skills.rest
oliverconstance
oliverconstanceCOMMUNITY
Explore all skills by this author →
GitHub

gherkin-qa-audit

Audits backend and frontend deliverables against Gherkin BDD criteria, OWASP Top 10, and GCP IAM standards.

Updated Jul 24, 2026
Search Tags:#owasp#acceptance criteria#security review#bdd#gherkin#gcp iam#qa audit
One-click install
npx skills add https://github.com/oliverconstance/webapp-scrum-team --skill gherkin-qa-audit-oliverconstance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gherkin-qa-audit
Source: https://github.com/oliverconstance/webapp-scrum-team/tree/main/.agent/skills/gherkin-qa-audit
Command: npx skills add https://github.com/oliverconstance/webapp-scrum-team --skill gherkin-qa-audit-oliverconstance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Software deliverables in a multi-agent development workflow need consistent, rigorous quality and security review before deployment. This Skill provides a standard operating procedure for auditing code against Gherkin BDD acceptance criteria, OWASP Top 10 vulnerabilities, and GCP IAM least-privilege rules, then emitting a machine-readable verdict. ## Core Features & Use Cases - Gherkin Compliance Auditing: Verifies each Scenario's Given/When/Then steps against actual code behavior, including all five frontend UX states (Ideal, Loading, Error, Empty, Degraded). - Security & IAM Inspection: Checks for injection flaws, broken authentication, hardcoded secrets, and over-privileged GCP service account roles. - Strict JSON Verdict Output: Produces a PASS/FAIL JSON payload consumed by the orchestration circuit breaker to trigger deployment or remediation. - Use Case: As the qa_sec agent, audit a backend pull request against TICKET-BACKEND-042's acceptance criteria, detect a hardcoded API key, and return a FAIL verdict with actionable remediation feedback. ## Quick Start Audit the pull request for TICKET-BACKEND-042 against its Gherkin acceptance criteria and OWASP security baselines, then return the verdict as strict JSON.

Frequently Asked Questions about gherkin-qa-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit code against Gherkin acceptance criteria?▼

Verify each Scenario's Given precondition state, trace the execution path triggered by the When action, and assert that HTTP status codes, JSON payloads, or UX state transitions match the Then clause. Frontend audits must also cover Ideal, Loading, Error, Empty, and Degraded states.

What security checks should a QA audit cover for GCP applications?▼

Check for SQL/NoSQL injection via parameterized queries, enforce JWT/OIDC or Knative IAM invoker authentication, prevent hardcoded secrets by requiring GCP Secret Manager retrieval, and reject primitive IAM roles like roles/owner in favor of granular bindings.

Why does the circuit breaker fail to parse the QA audit response?▼

The circuit breaker expects a strict JSON object with no conversational filler before or after it. Output only the JSON payload, optionally in a markdown code block, with status set to exactly PASS or FAIL in uppercase.

What JSON format does the QA audit verdict use?▼

The verdict contains a status field set to PASS or FAIL, a failed_criteria array listing specific scenario or security failures, and an actionable_feedback string describing what engineers must fix. The circuit breaker consumes this to decide deployment versus remediation.

Can this audit process work with pytest, Cypress, or Playwright?▼

Yes, the procedure assumes an automated testing framework such as pytest, Cypress, Playwright, or a Gherkin parser is available in CI/CD to validate functional compliance against the acceptance criteria defined in execution tickets.

Related Skills

Explore More Software Engineering Skills→
pingwupingwu
12

test-first-development

Generate BDD/Gherkin feature files and TDD test scaffolding before coding.

Community
Intermediate
githubgithub
38.5k

agent-owasp-compliance

Audit AI agent codebases against the OWASP Agentic Security Initiative Top 10 risks.

Official
Intermediate
JeffallanJeffallan
10.9k

test-master

Automate unit, integration, E2E, performance, and security testing across CI/CD pipelines.

Community
Advanced
MetaMaskMetaMask
3.0k

pr-manual-testing

Generate Gherkin-format manual testing steps from pull request diffs.

Official
Intermediate