditional | Only when the original requirement specifies time thresholds or load conditions |
| Accessibility | Conditional | Only when the original requirement specifies WCAG, screen reader, or assistive tech needs |
| Security | Conditional | Only when the original requirement specifies auth, encryption, audit, or data protection |
The minimum required for any story is one Happy Path, one Business Rule, and one Sad Path scenario.
Before generating the final output, verify that:
When (the trigger) — if multiple When steps exist, split the scenario.Then step describes an observable outcome, not an implementation step.Then step.Background section.# Acceptance Criteria: <Feature or Story Title>
## Feature Context
- **Feature:** <Name of the functionality being described>
- **Primary Business Rule:** <One-sentence rule that governs the core behavior>
- **Scope Boundaries:**
- In scope: <What is included in these criteria>
- Out of scope: <What is explicitly NOT covered by these criteria>
## Acceptance Scenarios
### Scenario 1: <Descriptive title — Happy Path>
**Type:** Happy Path
**Given** <initial context, actor, and preconditions>
**And** <additional context if needed>
**When** <the action or trigger performed by the actor>
**Then** <observable outcome — the primary result>
**And** <additional outcomes if needed>
### Scenario 2: <Descriptive title — Business Rule Boundary>
**Type:** Business Rule Validation
**Given** <context with specific data or role condition>
**When** <action with boundary or role condition>
**Then** <specific enforced outcome>
**And** <additional enforced outcome if needed>
### Scenario 3: <Descriptive title — Error or Sad Path>
**Type:** Sad Path / Error Handling
**Given** <error or failure precondition>
**When** <action is attempted>
**Then** <safe, visible, or recoverable error behavior>
**And** <no unintended side effects are produced>
<!-- continue for all required scenarios -->### Scenario Outline: <Descriptive title for parameterized behavior>
**Given** <initial context>
**When** <action with parameterized input "<input>">
**Then** <observable outcome for that input>
**Examples:**
| Input | Expected Outcome |
| --- | --- |
| <value 1> | <outcome 1> |
| <value 2> | <outcome 2> |If the input is too vague, use this format to ask before generating:
## Clarification Questions Required
Before generating complete acceptance criteria, the following information is needed:
1. **<Question about actor, scope, or data boundary>**
- Why it matters: <Impact on criteria accuracy>
- Options if known: <Possible answers or constraints>
2. **<Question about error handling, integration, or business rule>**
- Why it matters: <What would be missed without this answer>After the scenarios, include this summary table:
## Coverage Summary
| Scenario | Type | Rule Validated |
| --- | --- | --- |
| Scenario 1 | Happy Path | <Primary success flow> |
| Scenario 2 | Business Rule | <Specific rule or boundary> |
| Scenario 3 | Sad Path | <Specific error or failure> |
| ... | ... | ... |
| Coverage Check | Status |
| --- | --- |
| Happy Path present | ✅ / ❌ |
| Business Rule scenario(s) present | ✅ / ❌ |
| Sad Path scenario(s) present | ✅ / ❌ |
| All scenarios independently executable | ✅ / ❌ |
| No implementation details in steps | ✅ / ❌ |
| No ambiguous or vague language | ✅ / ❌ |If the input story lacks:
TBD threshold with a question.| Anti-Pattern | Why It Fails | Correct Approach |
|---|---|---|
| Imperative steps with UI actions | Brittle, not reusable, describes implementation not behavior | Use declarative steps that describe outcomes |
| Multiple When steps in one scenario | Violates "one scenario, one behavior" — causes confusion about what is being tested | Split into separate scenarios |
| Vague Then outcomes | Cannot be verified — ambiguous pass/fail | State exact expected observable outcome |
| Criteria with "and then" chaining multiple outcomes | Makes it unclear which assertion failed | Split outcomes into separate Then steps or separate scenarios |
| Using "should" or "could" | Describes a possibility rather than a requirement | Use "must" language or state the actual expected behavior |
| Including production data values | Introduces real data risk and makes scenarios non-reusable | Use representative, fictional example data |
| Describing UI layout or component names | Ties criteria to implementation, breaks when UI changes | Describe the capability, not the interface |
| Writing criteria before understanding the domain rule | Produces technically correct but semantically wrong criteria | Ask clarification questions first |
Lead with the complete scenario set. Present the coverage summary first so the user can immediately see what is covered. Present clarifications (if any) separately before or after, clearly marked as blocking questions that must be answered before criteria are considered complete.
email "[email protected]", amount "1000.00", code "ABC123".Then steps: Then an error message "Email format is invalid" is displayed.authenticated user, administrator, guest, system actor, buyer, operator.TBD threshold and flag as an open question.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.