What kinds of security requirements can it produce?

It covers functional requirements, non-functional requirements, and constraints, and can also produce security user stories, acceptance criteria, and security test cases.

Does it work from threat models?

Yes. It is designed to derive security requirements from threat models and business context, and it recommends tracing every requirement back to a threat.

Where are the templates for this skill?

The full template library lives in references/details.md. The agent should read that file when it needs concrete templates.

Security Requirement Extraction

SkillSecurity

This skill guides an AI agent through deriving security requirements from threat models and business context. It helps translate identified threats into specific, testable requirements, security user stories, acceptance criteria, and security test cases. It also covers requirement types, attributes such as traceability and priority, and compliance requirement mapping.

Connect your AI Use it in a pipeline

Then ask your AI: use the Security Requirement Extraction skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; Ahel provides instructions and does not run this skill.

No other account needed.

Have a threat model or threat analysis available for the system you are working on.

What your AI can do with it

Convert threat models into actionable security requirements
Write security user stories and acceptance criteria
Create security test cases from requirements
Classify requirements as functional, non-functional, or constraint
Map requirements to threats and compliance frameworks
Apply attributes like traceability, testability, and priority

Getting started

Have a threat model or threat analysis available for the system you are working on.
Add the skill to your agent so it can read the skill definition and its reference file.
Provide the threat model and relevant business context to the agent.
Ask the agent to derive security requirements, user stories, or test cases from that input.
Review the output for traceability to threats and testability, and adjust priorities as needed.

What this skill tells your AI

The instructions your AI receives, as published by wshobson/agents in plugins/security-scanning/skills/security-requirement-extraction/SKILL.md and read by Ahel’s review.

Transform threat analysis into actionable security requirements.

When to Use This Skill

Converting threat models to requirements
Writing security user stories
Creating security test cases
Building security acceptance criteria
Compliance requirement mapping
Security architecture documentation

Core Concepts

1. Requirement Categories

Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"

2. Security Requirement Types

Type	Focus	Example
Functional	What system must do	"System must authenticate users"
Non-functional	How system must perform	"Authentication must complete in <2s"
Constraint	Limitations imposed	"Must use approved crypto libraries"

3. Requirement Attributes

Attribute	Description
Traceability	Links to threats/compliance
Testability	Can be verified
Priority	Business importance
Risk Level	Impact if not met

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

Trace to threats - Every requirement should map to threats
Be specific - Vague requirements can't be tested
Include acceptance criteria - Define "done"
Consider compliance - Map to frameworks early
Review regularly - Requirements evolve with threats

Don'ts

Don't be generic - "Be secure" is not a requirement
Don't skip rationale - Explain why it matters
Don't ignore priorities - Not all requirements are equal
Don't forget testability - If you can't test it, you can't verify it
Don't work in isolation - Involve stakeholders

Signals

GitHub stars: 40k
Forks: 4k
Last commit: Oct 2026

Questions

What kinds of security requirements can it produce?: It covers functional requirements, non-functional requirements, and constraints, and can also produce security user stories, acceptance criteria, and security test cases.
Does it work from threat models?: Yes. It is designed to derive security requirements from threat models and business context, and it recommends tracing every requirement back to a threat.
Where are the templates for this skill?: The full template library lives in references/details.md. The agent should read that file when it needs concrete templates.

Advanced

Item type: skill
Key: security-requirement-extraction
Source: github.com/wshobson/agents

github.com/wshobson/agents