security-requirement-extraction

Generate security requirements, user stories, and test cases from threat models.

2|Updated Jan 18, 2026

Search Tags:#security #requirements #threat modeling #compliance #user stories #test cases

Ready to run

npx skills add https://github.com/as4584/antigravity-skills --skill security-requirement-extraction-as4584

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-requirement-extraction
Source: https://github.com/as4584/antigravity-skills/tree/main/agents-wshobson/plugins/security-scanning/skills/security-requirement-extraction
Command: npx skills add https://github.com/as4584/antigravity-skills --skill security-requirement-extraction-as4584

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of translating high-level threat models and business context into specific, actionable security requirements, user stories, and test cases.

Core Features & Use Cases

Threat to Requirement Mapping: Automatically generates security requirements based on threat categories (e.g., STRIDE).
Requirement Categorization: Organizes requirements by type (Functional, Non-functional, Constraint) and security domain.
Compliance Mapping: Links requirements to relevant compliance frameworks (e.g., PCI-DSS, GDPR).
Use Case: After a threat modeling session identifies a "Tampering" threat against user data, this Skill can generate requirements like "Validate all input to the user profile" and "Implement integrity checks for user data," complete with acceptance criteria and test cases.

Quick Start

Use the security-requirement-extraction skill to derive security requirements from the provided threat model document.

Frequently Asked Questions about security-requirement-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate security requirements from a threat model?▼

To generate security requirements from a threat model, you input your threat categories like STRIDE and business context to automatically derive actionable requirements, user stories, and test cases. This translates identified threats into specific development tasks.

What is the best way to map security requirements to compliance frameworks?▼

Mapping security requirements to compliance frameworks is achieved by categorizing generated requirements by security domain and linking them to relevant frameworks like PCI-DSS, HIPAA, and GDPR. This ensures your threat modeling outputs align with regulatory mandates.

Can I create security user stories and test cases from STRIDE threat categories?▼

Yes, you can create security user stories and test cases from STRIDE threat categories by processing your threat model. For example, a Tampering threat generates requirements for input validation and integrity checks, complete with acceptance criteria.

Does this security requirement generation approach support gap analysis for OWASP?▼

Yes, this approach supports gap analysis for OWASP alongside PCI-DSS, HIPAA, and GDPR. It categorizes requirements into functional, non-functional, and constraint types to identify missing security controls within your existing business context.

What do I need to provide to extract actionable security requirements?▼

You need to provide a threat model document and relevant business context to extract actionable security requirements. The process utilizes structured data definitions to translate these inputs into categorized requirements and compliance mappings.