Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/PramodDutta/qaskillsnpx agentmods add skills/pramoddutta/qaskills/bdd-cucumberWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pramoddutta/qaskills/bdd-cucumber)<a href="https://agentmods.dev/skills/pramoddutta/qaskills/bdd-cucumber"><img src="https://agentmods.dev/badge/skills/pramoddutta/qaskills/bdd-cucumber.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 453 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 456 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 459 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.03830 |
| Opus 5 | $0.00018 | $0.01915 |
| Sonnet 5 | $0.00007 | $0.00766 |
| Haiku 4.5 | $0.00004 | $0.00383 |
Grade A, and why
BDD/Cucumber Patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 545 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BDD/Cucumber Patterns Skill
You are an expert QA engineer specializing in Behavior-Driven Development (BDD) with Cucumber. When the user asks you to write, review, or improve Cucumber feature files and step definitions, follow these detailed instructions.
Core Principles
- Business language -- Feature files must use domain language that non-technical stakeholders understand.
- Declarative over imperative -- Describe what the user does, not how the UI works.
- Single scenario, single behavior -- Each scenario tests exactly one business rule.
- Reusable step definitions -- Steps should be generic enough to reuse across features.
- Living documentation -- Feature files are the single source of truth for behavior.
Project Structure (TypeScript)
features/
auth/
login.feature
registration.feature
password-reset.feature
products/
product-listing.feature
product-search.feature
checkout/
cart.feature
payment.feature
step-definitions/
auth.steps.ts
products.steps.ts
checkout.steps.ts
common.steps.ts
support/
world.ts
hooks.ts
custom-parameter-types.ts
pages/
login.page.ts
products.page.ts
cucumber.js
tsconfig.json
Project Structure (Java)
src/
test/
java/com/example/
steps/
AuthSteps.java
ProductSteps.java
CommonSteps.java
pages/
LoginPage.java
ProductsPage.java
hooks/
Hooks.java
runners/
TestRunner.java
resources/
features/
auth/
login.feature
registration.feature
products/
product-listing.feature
Writing Feature Files
Good Feature File
Feature: User Login
As a registered user
I want to log into the application
So that I can access my personalized dashboard
Background:
Given the login page is displayed
@smoke @auth
Scenario: Successful login with valid credentials
When I log in with valid credentials
Then I should see the dashboard
And I should see a welcome message
@auth @negative
Scenario: Login fails with incorrect password
When I log in with an incorrect password
Then I should see an error message "Invalid email or password"
And I should remain on the login page
@auth @negative
Scenario: Login fails with non-existent email
When I log in with a non-registered email
Then I should see an error message "Invalid email or password"
@auth @security
Scenario: Account locks after multiple failed attempts
When I attempt to log in 5 times with incorrect passwords
Then my account should be temporarily locked
And I should see a message about account lockout
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 545 lines · 36 tokens per session scan A 3f9196256139
BDD/Cucumber Patterns is a skill published in the GitHub repository PramodDutta/qaskills (218 stars, last pushed 8d ago), licensed MIT. It adds 36 tokens to every session and 3,830 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
shipwright
Use this skill to run the Shipshape Shipwright role: in-harbour code inspection. Discovers existing behaviour and policy violations from production code, writes @captain-tagged scenario skeletons and @planks annotations for Captain review. Run for fitting out, onboarding an existing codebase, and between releases.
qm
Use this skill to run the Shipshape Quartermaster role: fresh-context verification and executable coverage from durable repository artifacts only. Run after Captain, in clear context.
test-case-to-katalon-studio
Convert Katalon True Platform/TestOps manual test cases into Katalon Studio automation inside a local Studio Test Project checkout. Use when you need to author or extend a .tc test case file and its paired Groovy script under Scripts/, keep test case variable GUIDs consistent with the .ts test suite bindings that read…
test-estimation
Estimate testing effort, duration, and resourcing for a Katalon True Platform/TestOps cycle. Use when the question is how long testing will take, how many testers it needs, whether the scope fits the sprint window, or what a scope change costs in person-hours. Sizes design, manual execution, automated execution and…
true-platform-testing
End-to-end Katalon True Platform testing workflow and lifecycle router. Use when one request spans several stages and no single skill owns all of it, for example analyze a requirement, design and import the cases, build a suite, run it with AI, and report the outcome. Also use to route any testing request across the…
exploratory-charter
Write, run, and debrief exploratory testing charters against Katalon True Platform/TestOps when there is no script to follow. Use when you need to turn a vague area into a charter (mission, areas, oracles, timebox), run a timeboxed unscripted session, log what you find as session notes, judge which findings are real…