Security Requirement Extraction
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor◐PartialPlain prose you can paste in — but no Cursor rules file
Codex◐PartialPlain prose you can paste in — but no AGENTS.md
Gemini CLI◐PartialPlain prose you can paste in
Copilot◐PartialPlain prose you can paste in — but no Copilot instructions file
npx agentalley add security-requirement-extractionWho is stuck, and on what
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
The whole source
Frontmatter — 2 properties
| name | security-requirement-extraction |
|---|---|
| description | Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases. |
| 1 | --- |
| 2 | name: security-requirement-extraction |
| 3 | description: Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # Security Requirement Extraction |
| 7 | |
| 8 | Transform threat analysis into actionable security requirements. |
| 9 | |
| 10 | ## When to Use This Skill |
| 11 | |
| 12 | - Converting threat models to requirements |
| 13 | - Writing security user stories |
| 14 | - Creating security test cases |
| 15 | - Building security acceptance criteria |
| 16 | - Compliance requirement mapping |
| 17 | - Security architecture documentation |
| 18 | |
| 19 | ## Core Concepts |
| 20 | |
| 21 | ### 1. Requirement Categories |
| 22 | |
| 23 | ``` |
| 24 | Business Requirements → Security Requirements → Technical Controls |
| 25 | ↓ ↓ ↓ |
| 26 | "Protect customer "Encrypt PII at rest" "AES-256 encryption |
| 27 | data" with KMS key rotation" |
| 28 | ``` |
| 29 | |
| 30 | ### 2. Security Requirement Types |
| 31 | |
| 32 | | Type | Focus | Example | |
| 33 | | ------------------ | ----------------------- | ------------------------------------- | |
| 34 | | **Functional** | What system must do | "System must authenticate users" | |
| 35 | | **Non-functional** | How system must perform | "Authentication must complete in <2s" | |
| 36 | | **Constraint** | Limitations imposed | "Must use approved crypto libraries" | |
| 37 | |
| 38 | ### 3. Requirement Attributes |
| 39 | |
| 40 | | Attribute | Description | |
| 41 | | ---------------- | --------------------------- | |
| 42 | | **Traceability** | Links to threats/compliance | |
| 43 | | **Testability** | Can be verified | |
| 44 | | **Priority** | Business importance | |
| 45 | | **Risk Level** | Impact if not met | |
| 46 | |
| 47 | ## Templates and detailed worked examples |
| 48 | |
| 49 | Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill. |
| 50 | |
| 51 | ## Best Practices |
| 52 | |
| 53 | ### Do's |
| 54 | |
| 55 | - **Trace to threats** - Every requirement should map to threats |
| 56 | - **Be specific** - Vague requirements can't be tested |
| 57 | - **Include acceptance criteria** - Define "done" |
| 58 | - **Consider compliance** - Map to frameworks early |
| 59 | - **Review regularly** - Requirements evolve with threats |
| 60 | |
| 61 | ### Don'ts |
| 62 | |
| 63 | - **Don't be generic** - "Be secure" is not a requirement |
| 64 | - **Don't skip rationale** - Explain why it matters |
| 65 | - **Don't ignore priorities** - Not all requirements are equal |
| 66 | - **Don't forget testability** - If you can't test it, you can't verify it |
| 67 | - **Don't work in isolation** - Involve stakeholders |
| 68 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.◐◐◐◐◐●30/40