security-requirement-extraction Skill: Turn Threat Models Into Security Requirements

Helps Claude turn a threat model into specific, testable security requirements, user stories, test cases and compliance mappings.

Installs: 25.9K; on skills.sh
Stars: 42.1K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

security-requirement-extraction guides Claude from threats to requirements you can test. A requirement should trace back to a threat, say what must be true, carry acceptance criteria, and have a priority and a risk level. SKILL.md also describes three requirement types: functional, non-functional and constraint.

The templates are in references/details.md, which Claude reads when you need concrete output. It has four Python templates: a requirement model, a threat-to-requirement extractor, a compliance mapper and a security user story generator. It triggers when you convert threats to requirements, write security user stories, build security test cases or map compliance.

Good for

Security engineers converting a threat model into a requirements list
Product owners who need security user stories with acceptance criteria
Teams mapping requirements to frameworks such as PCI DSS, HIPAA, GDPR, SOC 2 or ISO 27001

Install security-requirement-extraction

Claude Code

Copy this prompt.

Install the security-requirement-extraction skill in Claude Code. Run this command:

npx skills add https://github.com/wshobson/agents --skill security-requirement-extraction

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

Sections in SKILL.md

When to Use This Skill
Core Concepts
1. Requirement Categories
2. Security Requirement Types
3. Requirement Attributes
Templates and detailed worked examples
Best Practices
Do's
Don'ts

Key facts

Author: wshobson (GitHub account that owns the repo)
License: MIT (as reported by GitHub)
What installs: 2 files including SKILL.md (references/details.md); no scripts
Lives in plugin: security-scanning, inside the wshobson/agents marketplace repo
Frameworks in the templates: PCI DSS, HIPAA, GDPR, SOC 2, NIST CSF, ISO 27001, OWASP
Installs on skills.sh: 25,929 (Nov 2, 2026)
GitHub stars: 42,081 (Nov 2, 2026)
Last commit: 2026-10-30
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk pass

What it includes

Business need, security requirement, technical control
Example in SKILL.md: protect customer data, encrypt personal data at rest, use AES-256 with key rotation.
Requirement chain
Functional, non-functional and constraint
What the system must do, how it must perform and what limits apply.
Requirement types
Traceability, testability, priority and risk level
Each requirement links to threats or compliance, can be verified, and has a business priority.
Requirement attributes
Python classes for requirements, domains, priorities and a traceability matrix
Can export a set as markdown and as test specs.
Write · Template 1: requirement model
Maps STRIDE categories to requirements, criteria and test cases
Priority comes from impact and likelihood.
Write · Template 2: threat-to-requirement extractor
Maps requirements to frameworks and finds gaps
Produces a compliance matrix and a gap analysis.
Write · Template 3: compliance mapping
Writes security user stories and epics from requirements
Each story carries acceptance criteria and test cases.
Write · Template 4: user story generator
Trace to threats, be specific, add criteria, plan for review
The do and do not list is in SKILL.md, for example that "Be secure" is not a requirement.
Best practices

From the official docs

Questions

What does security-requirement-extraction do?

It guides Claude to turn threat analysis into security requirements that are specific and testable. It also helps write security user stories, test cases and compliance mappings.

How do I install it?

Use the install box above, which installs this one skill. The wshobson/agents README says its skills-only installers add a skill without the plugin's agents, commands or hooks.

What do I give it?

A threat model or a list of threats, plus business context. A good prompt is "turn these STRIDE threats for our payments API into security requirements with acceptance criteria".

Does it run a scanner?

No. SKILL.md is guidance and templates for writing requirements. The templates in details.md are Python code you can ask Claude to adapt.

Which compliance frameworks does it know?

The compliance mapper in details.md lists PCI DSS, HIPAA, GDPR, SOC 2, NIST CSF, ISO 27001 and OWASP as framework options.

Is it safe?

It is guidance text and example code, with no bundled scripts. Treat generated requirements as a draft for a security person to review, because it does not check them against your real system.

Does it need an API key?

No. SKILL.md and details.md describe none.

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/security-scanning/skills/security-requirement-extraction

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

github.com · github.com
github.com · github.com
security-requirement-extraction on skills.sh · skills.sh
github.com · github.com