security-requirement-extraction
Helps your agent define security rules from threat plans. It turns risks into clear requirements to protect systems and applications.
What it does
This tool helps turn security threat ideas into clear, actionable rules for a system to follow. It transforms threat analysis into actionable security requirements.
When to use it
- ✓When converting threat models into requirements.
- ✓When writing security-focused user stories.
- ✓When creating test cases to verify security.
Example of what to ask your AI
“Turn these threats into security requirements: 'Unauthorized access to customer data' and 'Exposure of sensitive information'.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool analyzes identified threats and business context to generate specific requirements. It categorizes these requirements (what the system must do, how it must perform, or limitations) and adds important details like traceability and priority.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add wshobson/agents --skill security-requirement-extractionOr download just the file:
curl -L https://raw.githubusercontent.com/wshobson/agents/main/plugins/security-scanning/skills/security-requirement-extraction/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Security Requirement Extraction
Transform threat analysis into actionable security requirements.
When to Use This Skill
- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation
Core Concepts
1. Requirement Categories
Business Requirements → Security Requirements → Technical Controls
↓ ↓ ↓
"Protect customer "Encrypt PII at rest" "AES-256 encryption
data" with KMS key rotation"
2. Security Requirement Types
| Type | Focus | Example |
|---|---|---|
| Functional | What system must do | "System must authenticate users" |
| Non-functional | How system must perform | "Authentication must complete in <2s" |
| Constraint | Limitations imposed | "Must use approved crypto libraries" |
3. Requirement Attributes
| Attribute | Description |
|---|---|
| Traceability | Links to threats/compliance |
| Testability | Can be verified |
| Priority | Business importance |
| Risk Level | Impact if not met |
Templates and detailed worked examples
Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.
Best Practices
Do's
- Trace to threats - Every requirement should map to threats
- Be specific - Vague requirements can't be tested
- Include acceptance criteria - Define "done"
- Consider compliance - Map to frameworks early
- Review regularly - Requirements evolve with threats
Don'ts
- Don't be generic - "Be secure" is not a requirement
- Don't skip rationale - Explain why it matters
- Don't ignore priorities - Not all requirements are equal
- Don't forget testability - If you can't test it, you can't verify it
- Don't work in isolation - Involve stakeholders
FAQ
What are security requirements?
These are specific rules that define how a system must protect information and operate securely, based on potential threats.
Why is it important to trace requirements to threats?
It ensures that every security rule created has a clear purpose and is directly linked to an identified risk, preventing unnecessary or incomplete requirements.
What's the difference between functional and non-functional security requirements?
Functional requirements state what the system MUST DO to be secure (e.g., authenticate users). Non-functional requirements state HOW the system MUST PERFORM regarding security (e.g., fast authentication).
Details
Original description by the author
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
repo: wshobson/agents
Popularity
- GitHub stars
- 41k
- Ranking position
- #4947
- License
- MIT
- Updated
- 10/15/2026
Comments
- …
More skills from this repository
screen-reader-testing
Has your agent test websites using screen readers to ensure they are accessible.
wshobson/agents
wcag-audit-patterns
Helps your agent audit websites for accessibility and fix issues according to WCAG guidelines.
wshobson/agents
multi-reviewer-patterns
Enables your agent to coordinate parallel code reviews, deduplicating findings and consolidating reports.
wshobson/agents
parallel-debugging
Allows the agent to debug complex issues with parallel investigations and root cause analysis.
wshobson/agents
Similar skills
django-security
Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.
affaan-m/ECC
laravel-security
Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.
affaan-m/ECC
module-regression
Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.
affaan-m/ECC