skills.rest
jaskaranhundal
jaskaranhundalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-requirements-review

Analyze design documents for security gaps and map findings to MITRE ATT&CK.

3|3|Updated Mar 8, 2026
Search Tags:#architecture#security#requirements#threat modeling#compliance#devsecops
One-click install
npx skills add https://github.com/jaskaranhundal/usap-skills --skill security-requirements-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-requirements-review
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/appsec-devsecops/security-requirements-review
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill security-requirements-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill proactively identifies security design flaws in requirements and architecture documents before any code is written or deployed, preventing costly rework and security vulnerabilities.

Core Features & Use Cases

  • Early-Stage Security Review: Analyze PRDs, architecture docs, and POA&Ms for security gaps.
  • Threat Surface Mapping: Automatically maps identified risks to MITRE ATT&CK techniques.
  • Use Case: Before building a new feature, feed its Product Requirements Document (PRD) into this Skill to ensure security is considered from the outset, identifying potential data exposure or authentication issues early.

Quick Start

Use the security-requirements-review skill to analyze the attached document 'new-feature-prd.md'.

Frequently Asked Questions about security-requirements-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review architecture documents for security gaps before development?▼

A POA&M can be analyzed for security design flaws using deterministic security analysis to identify compliance risks and critical gaps. This process maps findings to MITRE ATT&CK techniques, ensuring threat surface vulnerabilities are documented and routed for remediation.

What is the best way to map security requirements to MITRE ATT&CK techniques?▼

Yes, you can use a Product Requirements Document (PRD) for early-stage threat modeling by feeding it into a security analysis process. This identifies potential data exposure and authentication issues from the outset, preventing security vulnerabilities before deployment.

Does DevSecOps threat modeling require analyzing POA&Ms and architecture docs?▼

DevSecOps threat modeling requires analyzing POA&Ms and architecture docs to proactively identify security design flaws and compliance risks. Handling these document formats ensures security requirements are integrated before any code is deployed.

How do I route identified security risks to downstream compliance mapping?▼

To route identified security risks to downstream compliance mapping, you perform a security requirements review that outputs structured findings mapped to MITRE ATT&CK. These mapped findings are then directly routed to downstream analysis skills for compliance evaluation.

Related Skills

Explore More Software Engineering Skills→
davidrrowleydavidrrowley

threat-modelling

Produce structured STRIDE threat models with DFD diagrams and DREAD scoring.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
fakhriaditiarahmanfakhriaditiarahman
1

security-auditor

Audit application code and infrastructure for security vulnerabilities and compliance.

Community
Advanced
sevenbelowllcsevenbelowllc

senior-security

Automate threat modeling, security auditing, and penetration testing for applications.

Official
Advanced