security-requirement-extraction
Converts abstract threat models into concrete, testable security requirements and user stories.
Install
mkdir -p .claude/skills/security-requirement-extraction && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/496" && unzip -o skill.zip -d .claude/skills/security-requirement-extraction && rm skill.zipInstalls to .claude/skills/security-requirement-extraction
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.Key capabilities
- →Maps business goals to technical security controls
- →Writes structured security user stories
- →Defines testable security acceptance criteria
- →Traces requirements to specific threats
- →Documents compliance and constraint requirements
How it works
The agent translates high-level business objectives into specific functional and non-functional security requirements, ensuring each is testable and mapped to a threat.
Inputs & outputs
When to use security-requirement-extraction
- →Create security user stories
- →Define security acceptance criteria
- →Map threats to technical controls
- →Document compliance requirements
About this skill
Security Requirement Extraction
Transform threat analysis into actionable security requirements.
When to Use This Skill
- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation
Core Concepts
1. Requirement Categories
Business Requirements → Security Requirements → Technical Controls
↓ ↓ ↓
"Protect customer "Encrypt PII at rest" "AES-256 encryption
data" with KMS key rotation"
2. Security Requirement Types
| Type | Focus | Example |
|---|---|---|
| Functional | What system must do | "System must authenticate users" |
| Non-functional | How system must perform | "Authentication must complete in <2s" |
| Constraint | Limitations imposed | "Must use approved crypto libraries" |
3. Requirement Attributes
| Attribute | Description |
|---|---|
| Traceability | Links to threats/compliance |
| Testability | Can be verified |
| Priority | Business importance |
| Risk Level | Impact if not met |
Templates and detailed worked examples
Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.
Best Practices
Do's
- Trace to threats - Every requirement should map to threats
- Be specific - Vague requirements can't be tested
- Include acceptance criteria - Define "done"
- Consider compliance - Map to frameworks early
- Review regularly - Requirements evolve with threats
Don'ts
- Don't be generic - "Be secure" is not a requirement
- Don't skip rationale - Explain why it matters
- Don't ignore priorities - Not all requirements are equal
- Don't forget testability - If you can't test it, you can't verify it
- Don't work in isolation - Involve stakeholders
When not to use it
- →When requirements are not derived from threat models or business context
Limitations
- →Requires input from stakeholders for accurate prioritization
- →Cannot replace manual security architecture review
How it compares
It enforces traceability and testability in security requirements, whereas manual documentation often results in vague or untestable security goals.
Compared to similar skills
security-requirement-extraction side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-requirement-extraction (this skill) | 7 | 2mo | No flags | Intermediate |
| audit-prep-assistant | 1 | 2mo | Review | Intermediate |
| code-review-checklist | 3 | 26d | No flags | Beginner |
| health | 0 | 2mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by wshobson
View all by wshobson →You might also like
audit-prep-assistant
trailofbits
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).
code-review-checklist
vudovn
Code review guidelines covering code quality, security, and best practices.
health
matteocervelli
Holistic project audit across endpoints, versions, docs, security, quality, CI, and library dimensions. Use when checking overall project health or running a periodic cross-cutting audit. Trigger on "project health", "audit the project", "health check", "is this project in good shape".
release
serithemage
Runs a comprehensive release review before tagging and publishing a new version. Reviews code, docs, tests, security, cost, and operations; use platform-native parallelism when available and a sequential fallback otherwise.
pr-review
microsoft
Multi-dimensional review of a PR or feature branch in the microsoft/winappcli repo. Activate when a contributor asks to "review my PR", "review my changes", "vet my branch before pushing", "do a full review", "PR review", "review this feature", or similar. Fans out parallel sub-agents covering secur
full-audit
oscardlfr
Run a unified audit across all quality dimensions — architecture, code quality, testing, security, docs, and release readiness. Consolidates findings from multiple agents and scripts into a single deduplicated report.