Security Requirement Extraction
Turns threat models and business context into testable security requirements and test cases
- Repository
- wshobson/agents
- Stars
- 42,095
- Licence
- MIT
- Files
- 2 files
What it does
When installed, this skill teaches an AI agent a structured method for converting threat analysis into security requirements. The agent maps business goals to security requirements to technical controls, classifies each requirement (functional, non-functional, or constraint), and attaches attributes such as traceability, testability, priority, and risk level. It also points the agent to a reference file with templates and worked examples for writing user stories, acceptance criteria, and test cases.
Great for
- Security engineers or architects writing requirements from an existing threat model
- Developers who need security user stories or acceptance criteria for a feature
- Teams mapping security work to compliance frameworks
Skip it if
- Finding or testing actual vulnerabilities in code, since the skill produces requirements documents rather than scans (it does not analyze your system)
- Replacing a qualified security review or compliance audit, since the output is only as accurate as the threat model and context you provide
Try asking
- “Turn this threat model for our payment API into security requirements with acceptance criteria”
- “Write security user stories for a new customer login feature”
- “Create security test cases for requirements about encrypting PII at rest”
- “Map these threats to requirements traceable to SOC 2 controls”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
security-requirement-extraction.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip security-requirement-extraction.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip security-requirement-extraction.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Provide a concrete threat model or list of threats and business context; vague input produces generic requirements.
- Ask for traceability links and priorities so each requirement can be checked against its source threat.
- Review the output against your own compliance obligations, since the skill does not verify framework mappings.
What's inside
- references/details.md
- SKILL.md
Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.