security-requirement-extraction
- Use it when:
- You have a threat model or business security goals and need requirements, security user stories or acceptance criteria a team can build and test against.
- It does:
- Traces each requirement from a business need to a security requirement to a technical control, typed as functional, non-functional or constraint, with priority and risk level.
- You get:
- Requirements with acceptance criteria and test specifications, security user stories grouped into epics, and mappings to PCI DSS, HIPAA, GDPR and OWASP controls.
- Works with:
- Threat models whose threats carry STRIDE categories, the six kinds of threat from spoofing and tampering to elevation of privilege, which its templates turn into requirement patterns.
TL;DR
A reference for the step after threat modeling. It sorts security requirements into functional (what the system must do), non-functional (how well it must do it) and constraints (limits such as approved crypto libraries), and gives each one a link to the threat or compliance rule behind it, a way to test it, a priority and a risk level. Its templates, written in Python and kept in a separate file, model requirements and sets of them, turn STRIDE-labelled threats into requirement patterns (spoofing becomes authentication and session rules, tampering becomes input validation and integrity checks), set priority from a threat's impact times its likelihood, map requirements to PCI DSS, HIPAA, GDPR and OWASP controls with a traceability matrix and a gap analysis, and write security user stories and epics with acceptance criteria and a definition of done. The rules: trace every requirement to a threat, make it specific enough to test, define when it's done, map to compliance early, and never write "be secure" as a requirement.
Summarizes the skill at 4bde316.
npx skills add https://github.com/wshobson/agents --skill security-requirement-extraction skills.sh pageSource on GitHubAll skills from wshobson/agents
- Total Downloads
- 26,400 on skills.sh, Nov 9, 2026
- Repo stars
- 42,334 wshobson/agents
- First seen
- Jan 20, 2026 on skills.sh
Weekly values
| Week to | Installs |
|---|---|
| Sep 21 | 739 |
| Sep 28 | 1,041 |
| Oct 5 | 1,111 |
| Oct 12 | 768 |
| Oct 19 | 831 |
| Oct 26 | 953 |
| Nov 2 | 866 |
| Nov 9 | 437 |
| Category |
Compliance, guardrails, skill vetting and browser fingerprinting. Make the agent question you and write the plan down before it writes code. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills. |
|---|---|
| Type |
Knowledge and rules the agent applies while it works: best practices, design principles, API references. |
| Effect |
Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code. |
| Needs |
Instructions only. Works in any agent that supports skills. |
| Publisher |
Everyone else. Unverified vendor claims default to community. |
| Topics |
SKILL.md
From wshobson/agents at 4bde316. Checked daily, last changed Nov 6, 2026.
Frontmatter
name: security-requirement-extraction
description: Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.Security Requirement Extraction
Transform threat analysis into actionable security requirements.
When to Use This Skill
- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation
Core Concepts
1. Requirement Categories
Business Requirements → Security Requirements → Technical Controls
↓ ↓ ↓
"Protect customer "Encrypt PII at rest" "AES-256 encryption
data" with KMS key rotation"
2. Security Requirement Types
| Type | Focus | Example |
|---|---|---|
| Functional | What system must do | "System must authenticate users" |
| Non-functional | How system must perform | "Authentication must complete in <2s" |
| Constraint | Limitations imposed | "Must use approved crypto libraries" |
3. Requirement Attributes
| Attribute | Description |
|---|---|
| Traceability | Links to threats/compliance |
| Testability | Can be verified |
| Priority | Business importance |
| Risk Level | Impact if not met |
Templates and detailed worked examples
Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.
Best Practices
Do's
- Trace to threats - Every requirement should map to threats
- Be specific - Vague requirements can't be tested
- Include acceptance criteria - Define "done"
- Consider compliance - Map to frameworks early
- Review regularly - Requirements evolve with threats
Don'ts
- Don't be generic - "Be secure" is not a requirement
- Don't skip rationale - Explain why it matters
- Don't ignore priorities - Not all requirements are equal
- Don't forget testability - If you can't test it, you can't verify it
- Don't work in isolation - Involve stakeholders