Guide · Agent skill
How to use the Security Requirement Extraction agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Security Requirement Extraction skill is a set of instructions that teaches an AI agent a structured method for converting threat analysis into security requirements. It is written for security engineers, architects and developers who already have a threat model or business context and want clear requirements, user stories and test cases from it. After this guide you will know how to install the skill, how to ask for it in plain language, and what to check in the output.
Security Requirement Extractionwshobson/agents · MIT Download the skill Quick start
- 1Download the ZIP. Get the security-requirement-extraction skill ZIP from this page.
- 2Install it. Unzip into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, upload it under Settings → Capabilities → Skills.
- 3Prepare your threat model. Gather the threats, assets, business goals and compliance frameworks that apply to the feature.
- 4Make a natural request. Describe the input and the output you want, such as security user stories or test cases.
- 5Review the output. Check that each requirement traces to a threat, is testable, and has a sensible priority and risk level.
What does the skill make the agent do?
The skill walks the agent through a chain: business goals become security requirements, and security requirements become technical controls. For example, a business goal of protecting customer data can become a requirement to encrypt PII at rest, which in turn can be implemented as AES-256 encryption with KMS key rotation.
Each requirement is classified as functional (what the system must do), non-functional (how well it must perform) or constraint (a limitation imposed on the system). Each one also gets attributes: traceability to threats or compliance frameworks, testability, priority, and risk level.
- Functional: "System must authenticate users"
- Non-functional: "Authentication must complete in <2s"
- Constraint: "Must use approved crypto libraries"
How do you install the skill?
Download the skill ZIP from this page. Then choose one of two routes.
For Claude Code, unzip the file into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it available only in that project.
In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project only: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
How do you trigger the skill with a natural request?
You do not need a special command. The skill is meant to be picked up when your request matches its description, which covers translating threats into requirements, writing security user stories, and building security test cases. Describe the threat model or feature and say what you want produced.
Good requests name the input and the output. Include the threats, the business context and the format you need, such as user stories or acceptance criteria.
- "Using our threat model below, write security requirements for the payment refund flow, each tagged with priority and traceability to the threats."
- "Turn these three threats into security user stories with acceptance criteria I can hand to developers."
- "Create security test cases for the new password reset feature."
What does a worked example look like?
The skill points the agent to a reference file, references/details.md, which holds templates and worked examples. It includes a Python security requirement model with requirement types, priority levels (critical to low), and security domains such as authentication, authorization, data protection, audit logging and input validation, plus compliance frameworks such as PCI DSS, HIPAA and GDPR.
Ask the agent to use these templates when you want a consistent structure, for example one format for all requirements in a sprint.
What do you need before you start?
The skill lists no required tools, no scripts and no network access. Its work is writing and structuring text, so the quality of the output depends on what you give it. A threat model, a list of assets and data types, and the compliance frameworks that apply will produce far more useful requirements than a one-line feature description.
The skill does not analyse your system. It will not find vulnerabilities in code or scan a running application.
- No runtime dependencies are listed
- Runs scripts: no
- Uses network: no
What are the safety notes and limits?
Because the skill runs no scripts and makes no network calls, it only shapes what the agent writes. Review the requirements as you would any draft. Treat the output as only as accurate as the threat model and context you provided.
Do not use it in place of a qualified security review or a compliance audit.
- Check every requirement against your actual threat model
- Confirm compliance mappings with the people responsible for them
- Review priorities and risk levels with stakeholders
Tips for better results
Follow the skill's own practices. Trace every requirement to a threat, make requirements specific enough to test, and include acceptance criteria that define done. Avoid generic wording such as "be secure", which cannot be verified.
Ask for rationale with each requirement so reviewers can see why it matters, and involve stakeholders before treating the list as final.
- Trace every requirement to at least one threat
- Ask for acceptance criteria with each user story
- Reject vague requirements that cannot be tested
- Revisit the list as threats change
What people use it for
- Converting an existing threat model into a list of security requirements
- Writing security user stories with acceptance criteria for a developer team
- Drafting security test cases for a new feature such as password reset
- Mapping security work to compliance frameworks such as PCI DSS, HIPAA or GDPR
Frequently asked questions
How do I install the security-requirement-extraction skill?
Download the skill ZIP from this page. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
Does the skill need any requirements or dependencies?
The listing shows no required tools. It does not run scripts and does not use the network, so it only guides the agent's written output.
Is the security-requirement-extraction skill free?
The source material provided for this page states the licence as MIT. It does not list pricing, so check the licence text for terms.
Can this skill find vulnerabilities in my code?
No. The skill produces requirements documents and does not analyse your system or scan code. Use a dedicated security tool or a qualified reviewer for vulnerability testing.
What are the alternatives to this skill?
Any approach that turns threat models into requirements works, including writing requirements manually or using a threat modelling workshop. This skill's value is a consistent structure with classifications, attributes and templates.
Why isn't the skill triggering when I ask for security requirements?
Make the request concrete and mention the threats, requirements or user stories you want. Confirm the folder is correct (~/.claude/skills/ or the project's .claude/skills/) and that SKILL.md is inside the skill folder.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security engineer, architect or developer who already has a threat model or feature context and needs structured requirements, user stories or test cases. Pick something else if you need to find or test real vulnerabilities in code, or if you need a formal compliance audit, since the skill only produces requirement documents from the context you supply.
Download the skill