Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor

security-requirement-extraction — Claude skill: threats into

Turns a threat model and business context into testable security requirements: user stories, acceptance criteria, test cases.

Install into Claude Code · Plugin marketplace All methods and platforms ↓ 
/plugin marketplace add wshobson/agents
/plugin install security-scanning@claude-code-workflows
Open on GitHub

What security-requirement-extraction does

The skill takes threat analysis and sorts it across three layers: business requirement, security requirement, technical control. “Protect customer data” becomes “encrypt PII at rest”, which then becomes a concrete control with key rotation.

It works with requirement categories — functional, non-functional, constraint — and four attributes: traceability to threats, testability, priority, risk level. Templates and worked examples sit in references/details.md, loaded when you need them.

You need a threat model first. Without one there is nothing to trace requirements back to, and the output stays generic. Worth installing if you maintain security documentation and write acceptance criteria for a team; skip it for quick code fixes.

What it helps with

  • turn threats from a model into concrete requirements
  • write security user stories with acceptance criteria
  • build test cases that verify security requirements
  • map requirements to compliance framework clauses
  • assign priority and risk level to each requirement

Example prompts for the agent

  • Take my threat model and derive security requirements by category
  • Write security user stories with acceptance criteria from this threat list
  • Build test cases for the requirements in `references/details.md`

How to install security-requirement-extraction

1Plugin marketplace

/plugin marketplace add wshobson/agents
/plugin install security-scanning@claude-code-workflows

This installs the whole security-scanning plugin with all its skills

2Skills CLI (Vercel)

npx skills add wshobson/agents --skill security-requirement-extraction -a claude-code

3Manually: put the files in place

~/.claude/skills/security-requirement-extraction/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/security-requirement-extraction/

From the same set213

The whole set →
typescript-advanced-types Seth Hobson Guides an agent through advanced TypeScript types, from generics to conditional and mapped types. Use it for typed libraries, API clients, or strict configuration objects. Claude Code CX Codex Cursor 92,169installs tailwind-design-system Seth Hobson Helps build design systems with Tailwind CSS v4, from theme tokens to component variants. Use it when a project needs shared UI patterns. Claude Code CX Codex Cursor 70,180installs brand-landingpage Travis D. Elliott This skill interviews you about the product and its visual direction, then builds a landing page through Stitch. Use it when there’s no established design yet. Claude Code CX Codex Cursor 39,476installs python-testing-patterns Seth Hobson This skill guides Python testing with pytest, fixtures and mocks. Use it when building a test suite or tracking down failing checks. Claude Code CX Codex Cursor 36,943installs python-performance-optimization Seth Hobson This skill profiles Python code to locate CPU and memory bottlenecks. Use it when an application responds slowly or consumes too many resources. Claude Code CX Codex Cursor 35,675installs nextjs-app-router-patterns Seth Hobson This skill covers Next.js App Router patterns for rendering, routing, and data fetching. Use it when starting an App Router project or moving from Pages Router. Claude Code CX Codex Cursor 32,529installs api-design-principles Seth Hobson Use this skill to plan or review REST and GraphQL APIs. It helps when writing a specification or setting API conventions for a team. Claude Code CX Codex Cursor 30,348installs code-review-excellence Seth Hobson This skill guides pull request reviews, catches logic and security issues, and helps teams give specific feedback. Use it for review standards or developer mentoring. Claude Code CX Codex Cursor 30,193installs

Similar

agent-governance official github Provides governance patterns for AI agents that use APIs, databases, or file systems. Use it when agent actions need policy checks, threat detection, and audit records. GitHub Copilot 9,623installs azure-deployment-preflight official github Checks Azure Bicep deployments before they run, including syntax, permissions, and planned changes. Use it before azd provision or az deployment. GitHub Copilot 9,591installs agent-platform-migrate-from-ai-studio official google Guides a Gemini API migration from Google AI Studio to Gemini Enterprise Agent Platform. Use it when the app needs Google Cloud billing, IAM, or shared infrastructure. Claude Code Gemini CLI CX Codex 7,934installs azure-role-selector official github This skill selects an Azure role with the least privilege needed for an identity and shows how to assign it. Use it when Azure access needs a careful RBAC match. GitHub Copilot 9,399installs debian-linux-triage official github This skill troubleshoots Debian Linux issues with apt, systemd, and dpkg, while accounting for AppArmor and firewall concerns. Use it for guided diagnosis. GitHub Copilot 9,197installs access official anthropics This skill manages Telegram channel access through a local JSON file. Use it for pairings, allowlists, and DM or group policy changes. Claude Code 3,867installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about security-requirement-extraction

How do I install security-requirement-extraction in Claude?

Through the plugin marketplace: /plugin marketplace add wshobson/agents, then /plugin install security-scanning@claude-code-workflows. Or run npx skills add wshobson/agents --skill security-requirement-extraction -a claude-code.

What does security-requirement-extraction do?

It converts a threat model and business context into security requirements: user stories, acceptance criteria, test cases. Each requirement traces back to a threat and carries a priority and risk level.

What do I need before using it?

A threat model, or at least a list of threats. Without one there is nothing to trace requirements to, and the result will be generic.

Source text

SKILL.md · MIT 
---
name: security-requirement-extraction
description: Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
---

# Security Requirement Extraction

Transform threat analysis into actionable security requirements.

## When to Use This Skill

- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation

## Core Concepts

### 1. Requirement Categories

```
Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"
```

### 2. Security Requirement Types

| Type               | Focus                   | Example                               |
| ------------------ | ----------------------- | ------------------------------------- |
| **Functional**     | What system must do     | "System must authenticate users"      |
| **Non-functional** | How system must perform | "Authentication must complete in <2s" |
| **Constraint**     | Limitations imposed     | "Must use approved crypto libraries"  |

### 3. Requirement Attributes

| Attribute        | Description                 |
| ---------------- | --------------------------- |
| **Traceability** | Links to threats/compliance |
| **Testability**  | Can be verified             |
| **Priority**     | Business importance         |
| **Risk Level**   | Impact if not met           |

## Templates and detailed worked examples

Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill.

## Best Practices

### Do's

- **Trace to threats** - Every requirement should map to threats
- **Be specific** - Vague requirements can't be tested
- **Include acceptance criteria** - Define "done"
- **Consider compliance** - Map to frameworks early
- **Review regularly** - Requirements evolve with threats

### Don'ts

- **Don't be generic** - "Be secure" is not a requirement
- **Don't skip rationale** - Explain why it matters
- **Don't ignore priorities** - Not all requirements are equal
- **Don't forget testability** - If you can't test it, you can't verify it
- **Don't work in isolation** - Involve stakeholders

© Seth Hobson · MIT · wshobson/agents

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor