user-story-capture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited user-story-capture (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Derive structured user stories and acceptance criteria from exploration session captures.
python ./scripts/execute.py \
--input <file> [<file2>...] \
--format <standard|gherkin> \
--output <output_file.md>Formats:
standard (default): As a [user type], I want [goal], so that [benefit] — with priority table and gaps.gherkin: Standard + Given / When / Then Acceptance Criteria blocks per story.Flags:
--input PATH [PATH ...] : Session brief, BRD draft, prototype notes, or prior captures--output PATH : Destination file (default: exploration/captures/user-stories-draft.md)--format FORMAT : Output format (default: standard)When invoked interactively, follow this 3-stage pattern. Do not dump a full story list at once.
Ask all three questions in a single message before generating anything:
exploration/ — list what you find: session brief, BRD draft, prototype notes.) If no files exist, stop and ask for input before proceeding.As a / I want / So that) or Gherkin (Given / When / Then)? Default to standard unless Gherkin is requested.After the user responds: read each input file they identify.
Build the backlog in layers — do not jump straight to full Gherkin blocks.
[UNCONFIRMED].As a [actor], I want [goal], so that [benefit].Given / When / Then AC blocks after the story statement.Gherkin format rules:
Given = precondition or system state before the action (what is already true)When = the single action or event the actor performsThen = the observable, testable outcome (what changes or appears)When per scenario. Use And for additional Given or Then clauses.Present each story and ask: "Accurate? Anything to add or change?" Apply edits before the next story.
After all approved stories are drafted:
Given / When / Then blocks for the confirmed edge cases. Mark inferred edge cases [UNCONFIRMED] until the user confirms they are real scenarios.## Story Gaps section at the end.[UNCONFIRMED] — only promote to [CONFIRMED] after human sign-off.(source: brd-draft.md, Functional Requirements)). Stories with no traceable source must be marked [UNCONFIRMED — inferred, not in source].<example> Context: BRD draft is complete, user wants a core story set. user: "Generate user stories from our BRD." assistant: "I'll run user-story-capture in standard format to derive a prioritised story set." </example>
<example> Context: User wants stories with ready-to-use Acceptance Criteria. user: "Create Gherkin acceptance criteria for these requirements." assistant: "I'll run user-story-capture --format gherkin to produce stories with Given/When/Then AC blocks." </example>
<example> Context: Pre-sprint refinement. user: "Write acceptance criteria for the checkout flow stories." assistant: "I'll use user-story-capture --format gherkin with the checkout BRD sections as input." </example>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.