Verified:GitHub

security-requirement-extraction

Convert threat models and business context into actionable security requirements.

Updated May 16, 2026

Search Tags:#owasp #threat modeling #acceptance criteria #user stories #test cases #security requirements #compliance mapping

Ready to run

npx skills add https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory --skill security-requirement-extraction-p-o-ke-nae

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-requirement-extraction
Source: https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory/tree/main/.github/skills/security-requirement-extraction
Command: npx skills add https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory --skill security-requirement-extraction-p-o-ke-nae

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill turns threat analysis and business context into clear, actionable security requirements, avoiding vague security goals that cannot be implemented or verified.

Core Features & Use Cases

Threat-to-Requirement Translation: Converts STRIDE-style threats into functional, non-functional, and constraint requirements.
Security User Stories and Test Cases: Produces security-focused user stories, acceptance criteria, and test ideas that teams can execute.
Compliance Mapping: Links requirements to frameworks such as OWASP, GDPR, HIPAA, and PCI DSS to support audits and traceability.
Use Case: A security architect can feed in a set of threats for an API and receive prioritized requirements, test cases, and compliance coverage in a structured format.

Quick Start

Provide a threat model and business context, and ask the skill to convert them into testable security requirements with acceptance criteria and traceability.

Frequently Asked Questions about security-requirement-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I convert threat modeling results into testable security requirements?▼

To convert threat modeling results into testable security requirements, you provide the threat model and business context to generate prioritized functional, non-functional, and constraint requirements. This process translates STRIDE-style threats into actionable items with acceptance criteria and compliance alignment.

What is the best way to map security requirements to OWASP and compliance frameworks?▼

The best way to map security requirements to OWASP and compliance frameworks is by linking generated constraints directly to standards like GDPR, HIPAA, and PCI DSS. This creates a traceability matrix that supports audits and ensures coverage across software systems.

Can I generate security user stories and acceptance criteria from a threat model?▼

Yes, you can generate security user stories and acceptance criteria from a threat model by processing STRIDE-style threats and business context. This yields security-focused user stories complete with test ideas and prioritized requirements that development teams can directly execute.

How do I create security test cases based on threat modeling for an API?▼

You create security test cases based on threat modeling for an API by feeding the specific API threats and business context into a translation process. This generates structured security test ideas and acceptance criteria mapped to compliance frameworks like OWASP.

Does converting STRIDE threats into security requirements work without specific business context?▼

Converting STRIDE threats into security requirements relies heavily on specific business context to prioritize accurately. Without business context, the generated security requirements risk being vague, unactionable, or misaligned with the actual software system constraints and compliance needs.