AutoGineer
Generated banner for Security Requirement Extraction
Generated logo for Security Requirement Extraction

Security Requirement Extraction

Seth HobsonCommunityCreated by Seth Hobson

  • Skill
  • Content generator
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a systematic framework for deriving security requirements from threat analysis and business objectives. It emphasizes the importance of traceability, testability, and clear prioritization, ensuring that security measures are not just abstract goals but concrete, verifiable technical controls. By utilizing defined requirement categories—functional, non-functional, and constraints—the skill helps bridge the gap between high-level security needs and implementation-ready specifications.

What it does

  • Maps business requirements to specific security controls
  • Converts threat models into actionable security user stories
  • Defines testable acceptance criteria for security features
  • Categorizes requirements by domain, priority, and risk level
  • Provides structure for compliance mapping and documentation
  • Facilitates the creation of test specifications from security requirements

When to use it

  • When translating identified threats into concrete development tasks
  • During the creation of security-focused user stories
  • When building security test cases and acceptance criteria
  • While documenting security architecture
  • When mapping security controls to compliance frameworks

Advantages

  • Ensures every security requirement is traceable to a specific threat
  • Promotes the creation of testable, non-vague security specifications
  • Standardizes the documentation of security requirements across teams
  • Helps prioritize security work based on business impact and risk
  • Facilitates clear communication between security and development stakeholders

Usage examples

“Convert the threat 'unauthorized access to PII' into a set of security requirements.”
The agent generates a structured requirement including a description, rationale, acceptance criteria, and test cases, mapped to the data protection domain.
“Create a security user story for an authentication requirement.”
The agent produces a formatted user story including the 'As a, I need to, So that' structure, along with specific acceptance criteria.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/wshobson/security-requirement-extraction/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip security-requirement-extraction.zip -d .agents/skills

Documentation by Seth Hobson

Security Requirement Extraction

Transform threat analysis into actionable security requirements.

When to Use This Skill

  • Converting threat models to requirements

  • Writing security user stories

  • Creating security test cases

  • Building security acceptance criteria

  • Compliance requirement mapping

  • Security architecture documentation

Core Concepts

1. Requirement Categories
Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"
2. Security Requirement Types
TypeFocusExample
FunctionalWhat system must do"System must authenticate users"
Non-functionalHow system must perform"Authentication must complete in <2s"
ConstraintLimitations imposed"Must use approved crypto libraries"
3. Requirement Attributes
AttributeDescription
TraceabilityLinks to threats/compliance
TestabilityCan be verified
PriorityBusiness importance
Risk LevelImpact if not met

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

  • Trace to threats - Every requirement should map to threats

  • Be specific - Vague requirements can't be tested

  • Include acceptance criteria - Define "done"

  • Consider compliance - Map to frameworks early

  • Review regularly - Requirements evolve with threats

Don'ts

  • Don't be generic - "Be secure" is not a requirement

  • Don't skip rationale - Explain why it matters

  • Don't ignore priorities - Not all requirements are equal

  • Don't forget testability - If you can't test it, you can't verify it

  • Don't work in isolation - Involve stakeholders

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/security-scanning/skills/security-requirement-extraction · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson or Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download security-requirement-extraction.zip