security-requirement-extraction – Security skill for AI agents
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
Install the security-requirement-extraction skill with one command
Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.
Claude Code
mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/security-requirement-extraction-ee337.tgz | tar xz -C ~/.claude/skills
Call it in Claude Code: /security-requirement-extraction – then describe the task you want done.
Codex
mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/security-requirement-extraction-ee337.tgz | tar xz -C ~/.codex/skills
Call it in Codex: $security-requirement-extraction – then describe the task you want done.
Hermes Agent
mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/security-requirement-extraction-ee337.tgz | tar xz -C ~/.hermes/skills
Call it in Hermes Agent: /security-requirement-extraction – then describe the task you want done.
DeepSeek
mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/security-requirement-extraction-ee337.tgz | tar xz -C ~/.deepcode/skills
Call it in DeepSeek: /security-requirement-extraction – then describe the task you want done.
SKILL.md content
Security Requirement Extraction
Transform threat analysis into actionable security requirements.
When to Use This Skill
- Converting threat models to requirements
- Writing security user stories
- Creating security test cases
- Building security acceptance criteria
- Compliance requirement mapping
- Security architecture documentation
Core Concepts
1. Requirement Categories
Business Requirements → Security Requirements → Technical Controls
↓ ↓ ↓
"Protect customer "Encrypt PII at rest" "AES-256 encryption
data" with KMS key rotation"2. Security Requirement Types
| Type | Focus | Example |
| ------------------ | ----------------------- | ------------------------------------- |
| Functional | What system must do | "System must authenticate users" |
| Non-functional | How system must perform | "Authentication must complete in <2s" |
| Constraint | Limitations imposed | "Must use approved crypto libraries" |
3. Requirement Attributes
| Attribute | Description |
| ---------------- | --------------------------- |
| Traceability | Links to threats/compliance |
| Testability | Can be verified |
| Priority | Business importance |
| Risk Level | Impact if not met |
Templates and detailed worked examples
Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.
Best Practices
Do's
- Trace to threats - Every requirement should map to threats
- Be specific - Vague requirements can't be tested
- Include acceptance criteria - Define "done"
- Consider compliance - Map to frameworks early
- Review regularly - Requirements evolve with threats
Don'ts
- Don't be generic - "Be secure" is not a requirement
- Don't skip rationale - Explain why it matters
- Don't ignore priorities - Not all requirements are equal
- Don't forget testability - If you can't test it, you can't verify it
- Don't work in isolation - Involve stakeholders
Related skills
- staging-subdomain-hunt – Hunt staging via crt.sh when production is WAF-hardened.
- subdomain-enumeration – Map subdomains via crt.sh and subfinder at recon kickoff.
- scholar-evaluation – Provides qualitative-first, evidence-traceable developmental review of scholarly works…
- subdomain-takeover-hunt – Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
- cyber-audit – Run read-only exposure checks for security advisories and write a structured local audit…
- signed-audit-trails-recipe – Step-by-step cookbook for setting up cryptographically signed audit trails on Claude…
- supply-chain-attack-recon – External recon for software supply-chain attack surface — package-namespace squatting…
- darkmoon-pentest – Start, follow and triage authorized autonomous AI pentest runs on a self-hosted Darkmoon…