mcpField
S
security-requirement-extraction

security-requirement-extraction

github.com/wshobsonSecurity41.9k25.5k installsUpdated 2w ago
Repository

About security-requirement-extraction

This skill turns threat analysis into actionable security requirements for teams writing security stories, tests, and acceptance criteria. It emphasizes traceability to threats, testability, priority, and risk.

Key features

  1. 01Convert threat models into requirements
  2. 02Write security stories and test cases
  3. 03Define acceptance criteria and map compliance
  4. 04Record traceability, priority, and risk

Use cases

  1. 01Turn threat analysis into verifiable requirements
  2. 02Write stories for security features
  3. 03Create security tests and acceptance criteria

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wshobson/agents --skill security-requirement-extraction

After installing, type/security-requirement-extractionin Claude Code to confirm it loaded.

Bundled filesreferences/details.md

Details

From the project README

Security Requirement Extraction

Transform threat analysis into actionable security requirements.

When to Use This Skill

  • Converting threat models to requirements
  • Writing security user stories
  • Creating security test cases
  • Building security acceptance criteria
  • Compliance requirement mapping
  • Security architecture documentation

Core Concepts

1. Requirement Categories
Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"
2. Security Requirement Types
TypeFocusExample
FunctionalWhat system must do"System must authenticate users"
Non-functionalHow system must perform"Authentication must complete in <2s"
ConstraintLimitations imposed"Must use approved crypto libraries"
3. Requirement Attributes
AttributeDescription
TraceabilityLinks to threats/compliance
TestabilityCan be verified
PriorityBusiness importance
Risk LevelImpact if not met

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's
  • Trace to threats - Every requirement should map to threats
  • Be specific - Vague requirements can't be tested
  • Include acceptance criteria - Define "done"
  • Consider compliance - Map to frameworks early
  • Review regularly - Requirements evolve with threats
Don'ts
  • Don't be generic - "Be secure" is not a requirement
  • Don't skip rationale - Explain why it matters
  • Don't ignore priorities - Not all requirements are equal
  • Don't forget testability - If you can't test it, you can't verify it
  • Don't work in isolation - Involve stakeholders

Comments

Markdown supported