Security Requirement Extraction

The security-requirement-extraction skill translates threat models and business contexts into actionable security requirements, user stories, and test cases. It serves security architects, developers, and compliance teams who need to convert threat analysis into testable, prioritized security controls mapped to compliance frameworks. This skill solves the problem of bridging the gap between abstract security threats and concrete, implementable requirements with clear traceability and acceptance criteria.

skills.sh installs: 26.4K
GitHub stars: 42.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add wshobson/agents --skill security-requirement-extraction --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Requirement Extraction

Transform threat analysis into actionable security requirements.

When to Use This Skill

Converting threat models to requirements
Writing security user stories
Creating security test cases
Building security acceptance criteria
Compliance requirement mapping
Security architecture documentation

Core Concepts

1. Requirement Categories

Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"

2. Security Requirement Types

Type	Focus	Example
Functional	What system must do	"System must authenticate users"
Non-functional	How system must perform	"Authentication must complete in <2s"
Constraint	Limitations imposed	"Must use approved crypto libraries"