# Security Requirement Extraction

> Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

Source: https://skillsagentes.com/skills/wshobson/agents/security-requirement-extraction
Repository: https://github.com/wshobson/agents
Author: wshobson
License: MIT
Updated: hace 2 meses
Context cost: 48 tok installed, 634 tok once triggered, 6.1k tok with every bundled file
Bundle: 2 files, 24 KB
Permissions requested: none declared

## Install

```bash
npx -y skills add wshobson/agents --skill security-requirement-extraction --agent claude-code
```

## What it does

- Convierte modelos de amenazas y contexto de negocio en requisitos de seguridad accionables
- Clasifica requisitos en funcionales, no funcionales y de restricción
- Define atributos de requisitos: trazabilidad, verificabilidad, prioridad y nivel de riesgo
- Remite a `references/details.md` para plantillas y ejemplos detallados

## Use it when

- Convertir modelos de amenazas en requisitos
- Escribir historias de usuario de seguridad
- Crear casos de prueba de seguridad
- Construir criterios de aceptación de seguridad o mapear requisitos de cumplimiento

## What triggers it

- "Convierte este modelo de amenazas en requisitos de seguridad"
- "Escríbeme historias de usuario de seguridad para este módulo"
- "Necesito casos de prueba de seguridad trazables a las amenazas identificadas"

## Before you install

- Consulta `references/details.md` para plantillas y ejemplos completos.

## Files

- SKILL.md — 2 KB
- references/details.md — 21 KB

## SKILL.md

Reproduced verbatim from wshobson/agents under MIT. This section is the upstream document and is in English.

# Security Requirement Extraction

Transform threat analysis into actionable security requirements.

## When to Use This Skill

- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation

## Core Concepts

### 1. Requirement Categories

```
Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"
```

### 2. Security Requirement Types

| Type               | Focus                   | Example                               |
| ------------------ | ----------------------- | ------------------------------------- |
| **Functional**     | What system must do     | "System must authenticate users"      |
| **Non-functional** | How system must perform | "Authentication must complete in <2s" |
| **Constraint**     | Limitations imposed     | "Must use approved crypto libraries"  |

### 3. Requirement Attributes

| Attribute        | Description                 |
| ---------------- | --------------------------- |
| **Traceability** | Links to threats/compliance |
| **Testability**  | Can be verified             |
| **Priority**     | Business importance         |
| **Risk Level**   | Impact if not met           |

## Templates and detailed worked examples

Full template library lives in `references/details.md`. Read that file when you need concrete templates for this skill.

## Best Practices

### Do's

- **Trace to threats** - Every requirement should map to threats
- **Be specific** - Vague requirements can't be tested
- **Include acceptance criteria** - Define "done"
- **Consider compliance** - Map to frameworks early
- **Review regularly** - Requirements evolve with threats

### Don'ts

- **Don't be generic** - "Be secure" is not a requirement
- **Don't skip rationale** - Explain why it matters
- **Don't ignore priorities** - Not all requirements are equal
- **Don't forget testability** - If you can't test it, you can't verify it
- **Don't work in isolation** - Involve stakeholders

---

Skills Agentes — https://skillsagentes.com/skills/wshobson/agents/security-requirement-extraction