security-requirement-extraction

Generate security requirements, user stories, and test cases from threat models.

Updated Feb 26, 2026

Search Tags:#security #requirements #threat modeling #compliance #user stories #test cases

Ready to run

npx skills add https://github.com/TheGreatL/KanbanBoard --skill security-requirement-extraction-thegreatl

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-requirement-extraction
Source: https://github.com/TheGreatL/KanbanBoard/tree/main/.agents/skills/security-requirement-extraction
Command: npx skills add https://github.com/TheGreatL/KanbanBoard --skill security-requirement-extraction-thegreatl

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates the process of translating identified security threats and business context into actionable security requirements, user stories, and test cases.

Core Features & Use Cases

Requirement Generation: Automatically creates detailed security requirements based on threat models (e.g., STRIDE).
User Story Creation: Generates security-focused user stories for agile development.
Test Case Development: Produces relevant test cases and acceptance criteria for verification.
Compliance Mapping: Maps requirements to common compliance frameworks like PCI DSS, HIPAA, and GDPR.
Use Case: After a threat modeling session identifies a "Tampering" threat against user data, this Skill can generate requirements like "Validate all input to the user profile" and "Implement integrity checks for user data," along with corresponding user stories and test cases.

Quick Start

Use the security-requirement-extraction skill to generate security requirements from the provided threat model data.

Frequently Asked Questions about security-requirement-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I translate threat modeling results into actionable security requirements?▼

To translate threat modeling results into security requirements, you can automate the extraction of detailed security controls, user stories, and test cases from identified threats and business context. This bridges the gap between threat identification and development implementation.

Can I generate security user stories and test cases from a STRIDE threat model?▼

Yes, you can generate security user stories and test cases from a STRIDE threat model. The process derives agile development stories and verification acceptance criteria directly from identified threats like tampering or spoofing.

How do I map security requirements to compliance frameworks like PCI DSS, HIPAA, and GDPR?▼

You can map security requirements to compliance frameworks like PCI DSS, HIPAA, and GDPR by deriving the controls from threat models and business context. This ensures generated security requirements align directly with regulatory obligations.

What is the best way to automate creating security test cases from identified threats?▼

The best way to automate creating security test cases from identified threats is using structured mapping logic that processes threat models. This yields relevant test cases and acceptance criteria for verifying that specific threats are mitigated.

Do I need to provide business context when deriving security requirements from threats?▼

Yes, providing business context is necessary when deriving security requirements from threats. The context ensures the generated security requirements, user stories, and test cases accurately reflect the application's specific environment and risks.

How does structured data mapping support security requirement generation?▼

Structured data mapping supports security requirement generation by using dataclasses and enums to define and map requirements logically. This structure ensures threats are consistently translated into actionable requirements and compliance mappings.